aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--gnu/local.mk1
-rw-r--r--gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch152
-rw-r--r--gnu/packages/xorg.scm13
3 files changed, 2 insertions, 164 deletions
diff --git a/gnu/local.mk b/gnu/local.mk
index 74b57b0bcb..34c95332b5 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -668,7 +668,6 @@ dist_patch_DATA = \
%D%/packages/patches/libwmf-CVE-2015-0848+CVE-2015-4588.patch \
%D%/packages/patches/libwmf-CVE-2015-4695.patch \
%D%/packages/patches/libwmf-CVE-2015-4696.patch \
- %D%/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch \
%D%/packages/patches/libxv-CVE-2016-5407.patch \
%D%/packages/patches/libxvmc-CVE-2016-7953.patch \
%D%/packages/patches/libxslt-generated-ids.patch \
diff --git a/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch b/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch
deleted file mode 100644
index 9df6cf3f4d..0000000000
--- a/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch
+++ /dev/null
@@ -1,152 +0,0 @@
-Fix CVE-2016-7951 and CVE-2016-7952
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7951
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7952
-
-Patch copied from upstream source repository:
-
-https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3
-
-From 9556ad67af3129ec4a7a4f4b54a0d59701beeae3 Mon Sep 17 00:00:00 2001
-From: Tobias Stoeckmann <tobias@stoeckmann.org>
-Date: Sun, 25 Sep 2016 21:37:01 +0200
-Subject: [PATCH] Out of boundary access and endless loop in libXtst
-
-A lack of range checks in libXtst allows out of boundary accesses.
-The checks have to be done in-place here, because it cannot be done
-without in-depth knowledge of the read data.
-
-If XRecordStartOfData, XRecordEndOfData, or XRecordClientDied
-without a client sequence have attached data, an endless loop would
-occur. The do-while-loop continues until the current index reaches
-the end. But in these cases, the current index would not be
-incremented, leading to an endless processing.
-
-Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
-Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
----
- src/XRecord.c | 43 +++++++++++++++++++++++++++++++++++++++----
- 1 file changed, 39 insertions(+), 4 deletions(-)
-
-diff --git a/src/XRecord.c b/src/XRecord.c
-index 50420c0..fefd842 100644
---- a/src/XRecord.c
-+++ b/src/XRecord.c
-@@ -749,15 +749,23 @@ parse_reply_call_callback(
- switch (rep->category) {
- case XRecordFromServer:
- if (rep->elementHeader&XRecordFromServerTime) {
-+ if (current_index + 4 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD32(rep->clientSwapped,
- reply->buf+current_index,
- data->server_time);
- current_index += 4;
- }
-+ if (current_index + 1 > rep->length << 2)
-+ return Error;
- switch (reply->buf[current_index]) {
- case X_Reply: /* reply */
-+ if (current_index + 8 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD32(rep->clientSwapped,
- reply->buf+current_index+4, datum_bytes);
-+ if (datum_bytes < 0 || datum_bytes > ((INT_MAX >> 2) - 8))
-+ return Error;
- datum_bytes = (datum_bytes+8) << 2;
- break;
- default: /* error or event */
-@@ -766,52 +774,73 @@ parse_reply_call_callback(
- break;
- case XRecordFromClient:
- if (rep->elementHeader&XRecordFromClientTime) {
-+ if (current_index + 4 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD32(rep->clientSwapped,
- reply->buf+current_index,
- data->server_time);
- current_index += 4;
- }
- if (rep->elementHeader&XRecordFromClientSequence) {
-+ if (current_index + 4 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD32(rep->clientSwapped,
- reply->buf+current_index,
- data->client_seq);
- current_index += 4;
- }
-+ if (current_index + 4 > rep->length<<2)
-+ return Error;
- if (reply->buf[current_index+2] == 0
- && reply->buf[current_index+3] == 0) /* needn't swap 0 */
- { /* BIG-REQUESTS */
-+ if (current_index + 8 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD32(rep->clientSwapped,
- reply->buf+current_index+4, datum_bytes);
- } else {
- EXTRACT_CARD16(rep->clientSwapped,
- reply->buf+current_index+2, datum_bytes);
- }
-+ if (datum_bytes < 0 || datum_bytes > INT_MAX >> 2)
-+ return Error;
- datum_bytes <<= 2;
- break;
- case XRecordClientStarted:
-+ if (current_index + 8 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD16(rep->clientSwapped,
- reply->buf+current_index+6, datum_bytes);
- datum_bytes = (datum_bytes+2) << 2;
- break;
- case XRecordClientDied:
- if (rep->elementHeader&XRecordFromClientSequence) {
-+ if (current_index + 4 > rep->length << 2)
-+ return Error;
- EXTRACT_CARD32(rep->clientSwapped,
- reply->buf+current_index,
- data->client_seq);
- current_index += 4;
-- }
-- /* fall through */
-+ } else if (current_index < rep->length << 2)
-+ return Error;
-+ datum_bytes = 0;
-+ break;
- case XRecordStartOfData:
- case XRecordEndOfData:
-+ if (current_index < rep->length << 2)
-+ return Error;
- datum_bytes = 0;
-+ break;
- }
-
- if (datum_bytes > 0) {
-- if (current_index + datum_bytes > rep->length << 2)
-+ if (INT_MAX - datum_bytes < (rep->length << 2) - current_index) {
- fprintf(stderr,
- "XRecord: %lu-byte reply claims %d-byte element (seq %lu)\n",
-- (long)rep->length << 2, current_index + datum_bytes,
-+ (unsigned long)rep->length << 2, current_index + datum_bytes,
- dpy->last_request_read);
-+ return Error;
-+ }
- /*
- * This assignment (and indeed the whole buffer sharing
- * scheme) assumes arbitrary 4-byte boundaries are
-@@ -863,6 +892,12 @@ XRecordEnableContext(Display *dpy, XRecordContext context,
- return 0;
- }
-
-+ if (rep.length > INT_MAX >> 2) {
-+ UnlockDisplay(dpy);
-+ SyncHandle();
-+ return 0;
-+ }
-+
- if (rep.length > 0) {
- reply = alloc_reply_buffer(info, rep.length<<2);
- if (!reply) {
---
-2.10.1
-
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 19b5d31e90..9d9211f8ee 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -4629,8 +4629,7 @@ cannot be adequately worked around on the client side of the wire.")
(define-public libxtst
(package
(name "libxtst")
- (replacement libxtst/fixed)
- (version "1.2.2")
+ (version "1.2.3")
(source
(origin
(method url-fetch)
@@ -4640,7 +4639,7 @@ cannot be adequately worked around on the client side of the wire.")
".tar.bz2"))
(sha256
(base32
- "1ngn161nq679ffmbwl81i2hn75jjg5b3ffv6n4jilpvyazypy2pg"))))
+ "012jpyj7xfm653a9jcfqbzxyywdmwb2b5wr1dwylx14f3f54jma6"))))
(build-system gnu-build-system)
(propagated-inputs
`(("recordproto" ,recordproto)
@@ -4665,14 +4664,6 @@ The RECORD extension supports the recording and reporting of all core X
protocol and arbitrary X extension protocol.")
(license license:x11)))
-(define libxtst/fixed
- (package
- (inherit libxtst)
- (source (origin
- (inherit (package-source libxtst))
- (patches (search-patches
- "libxtst-CVE-2016-7951-CVE-2016-7952.patch"))))))
-
(define-public libxv
(package
(name "libxv")
generated by cgit v1.2.3 (git 2.45.0) at 2024-12-14 13:00:37 +0000