diff options
Diffstat (limited to 'gnu/packages')
| -rw-r--r-- | gnu/packages/patches/libxfixes-CVE-2016-7944.patch | 62 | ||||
| -rw-r--r-- | gnu/packages/xorg.scm | 13 |
2 files changed, 2 insertions, 73 deletions
diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch deleted file mode 100644 index 2ce463fc46..0000000000 --- a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch +++ /dev/null @@ -1,62 +0,0 @@ -Fix CVE-2016-7944: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944 - -Patch copied from upstream source repository: - -https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e - -From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001 -From: Tobias Stoeckmann <tobias@stoeckmann.org> -Date: Sun, 25 Sep 2016 22:38:44 +0200 -Subject: [PATCH] Integer overflow on illegal server response - -The 32 bit field "rep.length" is not checked for validity, which allows -an integer overflow on 32 bit systems. - -A malicious server could send INT_MAX as length, which gets multiplied -by the size of XRectangle. In that case the client won't read the whole -data from server, getting out of sync. - -Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> -Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> ---- - src/Region.c | 15 ++++++++++++--- - 1 file changed, 12 insertions(+), 3 deletions(-) - -diff --git a/src/Region.c b/src/Region.c -index cb0cf6e..59bcc1a 100644 ---- a/src/Region.c -+++ b/src/Region.c -@@ -23,6 +23,7 @@ - #ifdef HAVE_CONFIG_H - #include <config.h> - #endif -+#include <limits.h> - #include "Xfixesint.h" - - XserverRegion -@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy, - bounds->y = rep.y; - bounds->width = rep.width; - bounds->height = rep.height; -- nbytes = (long) rep.length << 2; -- nrects = rep.length >> 1; -- rects = Xmalloc (nrects * sizeof (XRectangle)); -+ -+ if (rep.length < (INT_MAX >> 2)) { -+ nbytes = (long) rep.length << 2; -+ nrects = rep.length >> 1; -+ rects = Xmalloc (nrects * sizeof (XRectangle)); -+ } else { -+ nbytes = 0; -+ nrects = 0; -+ rects = NULL; -+ } -+ - if (!rects) - { - _XEatDataWords(dpy, rep.length); --- -2.10.1 - diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm index 9899a7c8ac..02382586fc 100644 --- a/gnu/packages/xorg.scm +++ b/gnu/packages/xorg.scm @@ -4848,8 +4848,7 @@ an X Window System display.") (define-public libxfixes (package (name "libxfixes") - (replacement libxfixes/fixed) - (version "5.0.2") + (version "5.0.3") (source (origin (method url-fetch) @@ -4859,7 +4858,7 @@ an X Window System display.") ".tar.bz2")) (sha256 (base32 - "1slsk898386xii0r3l7szwwq3s6y2m4dsj0x93ninjh8xkghxllv")))) + "1miana3y4hwdqdparsccmygqr3ic3hs5jrqfzp70hvi2zwxd676y")))) (build-system gnu-build-system) (propagated-inputs `(("fixesproto" ,fixesproto))) @@ -4873,14 +4872,6 @@ an X Window System display.") (description "Library for the XFixes Extension to the X11 protocol.") (license license:x11))) -(define libxfixes/fixed - (package - (inherit libxfixes) - (source (origin - (inherit (package-source libxfixes)) - (patches (search-patches - "libxfixes-CVE-2016-7944.patch")))))) - (define-public libxfont (package (name "libxfont") |