diff options
| author | Leonardo Arena <rnalrd@alpinelinux.org> | 2016-10-20 13:23:38 +0000 |
|---|---|---|
| committer | Leonardo Arena <rnalrd@alpinelinux.org> | 2016-10-20 13:23:38 +0000 |
| commit | 8609f0d65f3b07f23780e2ddde0978aee3776a8b (patch) | |
| tree | e3f44701b2cf5482759228080fa1791c3f2bb563 | |
| parent | ffaa32a96062a37c4b3aff0dc2b6e37661dab85a (diff) | |
main/libxfixes: securiti fix (CVE-2016-7944). Fixes #6309
| -rw-r--r-- | main/libxfixes/APKBUILD | 19 | ||||
| -rw-r--r-- | main/libxfixes/CVE-2016-7944.patch | 51 |
2 files changed, 65 insertions, 5 deletions
diff --git a/main/libxfixes/APKBUILD b/main/libxfixes/APKBUILD index 68bbb027351..50dcc4cb38b 100644 --- a/main/libxfixes/APKBUILD +++ b/main/libxfixes/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=libxfixes pkgver=5.0.1 -pkgrel=1 +pkgrel=2 pkgdesc="X11 miscellaneous 'fixes' extension library" url="http://xorg.freedesktop.org/" arch="all" @@ -10,7 +10,13 @@ depends= depends_dev="xproto fixesproto libx11-dev" makedepends="$depends_dev xextproto" subpackages="$pkgname-dev $pkgname-doc" -source="http://xorg.freedesktop.org/releases/individual/lib/libXfixes-$pkgver.tar.bz2" +source="http://xorg.freedesktop.org/releases/individual/lib/libXfixes-$pkgver.tar.bz2 + CVE-2016-7944.patch + " + +# secfixes: +# 5.0.1-r2: +# - CVE-2016-7944 _builddir="$srcdir"/libXfixes-$pkgver prepare() { @@ -37,6 +43,9 @@ package() { cd "$_builddir" make DESTDIR="$pkgdir" install || return 1 } -md5sums="b985b85f8b9386c85ddcfe1073906b4d libXfixes-5.0.1.tar.bz2" -sha256sums="63bec085084fa3caaee5180490dd871f1eb2020ba9e9b39a30f93693ffc34767 libXfixes-5.0.1.tar.bz2" -sha512sums="b47c841db169d1b329eec9deb555799cd087a466326840f1f5349303ba79cff5850b1bb69c1ff38b3f522f24d61db58a0c01021e1ffea2896527167262fc7150 libXfixes-5.0.1.tar.bz2" +md5sums="b985b85f8b9386c85ddcfe1073906b4d libXfixes-5.0.1.tar.bz2 +22b234be80f73486a949860a3a803dbc CVE-2016-7944.patch" +sha256sums="63bec085084fa3caaee5180490dd871f1eb2020ba9e9b39a30f93693ffc34767 libXfixes-5.0.1.tar.bz2 +27eceea2b3fcd41d84bc2f8db1d896dbd1e085514d30c1b0a23cdd1a4514b06d CVE-2016-7944.patch" +sha512sums="b47c841db169d1b329eec9deb555799cd087a466326840f1f5349303ba79cff5850b1bb69c1ff38b3f522f24d61db58a0c01021e1ffea2896527167262fc7150 libXfixes-5.0.1.tar.bz2 +8232ac3eaa0e16b59829f9aad6c336517280dff03c853312c5b9d7a71356b41589985d4142d55aa2a0147b21670bcfb876344ed366ac5218ba8d27fb2402971a CVE-2016-7944.patch" diff --git a/main/libxfixes/CVE-2016-7944.patch b/main/libxfixes/CVE-2016-7944.patch new file mode 100644 index 00000000000..8991eb7745d --- /dev/null +++ b/main/libxfixes/CVE-2016-7944.patch @@ -0,0 +1,51 @@ +From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann <tobias@stoeckmann.org> +Date: Sun, 25 Sep 2016 22:38:44 +0200 +Subject: Integer overflow on illegal server response + +The 32 bit field "rep.length" is not checked for validity, which allows +an integer overflow on 32 bit systems. + +A malicious server could send INT_MAX as length, which gets multiplied +by the size of XRectangle. In that case the client won't read the whole +data from server, getting out of sync. + +Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> +Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> + +diff --git a/src/Region.c b/src/Region.c +index cb0cf6e..59bcc1a 100644 +--- a/src/Region.c ++++ b/src/Region.c +@@ -23,6 +23,7 @@ + #ifdef HAVE_CONFIG_H + #include <config.h> + #endif ++#include <limits.h> + #include "Xfixesint.h" + + XserverRegion +@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy, + bounds->y = rep.y; + bounds->width = rep.width; + bounds->height = rep.height; +- nbytes = (long) rep.length << 2; +- nrects = rep.length >> 1; +- rects = Xmalloc (nrects * sizeof (XRectangle)); ++ ++ if (rep.length < (INT_MAX >> 2)) { ++ nbytes = (long) rep.length << 2; ++ nrects = rep.length >> 1; ++ rects = Xmalloc (nrects * sizeof (XRectangle)); ++ } else { ++ nbytes = 0; ++ nrects = 0; ++ rects = NULL; ++ } ++ + if (!rects) + { + _XEatDataWords(dpy, rep.length); +-- +cgit v0.10.2 + |