gnu: libxfixes: Update to 5.0.3.

* gnu/packages/xorg.scm (libxfixes): Update to 5.0.3.
[replacement]: Remove field.
(libxfixes/fixed): Remove variable.
* gnu/packages/patches/libxfixes-CVE-2016-7944.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.

2 files changed, 2 insertions, 73 deletions

diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
deleted file mode 100644
index 2ce463fc46..0000000000
--- a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-Fix CVE-2016-7944:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944
-
-Patch copied from upstream source repository:
-
-https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e
-
-From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001
-From: Tobias Stoeckmann <tobias@stoeckmann.org>
-Date: Sun, 25 Sep 2016 22:38:44 +0200
-Subject: [PATCH] Integer overflow on illegal server response
-
-The 32 bit field "rep.length" is not checked for validity, which allows
-an integer overflow on 32 bit systems.
-
-A malicious server could send INT_MAX as length, which gets multiplied
-by the size of XRectangle. In that case the client won't read the whole
-data from server, getting out of sync.
-
-Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
-Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
----
- src/Region.c | 15 ++++++++++++---
- 1 file changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/src/Region.c b/src/Region.c
-index cb0cf6e..59bcc1a 100644
---- a/src/Region.c
-+++ b/src/Region.c
-@@ -23,6 +23,7 @@
- #ifdef HAVE_CONFIG_H
- #include <config.h>
- #endif
-+#include <limits.h>
- #include "Xfixesint.h"
- 
- XserverRegion
-@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display	    *dpy,
-     bounds->y = rep.y;
-     bounds->width = rep.width;
-     bounds->height = rep.height;
--    nbytes = (long) rep.length << 2;
--    nrects = rep.length >> 1;
--    rects = Xmalloc (nrects * sizeof (XRectangle));
-+
-+    if (rep.length < (INT_MAX >> 2)) {
-+	nbytes = (long) rep.length << 2;
-+	nrects = rep.length >> 1;
-+	rects = Xmalloc (nrects * sizeof (XRectangle));
-+    } else {
-+	nbytes = 0;
-+	nrects = 0;
-+	rects = NULL;
-+    }
-+
-     if (!rects)
-     {
- 	_XEatDataWords(dpy, rep.length);
--- 
-2.10.1
-
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 9899a7c8ac..02382586fc 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -4848,8 +4848,7 @@ an X Window System display.")
 (define-public libxfixes
   (package
     (name "libxfixes")
-    (replacement libxfixes/fixed)
-    (version "5.0.2")
+    (version "5.0.3")
     (source
       (origin
         (method url-fetch)
@@ -4859,7 +4858,7 @@ an X Window System display.")
                ".tar.bz2"))
         (sha256
           (base32
-            "1slsk898386xii0r3l7szwwq3s6y2m4dsj0x93ninjh8xkghxllv"))))
+            "1miana3y4hwdqdparsccmygqr3ic3hs5jrqfzp70hvi2zwxd676y"))))
     (build-system gnu-build-system)
     (propagated-inputs
       `(("fixesproto" ,fixesproto)))
@@ -4873,14 +4872,6 @@ an X Window System display.")
     (description "Library for the XFixes Extension to the X11 protocol.")
     (license license:x11)))
 
-(define libxfixes/fixed
-  (package
-    (inherit libxfixes)
-    (source (origin
-              (inherit (package-source libxfixes))
-              (patches (search-patches
-                         "libxfixes-CVE-2016-7944.patch"))))))
-
 (define-public libxfont
   (package
     (name "libxfont")