pixman-general: Fix stack related pointer arithmetic overflow
authorSiarhei Siamashka <siarhei.siamashka@gmail.com>
Tue, 22 Sep 2015 01:25:40 +0000 (04:25 +0300)
committerOded Gabbay <oded.gabbay@gmail.com>
Tue, 22 Sep 2015 10:19:06 +0000 (13:19 +0300)
commit8b49d4b6b460d0c9299bca4ccddd7cd00d8f8441
tree311b374cd4baf19219509dd137dd102b2ba31021
parent4297e9058d252cac653723fe0b1bee559fbac3a4
pixman-general: Fix stack related pointer arithmetic overflow

As https://bugs.freedesktop.org/show_bug.cgi?id=92027#c6 explains,
the stack is allocated at the very top of the process address space
in some configurations (32-bit x86 systems with ASLR disabled).
And the careless computations done with the 'dest_buffer' pointer
may overflow, failing the buffer upper limit check.

The problem can be reproduced using the 'stress-test' program,
which segfaults when executed via setarch:

    export CFLAGS="-O2 -m32" && ./autogen.sh
    ./configure --disable-libpng --disable-gtk && make
    setarch i686 -R test/stress-test

This patch introduces the required corrections. The extra check
for negative 'width' may be redundant (the invalid 'width' value
is not supposed to reach here), but it's better to play safe
when dealing with the buffers allocated on stack.

Reported-by: Ludovic Courtès <ludo@gnu.org>
Signed-off-by: Siarhei Siamashka <siarhei.siamashka@gmail.com>
Reviewed-by: soren.sandmann@gmail.com
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
pixman/pixman-general.c