aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLeo Famulari <leo@famulari.name>2016-10-05 13:15:29 -0400
committerLeo Famulari <leo@famulari.name>2016-10-05 17:37:21 -0400
commitb50c6bf2a8892211a9445289c4a127fe81b0b628 (patch)
treebd466f9f63b27caaf47561b143f2651ed6d82a58
parent13c10b4ca41e4c03a4d500a9fd0c25244c1faab6 (diff)
downloadguix-b50c6bf2a8892211a9445289c4a127fe81b0b628.tar
guix-b50c6bf2a8892211a9445289c4a127fe81b0b628.tar.gz
gnu: libxfixes: Fix CVE-2016-7944.
* gnu/packages/patches/libxfixes-CVE-2016-7944.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/xorg.scm (libxfixes)[replacement]: New field. (libxfixes/fixed): New variable.
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/patches/libxfixes-CVE-2016-7944.patch62
-rw-r--r--gnu/packages/xorg.scm8
3 files changed, 71 insertions, 0 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 03d07f60cf..9e875dec2c 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -671,6 +671,7 @@ dist_patch_DATA = \
%D%/packages/patches/libwmf-CVE-2015-4696.patch \
%D%/packages/patches/libx11-CVE-2016-7942.patch \
%D%/packages/patches/libx11-CVE-2016-7943.patch \
+ %D%/packages/patches/libxfixes-CVE-2016-7944.patch \
%D%/packages/patches/libxslt-generated-ids.patch \
%D%/packages/patches/lirc-localstatedir.patch \
%D%/packages/patches/llvm-for-extempore.patch \
diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
new file mode 100644
index 0000000000..2ce463fc46
--- /dev/null
+++ b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
@@ -0,0 +1,62 @@
+Fix CVE-2016-7944:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944
+
+Patch copied from upstream source repository:
+
+https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e
+
+From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Sun, 25 Sep 2016 22:38:44 +0200
+Subject: [PATCH] Integer overflow on illegal server response
+
+The 32 bit field "rep.length" is not checked for validity, which allows
+an integer overflow on 32 bit systems.
+
+A malicious server could send INT_MAX as length, which gets multiplied
+by the size of XRectangle. In that case the client won't read the whole
+data from server, getting out of sync.
+
+Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
+Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
+---
+ src/Region.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/src/Region.c b/src/Region.c
+index cb0cf6e..59bcc1a 100644
+--- a/src/Region.c
++++ b/src/Region.c
+@@ -23,6 +23,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include "Xfixesint.h"
+
+ XserverRegion
+@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy,
+ bounds->y = rep.y;
+ bounds->width = rep.width;
+ bounds->height = rep.height;
+- nbytes = (long) rep.length << 2;
+- nrects = rep.length >> 1;
+- rects = Xmalloc (nrects * sizeof (XRectangle));
++
++ if (rep.length < (INT_MAX >> 2)) {
++ nbytes = (long) rep.length << 2;
++ nrects = rep.length >> 1;
++ rects = Xmalloc (nrects * sizeof (XRectangle));
++ } else {
++ nbytes = 0;
++ nrects = 0;
++ rects = NULL;
++ }
++
+ if (!rects)
+ {
+ _XEatDataWords(dpy, rep.length);
+--
+2.10.1
+
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 83dfd5d798..5bd3aeec21 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -4823,6 +4823,7 @@ an X Window System display.")
(define-public libxfixes
(package
(name "libxfixes")
+ (replacement libxfixes/fixed)
(version "5.0.1")
(source
(origin
@@ -4847,6 +4848,13 @@ an X Window System display.")
(description "Library for the XFixes Extension to the X11 protocol.")
(license license:x11)))
+(define libxfixes/fixed
+ (package
+ (inherit libxfixes)
+ (source (origin
+ (inherit (package-source libxfixes))
+ (patches (search-patches
+ "libxfixes-CVE-2016-7944.patch"))))))
(define-public libxfont
(package