← Back to branch summary

~ubuntu-branches/ubuntu/natty/virtualbox-ose/natty-updates

« back to all changes in this revision

Viewing changes to debian/patches/31-CVE-2011-2305.patch

  • Committer: Bazaar Package Importer
  • Author(s): Felix Geyer
  • Date: 2011-07-27 11:45:28 UTC
  • mfrom: (0.4.23 sid)
  • Revision ID: james.westby@ubuntu.com-20110727114528-51lcq87ih611m9us
Tags: 4.0.4-dfsg-1ubuntu4.1
https://launchpad.net/bugs/816874
* SECURITY UPDATE: possible arbitrary code execution on the host (LP: #816874)
  - debian/patches/31-CVE-2011-2305.patch: patch from upstream
  - CVE-2011-2305

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/31-CVE-2011-2305.patch
 
1
Description: crOpenGL: strict offset check
 
2
Origin: upstream, http://www.virtualbox.org/changeset/37432
 
3
Bug-Ubuntu: https://bugs.launchpad.net/bugs/816874
 
4
 
 
5
Index: trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp
 
6
===================================================================
 
7
--- trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp (revision 36846)
 
8
+++ trunk/src/VBox/HostServices/SharedOpenGL/crserver/crservice.cpp (revision 37432)
 
9
@@ -487,4 +487,10 @@
 
10
             if (pBuffer->uiId == iBuffer)
 
11
             {
 
12
+                if (pBuffer->uiSize!=cbBufferSize)
 
13
+                {
 
14
+                    LogRel(("SHARED_CROPENGL svcGetBuffer: invalid buffer(%i) size %i instead of %i\n",
 
15
+                            iBuffer, pBuffer->uiSize, cbBufferSize));
 
16
+                    return NULL;
 
17
+                }
 
18
                 return pBuffer;
 
19
             }
 
20
@@ -819,5 +825,5 @@
 
21
                 /* Execute the function. */
 
22
                 CRVBOXSVCBUFFER_t *pSvcBuffer = svcGetBuffer(iBuffer, cbBufferSize);
 
23
-                if (!pSvcBuffer || ui32Offset+cbBuffer>cbBufferSize)
 
24
+                if (!pSvcBuffer || ((uint64_t)ui32Offset+cbBuffer)>cbBufferSize)
 
25
                 {
 
26
                     rc = VERR_INVALID_PARAMETER;