From c9b690e680af7197e8eec615c42bfcf4727e74ad Mon Sep 17 00:00:00 2001
From: matthieu <matthieu@openbsd.org>
Date: Tue, 14 Dec 2021 13:42:47 +0000
Subject: [PATCH] render: Fix out of bounds access in
 SProcRenderCompositeGlyphs()

ZDI-CAN-14192, CVE-2021-4008
---
 xserver/render/render.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/xserver/render/render.c b/xserver/render/render.c
index c376090ca..8c8f9a2d5 100644
--- a/xserver/render/render.c
+++ b/xserver/render/render.c
@@ -2309,6 +2309,8 @@ SProcRenderCompositeGlyphs(ClientPtr client)
 
         i = elt->len;
         if (i == 0xff) {
+            if (buffer + 4 >= end)
+                return BadLength;
             swapl((int *) buffer);
             buffer += 4;
         }
@@ -2320,12 +2322,16 @@ SProcRenderCompositeGlyphs(ClientPtr client)
                 break;
             case 2:
                 while (i--) {
+                    if (buffer + 2 >= end)
+                        return BadLength;
                     swaps((short *) buffer);
                     buffer += 2;
                 }
                 break;
             case 4:
                 while (i--) {
+                    if (buffer + 4 >= end)
+                        return BadLength;
                     swapl((int *) buffer);
                     buffer += 4;
                 }