ac5c859b15
- cve-2007-5760.patch: XFree86-Misc Extension Invalid Array Index Vulnerability - cve-2007-5958.patch: Xorg / XFree86 file existence disclosure vulnerability - cve-2007-6427.patch: XInput Extension Memory Corruption Vulnerability - cve-2007-6428.patch: TOG-CUP Extension Memory Corruption Vulnerability - cve-2007-6429.patch: EVI and MIT-SHM Extension Integer Overflow Vulnerability
14 lines
527 B
Diff
14 lines
527 B
Diff
diff -up xorg-server-1.1.1/Xext/cup.c.jx xorg-server-1.1.1/Xext/cup.c
|
|
--- xorg-server-1.1.1/Xext/cup.c.jx 2006-07-05 14:31:36.000000000 -0400
|
|
+++ xorg-server-1.1.1/Xext/cup.c 2007-12-11 14:28:37.000000000 -0500
|
|
@@ -198,6 +198,9 @@ int ProcGetReservedColormapEntries(
|
|
|
|
REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
|
|
|
|
+ if (stuff->screen >= screenInfo.numScreens)
|
|
+ return BadValue;
|
|
+
|
|
#ifndef HAVE_SPECIAL_DESKTOP_COLORS
|
|
citems[CUP_BLACK_PIXEL].pixel =
|
|
screenInfo.screens[stuff->screen]->blackPixel;
|