diff options
Diffstat (limited to 'gnu/packages/patches/libxfixes-CVE-2016-7944.patch')
| -rw-r--r-- | gnu/packages/patches/libxfixes-CVE-2016-7944.patch | 62 |
1 files changed, 62 insertions, 0 deletions
diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch new file mode 100644 index 0000000000..2ce463fc46 --- /dev/null +++ b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch @@ -0,0 +1,62 @@ +Fix CVE-2016-7944: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944 + +Patch copied from upstream source repository: + +https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e + +From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann <tobias@stoeckmann.org> +Date: Sun, 25 Sep 2016 22:38:44 +0200 +Subject: [PATCH] Integer overflow on illegal server response + +The 32 bit field "rep.length" is not checked for validity, which allows +an integer overflow on 32 bit systems. + +A malicious server could send INT_MAX as length, which gets multiplied +by the size of XRectangle. In that case the client won't read the whole +data from server, getting out of sync. + +Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> +Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> +--- + src/Region.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/Region.c b/src/Region.c +index cb0cf6e..59bcc1a 100644 +--- a/src/Region.c ++++ b/src/Region.c +@@ -23,6 +23,7 @@ + #ifdef HAVE_CONFIG_H + #include <config.h> + #endif ++#include <limits.h> + #include "Xfixesint.h" + + XserverRegion +@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy, + bounds->y = rep.y; + bounds->width = rep.width; + bounds->height = rep.height; +- nbytes = (long) rep.length << 2; +- nrects = rep.length >> 1; +- rects = Xmalloc (nrects * sizeof (XRectangle)); ++ ++ if (rep.length < (INT_MAX >> 2)) { ++ nbytes = (long) rep.length << 2; ++ nrects = rep.length >> 1; ++ rects = Xmalloc (nrects * sizeof (XRectangle)); ++ } else { ++ nbytes = 0; ++ nrects = 0; ++ rects = NULL; ++ } ++ + if (!rects) + { + _XEatDataWords(dpy, rep.length); +-- +2.10.1 + |