gnu: libxfixes: Update to 5.0.3.
* gnu/packages/xorg.scm (libxfixes): Update to 5.0.3. [replacement]: Remove field. (libxfixes/fixed): Remove variable. * gnu/packages/patches/libxfixes-CVE-2016-7944.patch: Delete file. * gnu/local.mk (dist_patch_DATA): Remove it.
This commit is contained in:
parent
4dd841c1dc
commit
3e1ed70f74
|
@ -668,7 +668,6 @@ dist_patch_DATA = \
|
|||
%D%/packages/patches/libwmf-CVE-2015-0848+CVE-2015-4588.patch \
|
||||
%D%/packages/patches/libwmf-CVE-2015-4695.patch \
|
||||
%D%/packages/patches/libwmf-CVE-2015-4696.patch \
|
||||
%D%/packages/patches/libxfixes-CVE-2016-7944.patch \
|
||||
%D%/packages/patches/libxi-CVE-2016-7945-CVE-2016-7946.patch \
|
||||
%D%/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch \
|
||||
%D%/packages/patches/libxrender-CVE-2016-7949.patch \
|
||||
|
|
|
@ -1,62 +0,0 @@
|
|||
Fix CVE-2016-7944:
|
||||
|
||||
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944
|
||||
|
||||
Patch copied from upstream source repository:
|
||||
|
||||
https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e
|
||||
|
||||
From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001
|
||||
From: Tobias Stoeckmann <tobias@stoeckmann.org>
|
||||
Date: Sun, 25 Sep 2016 22:38:44 +0200
|
||||
Subject: [PATCH] Integer overflow on illegal server response
|
||||
|
||||
The 32 bit field "rep.length" is not checked for validity, which allows
|
||||
an integer overflow on 32 bit systems.
|
||||
|
||||
A malicious server could send INT_MAX as length, which gets multiplied
|
||||
by the size of XRectangle. In that case the client won't read the whole
|
||||
data from server, getting out of sync.
|
||||
|
||||
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
|
||||
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
|
||||
---
|
||||
src/Region.c | 15 ++++++++++++---
|
||||
1 file changed, 12 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/Region.c b/src/Region.c
|
||||
index cb0cf6e..59bcc1a 100644
|
||||
--- a/src/Region.c
|
||||
+++ b/src/Region.c
|
||||
@@ -23,6 +23,7 @@
|
||||
#ifdef HAVE_CONFIG_H
|
||||
#include <config.h>
|
||||
#endif
|
||||
+#include <limits.h>
|
||||
#include "Xfixesint.h"
|
||||
|
||||
XserverRegion
|
||||
@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy,
|
||||
bounds->y = rep.y;
|
||||
bounds->width = rep.width;
|
||||
bounds->height = rep.height;
|
||||
- nbytes = (long) rep.length << 2;
|
||||
- nrects = rep.length >> 1;
|
||||
- rects = Xmalloc (nrects * sizeof (XRectangle));
|
||||
+
|
||||
+ if (rep.length < (INT_MAX >> 2)) {
|
||||
+ nbytes = (long) rep.length << 2;
|
||||
+ nrects = rep.length >> 1;
|
||||
+ rects = Xmalloc (nrects * sizeof (XRectangle));
|
||||
+ } else {
|
||||
+ nbytes = 0;
|
||||
+ nrects = 0;
|
||||
+ rects = NULL;
|
||||
+ }
|
||||
+
|
||||
if (!rects)
|
||||
{
|
||||
_XEatDataWords(dpy, rep.length);
|
||||
--
|
||||
2.10.1
|
||||
|
|
@ -4848,8 +4848,7 @@ an X Window System display.")
|
|||
(define-public libxfixes
|
||||
(package
|
||||
(name "libxfixes")
|
||||
(replacement libxfixes/fixed)
|
||||
(version "5.0.2")
|
||||
(version "5.0.3")
|
||||
(source
|
||||
(origin
|
||||
(method url-fetch)
|
||||
|
@ -4859,7 +4858,7 @@ an X Window System display.")
|
|||
".tar.bz2"))
|
||||
(sha256
|
||||
(base32
|
||||
"1slsk898386xii0r3l7szwwq3s6y2m4dsj0x93ninjh8xkghxllv"))))
|
||||
"1miana3y4hwdqdparsccmygqr3ic3hs5jrqfzp70hvi2zwxd676y"))))
|
||||
(build-system gnu-build-system)
|
||||
(propagated-inputs
|
||||
`(("fixesproto" ,fixesproto)))
|
||||
|
@ -4873,14 +4872,6 @@ an X Window System display.")
|
|||
(description "Library for the XFixes Extension to the X11 protocol.")
|
||||
(license license:x11)))
|
||||
|
||||
(define libxfixes/fixed
|
||||
(package
|
||||
(inherit libxfixes)
|
||||
(source (origin
|
||||
(inherit (package-source libxfixes))
|
||||
(patches (search-patches
|
||||
"libxfixes-CVE-2016-7944.patch"))))))
|
||||
|
||||
(define-public libxfont
|
||||
(package
|
||||
(name "libxfont")
|
||||
|
|
Loading…
Reference in New Issue