aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLeo <thinkabit.ukim@gmail.com>2021-05-19 00:19:02 -0300
committerLeo <thinkabit.ukim@gmail.com>2021-05-19 00:21:42 -0300
commit721ca84683a67b31dcc8576d5a221fc32ac3b45f (patch)
treeb2275b3161e99cb3ac00dfca2271c9412ef43a88
parentabc3d95fdc9a62dd1651a117b4bae4efdd236757 (diff)
downloadaports-721ca84683a67b31dcc8576d5a221fc32ac3b45f.tar.gz
aports-721ca84683a67b31dcc8576d5a221fc32ac3b45f.tar.bz2
aports-721ca84683a67b31dcc8576d5a221fc32ac3b45f.tar.xz
main/libx11: fix CVE-2021-31535
-rw-r--r--main/libx11/APKBUILD13
-rw-r--r--main/libx11/CVE-2021-31535.patch315
2 files changed, 325 insertions, 3 deletions
diff --git a/main/libx11/APKBUILD b/main/libx11/APKBUILD
index 99d841efb3..e0d8ab4bc8 100644
--- a/main/libx11/APKBUILD
+++ b/main/libx11/APKBUILD
@@ -1,7 +1,7 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=libx11
pkgver=1.6.12
-pkgrel=0
+pkgrel=1
pkgdesc="X11 client-side library"
url="http://xorg.freedesktop.org/"
arch="all"
@@ -9,10 +9,14 @@ license="custom:XFREE86"
subpackages="$pkgname-static $pkgname-dev $pkgname-doc"
depends_dev="libxcb-dev xtrans"
makedepends="$depends_dev xorgproto util-macros xmlto"
-source="https://www.x.org/releases/individual/lib/libX11-$pkgver.tar.bz2"
+source="https://www.x.org/releases/individual/lib/libX11-$pkgver.tar.bz2
+ CVE-2021-31535.patch
+ "
builddir="$srcdir"/libX11-$pkgver
# secfixes:
+# 1.6.12-r1:
+# - CVE-2021-31535
# 1.6.12-r0:
# - CVE-2020-14363
# 1.6.10-r0:
@@ -43,4 +47,7 @@ package() {
install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
}
-sha512sums="79df7d61d9009b0dd3b65f67a62189aa0a43799c01026b3d2d534092596a0b67f246af5e398a89eb1ccc61a27335f81be8262b8a39768a76f62d862cd7415a47 libX11-1.6.12.tar.bz2"
+sha512sums="
+79df7d61d9009b0dd3b65f67a62189aa0a43799c01026b3d2d534092596a0b67f246af5e398a89eb1ccc61a27335f81be8262b8a39768a76f62d862cd7415a47 libX11-1.6.12.tar.bz2
+6b4b6c58eacda10cb521b122ff0f1563e70b185739d578dbba3d010e20ebcd4d1a3dce1bcf868e23eefc94155d63b91129a571882ceaa7372dcffd8db339bbea CVE-2021-31535.patch
+"
diff --git a/main/libx11/CVE-2021-31535.patch b/main/libx11/CVE-2021-31535.patch
new file mode 100644
index 0000000000..5c6778a130
--- /dev/null
+++ b/main/libx11/CVE-2021-31535.patch
@@ -0,0 +1,315 @@
+From 8d2e02ae650f00c4a53deb625211a0527126c605 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Fri, 19 Feb 2021 15:30:39 +0100
+Subject: [PATCH] Reject string longer than USHRT_MAX before sending them on
+ the wire
+
+The X protocol uses CARD16 values to represent the length so
+this would overflow.
+
+CVE-2021-31535
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+---
+ src/Font.c | 4 +++-
+ src/FontInfo.c | 3 +++
+ src/FontNames.c | 3 +++
+ src/GetColor.c | 4 ++++
+ src/LoadFont.c | 4 ++++
+ src/LookupCol.c | 6 ++++--
+ src/ParseCol.c | 3 +++
+ src/QuExt.c | 5 +++++
+ src/SetFPath.c | 6 ++++++
+ src/SetHints.c | 7 +++++++
+ src/StNColor.c | 3 +++
+ src/StName.c | 7 ++++++-
+ 12 files changed, 51 insertions(+), 4 deletions(-)
+
+diff --git a/src/Font.c b/src/Font.c
+index d4ebdaca..1cd89cca 100644
+--- a/src/Font.c
++++ b/src/Font.c
+@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
+ XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
+ #endif
+
++ if (strlen(name) >= USHRT_MAX)
++ return NULL;
+ if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
+ return font_result;
+ LockDisplay(dpy);
+@@ -663,7 +665,7 @@ int _XF86LoadQueryLocaleFont(
+ if (!name)
+ return 0;
+ l = (int) strlen(name);
+- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
++ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
+ return 0;
+ charset = NULL;
+ /* next three lines stolen from _XkbGetCharset() */
+diff --git a/src/FontInfo.c b/src/FontInfo.c
+index 694efa10..6644b3fa 100644
+--- a/src/FontInfo.c
++++ b/src/FontInfo.c
+@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
+ register xListFontsReq *req;
+ int j;
+
++ if (strlen(pattern) >= USHRT_MAX)
++ return NULL;
++
+ LockDisplay(dpy);
+ GetReq(ListFontsWithInfo, req);
+ req->maxNames = maxNames;
+diff --git a/src/FontNames.c b/src/FontNames.c
+index 30912925..458d80c9 100644
+--- a/src/FontNames.c
++++ b/src/FontNames.c
+@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
+ register xListFontsReq *req;
+ unsigned long rlen = 0;
+
++ if (strlen(pattern) >= USHRT_MAX)
++ return NULL;
++
+ LockDisplay(dpy);
+ GetReq(ListFonts, req);
+ req->maxNames = maxNames;
+diff --git a/src/GetColor.c b/src/GetColor.c
+index d088497f..c8178067 100644
+--- a/src/GetColor.c
++++ b/src/GetColor.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
+ XcmsColor cmsColor_exact;
+ Status ret;
+
++ if (strlen(colorname) >= USHRT_MAX)
++ return (0);
++
+ #ifdef XCMS
+ /*
+ * Let's Attempt to use Xcms and i18n approach to Parse Color
+diff --git a/src/LoadFont.c b/src/LoadFont.c
+index 0a3809a8..3996436f 100644
+--- a/src/LoadFont.c
++++ b/src/LoadFont.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include "Xlibint.h"
+
+ Font
+@@ -38,6 +39,9 @@ XLoadFont (
+ Font fid;
+ register xOpenFontReq *req;
+
++ if (strlen(name) >= USHRT_MAX)
++ return (0);
++
+ if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
+ return fid;
+
+diff --git a/src/LookupCol.c b/src/LookupCol.c
+index 9608d512..cd9b1368 100644
+--- a/src/LookupCol.c
++++ b/src/LookupCol.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,9 @@ XLookupColor (
+ XcmsCCC ccc;
+ XcmsColor cmsColor_exact;
+
++ n = (int) strlen (spec);
++ if (n >= USHRT_MAX)
++ return 0;
+ #ifdef XCMS
+ /*
+ * Let's Attempt to use Xcms and i18n approach to Parse Color
+@@ -77,8 +81,6 @@ XLookupColor (
+ * Xcms and i18n methods failed, so lets pass it to the server
+ * for parsing.
+ */
+-
+- n = (int) strlen (spec);
+ LockDisplay(dpy);
+ GetReq (LookupColor, req);
+ req->cmap = cmap;
+diff --git a/src/ParseCol.c b/src/ParseCol.c
+index 2691df36..7a84a17b 100644
+--- a/src/ParseCol.c
++++ b/src/ParseCol.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -47,6 +48,8 @@ XParseColor (
+
+ if (!spec) return(0);
+ n = (int) strlen (spec);
++ if (n >= USHRT_MAX)
++ return(0);
+ if (*spec == '#') {
+ /*
+ * RGB
+diff --git a/src/QuExt.c b/src/QuExt.c
+index 2021dca4..4cb99fcf 100644
+--- a/src/QuExt.c
++++ b/src/QuExt.c
+@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
++#include <stdbool.h>
+ #include "Xlibint.h"
+
+ Bool
+@@ -40,6 +42,9 @@ XQueryExtension(
+ xQueryExtensionReply rep;
+ register xQueryExtensionReq *req;
+
++ if (strlen(name) >= USHRT_MAX)
++ return false;
++
+ LockDisplay(dpy);
+ GetReq(QueryExtension, req);
+ req->nbytes = name ? (CARD16) strlen(name) : 0;
+diff --git a/src/SetFPath.c b/src/SetFPath.c
+index 7d12f18c..13fce49e 100644
+--- a/src/SetFPath.c
++++ b/src/SetFPath.c
+@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
+
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
++#include <limits.h>
+ #endif
+ #include "Xlibint.h"
+
+@@ -49,6 +50,11 @@ XSetFontPath (
+ req->nFonts = ndirs;
+ for (i = 0; i < ndirs; i++) {
+ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
++ if (n >= USHRT_MAX) {
++ UnlockDisplay(dpy);
++ SyncHandle();
++ return 0;
++ }
+ }
+ nbytes = (n + 3) & ~3;
+ req->length += nbytes >> 2;
+diff --git a/src/SetHints.c b/src/SetHints.c
+index e81aa9d3..61cb0684 100644
+--- a/src/SetHints.c
++++ b/src/SetHints.c
+@@ -49,6 +49,7 @@ SOFTWARE.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xutil.h>
+ #include "Xatomtype.h"
+@@ -214,6 +215,8 @@ XSetCommand (
+ register char *buf, *bp;
+ for (i = 0, nbytes = 0; i < argc; i++) {
+ nbytes += safestrlen(argv[i]) + 1;
++ if (nbytes >= USHRT_MAX)
++ return 1;
+ }
+ if ((bp = buf = Xmalloc(nbytes))) {
+ /* copy arguments into single buffer */
+@@ -256,6 +259,8 @@ XSetStandardProperties (
+
+ if (name != NULL) XStoreName (dpy, w, name);
+
++ if (safestrlen(icon_string) >= USHRT_MAX)
++ return 1;
+ if (icon_string != NULL) {
+ XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+ PropModeReplace,
+@@ -298,6 +303,8 @@ XSetClassHint(
+
+ len_nm = safestrlen(classhint->res_name);
+ len_cl = safestrlen(classhint->res_class);
++ if (len_nm + len_cl >= USHRT_MAX)
++ return 1;
+ if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
+ if (len_nm) {
+ strcpy(s, classhint->res_name);
+diff --git a/src/StNColor.c b/src/StNColor.c
+index 3b50401b..16dc9cbc 100644
+--- a/src/StNColor.c
++++ b/src/StNColor.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
+ XcmsColor cmsColor_exact;
+ XColor scr_def;
+
++ if (strlen(name) >= USHRT_MAX)
++ return 0;
+ #ifdef XCMS
+ /*
+ * Let's Attempt to use Xcms approach to Parse Color
+diff --git a/src/StName.c b/src/StName.c
+index 58b5a5a6..04bb3aa6 100644
+--- a/src/StName.c
++++ b/src/StName.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xatom.h>
+
+@@ -36,7 +37,9 @@ XStoreName (
+ Window w,
+ _Xconst char *name)
+ {
+- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
++ if (strlen(name) >= USHRT_MAX)
++ return 0;
++ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
+ 8, PropModeReplace, (_Xconst unsigned char *)name,
+ name ? (int) strlen(name) : 0);
+ }
+@@ -47,6 +50,8 @@ XSetIconName (
+ Window w,
+ _Xconst char *icon_name)
+ {
++ if (strlen(icon_name) >= USHRT_MAX)
++ return 0;
+ return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+ PropModeReplace, (_Xconst unsigned char *)icon_name,
+ icon_name ? (int) strlen(icon_name) : 0);
+--
+GitLab
+