summary refs log tree commit diff
path: root/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
diff options
context:
space:
mode:
Diffstat (limited to 'gnu/packages/patches/libxfixes-CVE-2016-7944.patch')
-rw-r--r--gnu/packages/patches/libxfixes-CVE-2016-7944.patch62
1 files changed, 62 insertions, 0 deletions
diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
new file mode 100644
index 0000000000..2ce463fc46
--- /dev/null
+++ b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch
@@ -0,0 +1,62 @@
+Fix CVE-2016-7944:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944
+
+Patch copied from upstream source repository:
+
+https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e
+
+From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001
+From: Tobias Stoeckmann <tobias@stoeckmann.org>
+Date: Sun, 25 Sep 2016 22:38:44 +0200
+Subject: [PATCH] Integer overflow on illegal server response
+
+The 32 bit field "rep.length" is not checked for validity, which allows
+an integer overflow on 32 bit systems.
+
+A malicious server could send INT_MAX as length, which gets multiplied
+by the size of XRectangle. In that case the client won't read the whole
+data from server, getting out of sync.
+
+Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
+Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
+---
+ src/Region.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/src/Region.c b/src/Region.c
+index cb0cf6e..59bcc1a 100644
+--- a/src/Region.c
++++ b/src/Region.c
+@@ -23,6 +23,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include "Xfixesint.h"
+ 
+ XserverRegion
+@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display	    *dpy,
+     bounds->y = rep.y;
+     bounds->width = rep.width;
+     bounds->height = rep.height;
+-    nbytes = (long) rep.length << 2;
+-    nrects = rep.length >> 1;
+-    rects = Xmalloc (nrects * sizeof (XRectangle));
++
++    if (rep.length < (INT_MAX >> 2)) {
++	nbytes = (long) rep.length << 2;
++	nrects = rep.length >> 1;
++	rects = Xmalloc (nrects * sizeof (XRectangle));
++    } else {
++	nbytes = 0;
++	nrects = 0;
++	rects = NULL;
++    }
++
+     if (!rects)
+     {
+ 	_XEatDataWords(dpy, rep.length);
+-- 
+2.10.1
+