pixman (X.org server) Integer Overflow

2014.01.19

Credit: Ritesh Khadgaray

Risk: Medium

Local: Yes

Remote: No

CVE: CVE-2013-6425

CWE: CWE-189

CVSS Base Score: 5/10

Impact Subscore: 2.9/10

Exploitability Subscore: 10/10

Exploit range: Remote

Attack complexity: Low

Authentication: No required

Confidentiality impact: None

Integrity impact: None

Availability impact: Partial

If t->bottom is close to MIN_INT (probably invalid value), subtracting top can lead to underflow which causes crashes. Attached patch will fix the issue. This fixes bug 67484.
diff --git a/pixman/pixman.h b/pixman/pixman.h
index 7ff9fb5..509ba5e 100644
--- a/pixman/pixman.h
+++ b/pixman/pixman.h
@@ -1030,7 +1030,7 @@ struct pixman_triangle
#define pixman_trapezoid_valid(t) \
((t)->left.p1.y != (t)->left.p2.y && \
(t)->right.p1.y != (t)->right.p2.y && \
- (int) ((t)->bottom - (t)->top) > 0)
+ ((t)->bottom > (t)->top))
struct pixman_span_fix
{

References:

http://cgit.freedesktop.org/pixman/commit/?id=5e14da97f16e421d084a9e735be21b1025150f0c

Vote for this issue:

50%

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}