{"push_id":633185145,"size":1,"distinct_size":1,"ref":"refs/heads/pr/arch-cleanup.CRAY","head":"10c40f06e4af9fdb5f34fd09c42c684705662078","before":"65543af56f4f97180b8dda998d5d7101d51ac1a3","commits":[{"sha":"10c40f06e4af9fdb5f34fd09c42c684705662078","author":{"email":"0532dd8bbbfb2150de1f2cc06d37fd5fc6dbb5d4@das-netzwerkteam.de","name":"Mike Gabriel"},"message":"MakeBigReq: don't move the last word, already handled by Data32 (X.Org CVE-2013-7439).\n\n MakeBigReq inserts a length field after the first 4 bytes of the request\n (after req->length), pushing everything else back by 4 bytes.\n\n The current memmove moves everything but the first 4 bytes back. If a\n request aligns to the end of the buffer pointer when MakeBigReq is\n invoked for that request, this runs over the buffer. Instead, we need to\n memmove minus the first 4 bytes (which aren't moved), minus the last 4\n bytes (so we still align to the previous tail).\n\n The 4 bytes that fell out are already handled with Data32, which will\n handle the buffermax correctly.\n\n The case where req->length = 1 was already not functional.\n\n Reported by Abhishek Arya <inferno@chromium.org> (against X.Org BTS).\n\n https://bugzilla.mozilla.org/show_bug.cgi?id=803762\n\n Reviewed-by: Jeff Muizelaar <jmuizelaar@mozilla.com>\n Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>\n Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>\n Rebased-for-NX: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>","distinct":true,"url":"https://api.github.com/repos/sunweaver/nx-libs/commits/10c40f06e4af9fdb5f34fd09c42c684705662078"}]}