tree 2e3db9e407e4559f313700a8912e431cf96a5880
parent 9569f5cb5b4bffa9d3ebc8ba7da1e03830a9a895
author Mauro Matteo Cascella <mcascell@redhat.com> 1649319432 +0200
committer Gerd Hoffmann <kraxel@redhat.com> 1649327454 +0200

ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)

Prevent potential integer overflow by limiting 'width' and 'height' to
512x512. Also change 'datasize' type to size_t. Refer to security
advisory https://starlabs.sg/advisories/22-4206/ for more information.

Fixes: CVE-2021-4206
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20220407081712.345609-1-mcascell@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>