nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gnu: libxfixes: Fix CVE-2016-7944. 

* gnu/packages/patches/libxfixes-CVE-2016-7944.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/xorg.scm (libxfixes)[replacement]: New field.
(libxfixes/fixed): New variable.
This commit is contained in:
Leo Famulari 2016-10-05 13:15:29 -04:00
parent 13c10b4ca4
commit b50c6bf2a8
No known key found for this signature in database
GPG Key ID: 2646FA30BACA7F08
3 changed files with 71 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
gnu/local.mk
View File

@ -671,6 +671,7 @@ dist_patch_DATA = \
%D%/packages/patches/libwmf-CVE-2015-4696.patch \
%D%/packages/patches/libx11-CVE-2016-7942.patch \
%D%/packages/patches/libx11-CVE-2016-7943.patch \
%D%/packages/patches/libxfixes-CVE-2016-7944.patch \
%D%/packages/patches/libxslt-generated-ids.patch \
%D%/packages/patches/lirc-localstatedir.patch \
%D%/packages/patches/llvm-for-extempore.patch \

62
gnu/packages/patches/libxfixes-CVE-2016-7944.patch Normal file
View File

@ -0,0 +1,62 @@
Fix CVE-2016-7944:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944
Patch copied from upstream source repository:
https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e
From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001
From: Tobias Stoeckmann <tobias@stoeckmann.org>
Date: Sun, 25 Sep 2016 22:38:44 +0200
Subject: [PATCH] Integer overflow on illegal server response
The 32 bit field "rep.length" is not checked for validity, which allows
an integer overflow on 32 bit systems.
A malicious server could send INT_MAX as length, which gets multiplied
by the size of XRectangle. In that case the client won't read the whole
data from server, getting out of sync.
Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
---
src/Region.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/src/Region.c b/src/Region.c
index cb0cf6e..59bcc1a 100644
--- a/src/Region.c
+++ b/src/Region.c
@@ -23,6 +23,7 @@
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include "Xfixesint.h"
XserverRegion
@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy,
bounds->y = rep.y;
bounds->width = rep.width;
bounds->height = rep.height;
- nbytes = (long) rep.length << 2;
- nrects = rep.length >> 1;
- rects = Xmalloc (nrects * sizeof (XRectangle));
+
+ if (rep.length < (INT_MAX >> 2)) {
+ nbytes = (long) rep.length << 2;
+ nrects = rep.length >> 1;
+ rects = Xmalloc (nrects * sizeof (XRectangle));
+ } else {
+ nbytes = 0;
+ nrects = 0;
+ rects = NULL;
+ }
+
if (!rects)
{
_XEatDataWords(dpy, rep.length);
--
2.10.1

8
gnu/packages/xorg.scm
View File

@ -4823,6 +4823,7 @@ an X Window System display.")
(define-public libxfixes
(package
(name "libxfixes")
(replacement libxfixes/fixed)
(version "5.0.1")
(source
(origin
@ -4847,6 +4848,13 @@ an X Window System display.")
(description "Library for the XFixes Extension to the X11 protocol.")
(license license:x11)))
(define libxfixes/fixed
(package
(inherit libxfixes)
(source (origin
(inherit (package-source libxfixes))
(patches (search-patches
"libxfixes-CVE-2016-7944.patch"))))))
(define-public libxfont
(package