diff options
Diffstat (limited to 'gnu/packages/patches/libxfixes-CVE-2016-7944.patch')
| -rw-r--r-- | gnu/packages/patches/libxfixes-CVE-2016-7944.patch | 62 |
1 files changed, 0 insertions, 62 deletions
diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch deleted file mode 100644 index 2ce463fc46..0000000000 --- a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch +++ /dev/null @@ -1,62 +0,0 @@ -Fix CVE-2016-7944: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944 - -Patch copied from upstream source repository: - -https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e - -From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001 -From: Tobias Stoeckmann <tobias@stoeckmann.org> -Date: Sun, 25 Sep 2016 22:38:44 +0200 -Subject: [PATCH] Integer overflow on illegal server response - -The 32 bit field "rep.length" is not checked for validity, which allows -an integer overflow on 32 bit systems. - -A malicious server could send INT_MAX as length, which gets multiplied -by the size of XRectangle. In that case the client won't read the whole -data from server, getting out of sync. - -Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> -Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> ---- - src/Region.c | 15 ++++++++++++--- - 1 file changed, 12 insertions(+), 3 deletions(-) - -diff --git a/src/Region.c b/src/Region.c -index cb0cf6e..59bcc1a 100644 ---- a/src/Region.c -+++ b/src/Region.c -@@ -23,6 +23,7 @@ - #ifdef HAVE_CONFIG_H - #include <config.h> - #endif -+#include <limits.h> - #include "Xfixesint.h" - - XserverRegion -@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy, - bounds->y = rep.y; - bounds->width = rep.width; - bounds->height = rep.height; -- nbytes = (long) rep.length << 2; -- nrects = rep.length >> 1; -- rects = Xmalloc (nrects * sizeof (XRectangle)); -+ -+ if (rep.length < (INT_MAX >> 2)) { -+ nbytes = (long) rep.length << 2; -+ nrects = rep.length >> 1; -+ rects = Xmalloc (nrects * sizeof (XRectangle)); -+ } else { -+ nbytes = 0; -+ nrects = 0; -+ rects = NULL; -+ } -+ - if (!rects) - { - _XEatDataWords(dpy, rep.length); --- -2.10.1 - |