gnu/packages/patches/libxfixes-CVE-2016-7944.patch

   1 Fix CVE-2016-7944:
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944
   4
   5 Patch copied from upstream source repository:
   6
   7 https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e
   8
   9 From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001
  10 From: Tobias Stoeckmann <tobias@stoeckmann.org>
  11 Date: Sun, 25 Sep 2016 22:38:44 +0200
  12 Subject: [PATCH] Integer overflow on illegal server response
  13
  14 The 32 bit field "rep.length" is not checked for validity, which allows
  15 an integer overflow on 32 bit systems.
  16
  17 A malicious server could send INT_MAX as length, which gets multiplied
  18 by the size of XRectangle. In that case the client won't read the whole
  19 data from server, getting out of sync.
  20
  21 Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
  22 Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
  23 ---
  24  src/Region.c | 15 ++++++++++++---
  25  1 file changed, 12 insertions(+), 3 deletions(-)
  26
  27 diff --git a/src/Region.c b/src/Region.c
  28 index cb0cf6e..59bcc1a 100644
  29 --- a/src/Region.c
  30 +++ b/src/Region.c
  31 @@ -23,6 +23,7 @@
  32  #ifdef HAVE_CONFIG_H
  33  #include <config.h>
  34  #endif
  35 +#include <limits.h>
  36  #include "Xfixesint.h"
  37
  38  XserverRegion
  39 @@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display            *dpy,
  40      bounds->y = rep.y;
  41      bounds->width = rep.width;
  42      bounds->height = rep.height;
  43 -    nbytes = (long) rep.length << 2;
  44 -    nrects = rep.length >> 1;
  45 -    rects = Xmalloc (nrects * sizeof (XRectangle));
  46 +
  47 +    if (rep.length < (INT_MAX >> 2)) {
  48 +       nbytes = (long) rep.length << 2;
  49 +       nrects = rep.length >> 1;
  50 +       rects = Xmalloc (nrects * sizeof (XRectangle));
  51 +    } else {
  52 +       nbytes = 0;
  53 +       nrects = 0;
  54 +       rects = NULL;
  55 +    }
  56 +
  57      if (!rects)
  58      {
  59         _XEatDataWords(dpy, rep.length);
  60 --
  61 2.10.1
  62