gnu/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch

   1 Fix CVE-2016-7947 and CVE-2016-7948.
   2
   3 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947
   4 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948
   5
   6 Patch copied from upstream source repository:
   7
   8 https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6
   9
  10 From a0df3e1c7728205e5c7650b2e6dce684139254a6 Mon Sep 17 00:00:00 2001
  11 From: Tobias Stoeckmann <tobias@stoeckmann.org>
  12 Date: Sun, 25 Sep 2016 22:21:40 +0200
  13 Subject: [PATCH] Avoid out of boundary accesses on illegal responses
  14
  15 The responses of the connected X server have to be properly checked
  16 to avoid out of boundary accesses that could otherwise be triggered
  17 by a malicious server.
  18
  19 Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
  20 Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
  21 ---
  22  src/XrrConfig.c   | 32 +++++++++++++--------
  23  src/XrrCrtc.c     | 83 ++++++++++++++++++++++++++++++++++++++++++-------------
  24  src/XrrMonitor.c  | 18 ++++++++++++
  25  src/XrrOutput.c   | 11 ++++++++
  26  src/XrrProvider.c | 28 ++++++++++++++++---
  27  src/XrrScreen.c   | 52 ++++++++++++++++++++++------------
  28  6 files changed, 172 insertions(+), 52 deletions(-)
  29
  30 diff --git a/src/XrrConfig.c b/src/XrrConfig.c
  31 index 2f0282b..e68c45a 100644
  32 --- a/src/XrrConfig.c
  33 +++ b/src/XrrConfig.c
  34 @@ -29,6 +29,7 @@
  35  #include <config.h>
  36  #endif
  37
  38 +#include <limits.h>
  39  #include <stdio.h>
  40  #include <X11/Xlib.h>
  41  /* we need to be able to manipulate the Display structure on events */
  42 @@ -272,23 +273,30 @@ static XRRScreenConfiguration *_XRRGetScreenInfo (Display *dpy,
  43         rep.rate = 0;
  44         rep.nrateEnts = 0;
  45      }
  46 +    if (rep.length < INT_MAX >> 2) {
  47 +       nbytes = (long) rep.length << 2;
  48
  49 -    nbytes = (long) rep.length << 2;
  50 +       nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) +
  51 +                           ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF(CARD16) */);
  52
  53 -    nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) +
  54 -                        ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF (CARD16) */);
  55 +       /*
  56 +        * first we must compute how much space to allocate for
  57 +        * randr library's use; we'll allocate the structures in a single
  58 +        * allocation, on cleanlyness grounds.
  59 +        */
  60
  61 -    /*
  62 -     * first we must compute how much space to allocate for
  63 -     * randr library's use; we'll allocate the structures in a single
  64 -     * allocation, on cleanlyness grounds.
  65 -     */
  66 +       rbytes = sizeof (XRRScreenConfiguration) +
  67 +         (rep.nSizes * sizeof (XRRScreenSize) +
  68 +          rep.nrateEnts * sizeof (int));
  69
  70 -    rbytes = sizeof (XRRScreenConfiguration) +
  71 -      (rep.nSizes * sizeof (XRRScreenSize) +
  72 -       rep.nrateEnts * sizeof (int));
  73 +       scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes);
  74 +    } else {
  75 +       nbytes = 0;
  76 +       nbytesRead = 0;
  77 +       rbytes = 0;
  78 +       scp = NULL;
  79 +    }
  80
  81 -    scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes);
  82      if (scp == NULL) {
  83         _XEatData (dpy, (unsigned long) nbytes);
  84         return NULL;
  85 diff --git a/src/XrrCrtc.c b/src/XrrCrtc.c
  86 index 5ae35c5..6665092 100644
  87 --- a/src/XrrCrtc.c
  88 +++ b/src/XrrCrtc.c
  89 @@ -24,6 +24,7 @@
  90  #include <config.h>
  91  #endif
  92
  93 +#include <limits.h>
  94  #include <stdio.h>
  95  #include <X11/Xlib.h>
  96  /* we need to be able to manipulate the Display structure on events */
  97 @@ -57,22 +58,33 @@ XRRGetCrtcInfo (Display *dpy, XRRScreenResources *resources, RRCrtc crtc)
  98         return NULL;
  99      }
 100
 101 -    nbytes = (long) rep.length << 2;
 102 +    if (rep.length < INT_MAX >> 2)
 103 +    {
 104 +       nbytes = (long) rep.length << 2;
 105
 106 -    nbytesRead = (long) (rep.nOutput * 4 +
 107 -                        rep.nPossibleOutput * 4);
 108 +       nbytesRead = (long) (rep.nOutput * 4 +
 109 +                            rep.nPossibleOutput * 4);
 110
 111 -    /*
 112 -     * first we must compute how much space to allocate for
 113 -     * randr library's use; we'll allocate the structures in a single
 114 -     * allocation, on cleanlyness grounds.
 115 -     */
 116 +       /*
 117 +        * first we must compute how much space to allocate for
 118 +        * randr library's use; we'll allocate the structures in a single
 119 +        * allocation, on cleanlyness grounds.
 120 +        */
 121
 122 -    rbytes = (sizeof (XRRCrtcInfo) +
 123 -             rep.nOutput * sizeof (RROutput) +
 124 -             rep.nPossibleOutput * sizeof (RROutput));
 125 +       rbytes = (sizeof (XRRCrtcInfo) +
 126 +                 rep.nOutput * sizeof (RROutput) +
 127 +                 rep.nPossibleOutput * sizeof (RROutput));
 128 +
 129 +       xci = (XRRCrtcInfo *) Xmalloc(rbytes);
 130 +    }
 131 +    else
 132 +    {
 133 +       nbytes = 0;
 134 +       nbytesRead = 0;
 135 +       rbytes = 0;
 136 +       xci = NULL;
 137 +    }
 138
 139 -    xci = (XRRCrtcInfo *) Xmalloc(rbytes);
 140      if (xci == NULL) {
 141         _XEatDataWords (dpy, rep.length);
 142         UnlockDisplay (dpy);
 143 @@ -194,12 +206,21 @@ XRRGetCrtcGamma (Display *dpy, RRCrtc crtc)
 144      if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
 145         goto out;
 146
 147 -    nbytes = (long) rep.length << 2;
 148 +    if (rep.length < INT_MAX >> 2)
 149 +    {
 150 +       nbytes = (long) rep.length << 2;
 151
 152 -    /* three channels of CARD16 data */
 153 -    nbytesRead = (rep.size * 2 * 3);
 154 +       /* three channels of CARD16 data */
 155 +       nbytesRead = (rep.size * 2 * 3);
 156
 157 -    crtc_gamma = XRRAllocGamma (rep.size);
 158 +       crtc_gamma = XRRAllocGamma (rep.size);
 159 +    }
 160 +    else
 161 +    {
 162 +       nbytes = 0;
 163 +       nbytesRead = 0;
 164 +       crtc_gamma = NULL;
 165 +    }
 166
 167      if (!crtc_gamma)
 168      {
 169 @@ -357,7 +378,7 @@ XRRGetCrtcTransform (Display        *dpy,
 170      xRRGetCrtcTransformReq     *req;
 171      int                                major_version, minor_version;
 172      XRRCrtcTransformAttributes *attr;
 173 -    char                       *extra = NULL, *e;
 174 +    char                       *extra = NULL, *end = NULL, *e;
 175      int                                p;
 176
 177      *attributes = NULL;
 178 @@ -395,9 +416,17 @@ XRRGetCrtcTransform (Display       *dpy,
 179         else
 180         {
 181             int extraBytes = rep.length * 4 - CrtcTransformExtra;
 182 -           extra = Xmalloc (extraBytes);
 183 +           if (rep.length < INT_MAX / 4 &&
 184 +               rep.length * 4 >= CrtcTransformExtra) {
 185 +               extra = Xmalloc (extraBytes);
 186 +               end = extra + extraBytes;
 187 +           } else
 188 +               extra = NULL;
 189             if (!extra) {
 190 -               _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2));
 191 +               if (rep.length > (CrtcTransformExtra >> 2))
 192 +                   _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2));
 193 +               else
 194 +                   _XEatDataWords (dpy, rep.length);
 195                 UnlockDisplay (dpy);
 196                 SyncHandle ();
 197                 return False;
 198 @@ -429,22 +458,38 @@ XRRGetCrtcTransform (Display      *dpy,
 199
 200      e = extra;
 201
 202 +    if (e + rep.pendingNbytesFilter > end) {
 203 +       XFree (extra);
 204 +       return False;
 205 +    }
 206      memcpy (attr->pendingFilter, e, rep.pendingNbytesFilter);
 207      attr->pendingFilter[rep.pendingNbytesFilter] = '\0';
 208      e += (rep.pendingNbytesFilter + 3) & ~3;
 209      for (p = 0; p < rep.pendingNparamsFilter; p++) {
 210         INT32   f;
 211 +       if (e + 4 > end) {
 212 +           XFree (extra);
 213 +           return False;
 214 +       }
 215         memcpy (&f, e, 4);
 216         e += 4;
 217         attr->pendingParams[p] = (XFixed) f;
 218      }
 219      attr->pendingNparams = rep.pendingNparamsFilter;
 220
 221 +    if (e + rep.currentNbytesFilter > end) {
 222 +       XFree (extra);
 223 +       return False;
 224 +    }
 225      memcpy (attr->currentFilter, e, rep.currentNbytesFilter);
 226      attr->currentFilter[rep.currentNbytesFilter] = '\0';
 227      e += (rep.currentNbytesFilter + 3) & ~3;
 228      for (p = 0; p < rep.currentNparamsFilter; p++) {
 229         INT32   f;
 230 +       if (e + 4 > end) {
 231 +           XFree (extra);
 232 +           return False;
 233 +       }
 234         memcpy (&f, e, 4);
 235         e += 4;
 236         attr->currentParams[p] = (XFixed) f;
 237 diff --git a/src/XrrMonitor.c b/src/XrrMonitor.c
 238 index a9eaa7b..adc5330 100644
 239 --- a/src/XrrMonitor.c
 240 +++ b/src/XrrMonitor.c
 241 @@ -24,6 +24,7 @@
 242  #include <config.h>
 243  #endif
 244
 245 +#include <limits.h>
 246  #include <stdio.h>
 247  #include <X11/Xlib.h>
 248  /* we need to be able to manipulate the Display structure on events */
 249 @@ -65,6 +66,15 @@ XRRGetMonitors(Display *dpy, Window window, Bool get_active, int *nmonitors)
 250         return NULL;
 251      }
 252
 253 +    if (rep.length > INT_MAX >> 2 ||
 254 +       rep.nmonitors > INT_MAX / SIZEOF(xRRMonitorInfo) ||
 255 +       rep.noutputs > INT_MAX / 4 ||
 256 +       rep.nmonitors * SIZEOF(xRRMonitorInfo) > INT_MAX - rep.noutputs * 4) {
 257 +       _XEatData (dpy, rep.length);
 258 +       UnlockDisplay (dpy);
 259 +       SyncHandle ();
 260 +       return NULL;
 261 +    }
 262      nbytes = (long) rep.length << 2;
 263      nmon = rep.nmonitors;
 264      noutput = rep.noutputs;
 265 @@ -111,6 +121,14 @@ XRRGetMonitors(Display *dpy, Window window, Bool get_active, int *nmonitors)
 266             mon[m].outputs = output;
 267             buf += SIZEOF (xRRMonitorInfo);
 268             xoutput = (CARD32 *) buf;
 269 +           if (xmon->noutput > rep.noutputs) {
 270 +               Xfree(buf);
 271 +               Xfree(mon);
 272 +               UnlockDisplay (dpy);
 273 +               SyncHandle ();
 274 +               return NULL;
 275 +           }
 276 +           rep.noutputs -= xmon->noutput;
 277             for (o = 0; o < xmon->noutput; o++)
 278                 output[o] = xoutput[o];
 279             output += xmon->noutput;
 280 diff --git a/src/XrrOutput.c b/src/XrrOutput.c
 281 index 85f0b6e..30f3d40 100644
 282 --- a/src/XrrOutput.c
 283 +++ b/src/XrrOutput.c
 284 @@ -25,6 +25,7 @@
 285  #include <config.h>
 286  #endif
 287
 288 +#include <limits.h>
 289  #include <stdio.h>
 290  #include <X11/Xlib.h>
 291  /* we need to be able to manipulate the Display structure on events */
 292 @@ -60,6 +61,16 @@ XRRGetOutputInfo (Display *dpy, XRRScreenResources *resources, RROutput output)
 293         return NULL;
 294      }
 295
 296 +    if (rep.length > INT_MAX >> 2 || rep.length < (OutputInfoExtra >> 2))
 297 +    {
 298 +        if (rep.length > (OutputInfoExtra >> 2))
 299 +           _XEatDataWords (dpy, rep.length - (OutputInfoExtra >> 2));
 300 +       else
 301 +           _XEatDataWords (dpy, rep.length);
 302 +       UnlockDisplay (dpy);
 303 +       SyncHandle ();
 304 +       return NULL;
 305 +    }
 306      nbytes = ((long) (rep.length) << 2) - OutputInfoExtra;
 307
 308      nbytesRead = (long) (rep.nCrtcs * 4 +
 309 diff --git a/src/XrrProvider.c b/src/XrrProvider.c
 310 index 9e620c7..d796cd0 100644
 311 --- a/src/XrrProvider.c
 312 +++ b/src/XrrProvider.c
 313 @@ -25,6 +25,7 @@
 314  #include <config.h>
 315  #endif
 316
 317 +#include <limits.h>
 318  #include <stdio.h>
 319  #include <X11/Xlib.h>
 320  /* we need to be able to manipulate the Display structure on events */
 321 @@ -59,12 +60,20 @@ XRRGetProviderResources(Display *dpy, Window window)
 322        return NULL;
 323      }
 324
 325 -    nbytes = (long) rep.length << 2;
 326 +    if (rep.length < INT_MAX >> 2) {
 327 +       nbytes = (long) rep.length << 2;
 328
 329 -    nbytesRead = (long) (rep.nProviders * 4);
 330 +       nbytesRead = (long) (rep.nProviders * 4);
 331
 332 -    rbytes = (sizeof(XRRProviderResources) + rep.nProviders * sizeof(RRProvider));
 333 -    xrpr = (XRRProviderResources *) Xmalloc(rbytes);
 334 +       rbytes = (sizeof(XRRProviderResources) + rep.nProviders *
 335 +                 sizeof(RRProvider));
 336 +       xrpr = (XRRProviderResources *) Xmalloc(rbytes);
 337 +    } else {
 338 +       nbytes = 0;
 339 +       nbytesRead = 0;
 340 +       rbytes = 0;
 341 +       xrpr = NULL;
 342 +    }
 343
 344      if (xrpr == NULL) {
 345         _XEatDataWords (dpy, rep.length);
 346 @@ -121,6 +130,17 @@ XRRGetProviderInfo(Display *dpy, XRRScreenResources *resources, RRProvider provi
 347         return NULL;
 348      }
 349
 350 +    if (rep.length > INT_MAX >> 2 || rep.length < ProviderInfoExtra >> 2)
 351 +    {
 352 +       if (rep.length < ProviderInfoExtra >> 2)
 353 +           _XEatDataWords (dpy, rep.length);
 354 +       else
 355 +           _XEatDataWords (dpy, rep.length - (ProviderInfoExtra >> 2));
 356 +       UnlockDisplay (dpy);
 357 +       SyncHandle ();
 358 +       return NULL;
 359 +    }
 360 +
 361      nbytes = ((long) rep.length << 2) - ProviderInfoExtra;
 362
 363      nbytesRead = (long)(rep.nCrtcs * 4 +
 364 diff --git a/src/XrrScreen.c b/src/XrrScreen.c
 365 index b8ce7e5..1f7ffe6 100644
 366 --- a/src/XrrScreen.c
 367 +++ b/src/XrrScreen.c
 368 @@ -24,6 +24,7 @@
 369  #include <config.h>
 370  #endif
 371
 372 +#include <limits.h>
 373  #include <stdio.h>
 374  #include <X11/Xlib.h>
 375  /* we need to be able to manipulate the Display structure on events */
 376 @@ -105,27 +106,36 @@ doGetScreenResources (Display *dpy, Window window, int poll)
 377         xrri->has_rates = _XRRHasRates (xrri->minor_version, xrri->major_version);
 378      }
 379
 380 -    nbytes = (long) rep.length << 2;
 381 +    if (rep.length < INT_MAX >> 2) {
 382 +       nbytes = (long) rep.length << 2;
 383
 384 -    nbytesRead = (long) (rep.nCrtcs * 4 +
 385 -                        rep.nOutputs * 4 +
 386 -                        rep.nModes * SIZEOF (xRRModeInfo) +
 387 -                        ((rep.nbytesNames + 3) & ~3));
 388 +       nbytesRead = (long) (rep.nCrtcs * 4 +
 389 +                            rep.nOutputs * 4 +
 390 +                            rep.nModes * SIZEOF (xRRModeInfo) +
 391 +                            ((rep.nbytesNames + 3) & ~3));
 392
 393 -    /*
 394 -     * first we must compute how much space to allocate for
 395 -     * randr library's use; we'll allocate the structures in a single
 396 -     * allocation, on cleanlyness grounds.
 397 -     */
 398 +       /*
 399 +        * first we must compute how much space to allocate for
 400 +        * randr library's use; we'll allocate the structures in a single
 401 +        * allocation, on cleanlyness grounds.
 402 +        */
 403 +
 404 +       rbytes = (sizeof (XRRScreenResources) +
 405 +                 rep.nCrtcs * sizeof (RRCrtc) +
 406 +                 rep.nOutputs * sizeof (RROutput) +
 407 +                 rep.nModes * sizeof (XRRModeInfo) +
 408 +                 rep.nbytesNames + rep.nModes);    /* '\0' terminate names */
 409
 410 -    rbytes = (sizeof (XRRScreenResources) +
 411 -             rep.nCrtcs * sizeof (RRCrtc) +
 412 -             rep.nOutputs * sizeof (RROutput) +
 413 -             rep.nModes * sizeof (XRRModeInfo) +
 414 -             rep.nbytesNames + rep.nModes);    /* '\0' terminate names */
 415 +       xrsr = (XRRScreenResources *) Xmalloc(rbytes);
 416 +       wire_names = (char *) Xmalloc (rep.nbytesNames);
 417 +    } else {
 418 +       nbytes = 0;
 419 +       nbytesRead = 0;
 420 +       rbytes = 0;
 421 +       xrsr = NULL;
 422 +       wire_names = NULL;
 423 +    }
 424
 425 -    xrsr = (XRRScreenResources *) Xmalloc(rbytes);
 426 -    wire_names = (char *) Xmalloc (rep.nbytesNames);
 427      if (xrsr == NULL || wire_names == NULL) {
 428         Xfree (xrsr);
 429         Xfree (wire_names);
 430 @@ -174,6 +184,14 @@ doGetScreenResources (Display *dpy, Window window, int poll)
 431      wire_name = wire_names;
 432      for (i = 0; i < rep.nModes; i++)  {
 433         xrsr->modes[i].name = names;
 434 +       if (xrsr->modes[i].nameLength > rep.nbytesNames) {
 435 +           Xfree (xrsr);
 436 +           Xfree (wire_names);
 437 +           UnlockDisplay (dpy);
 438 +           SyncHandle ();
 439 +           return NULL;
 440 +       }
 441 +       rep.nbytesNames -= xrsr->modes[i].nameLength;
 442         memcpy (names, wire_name, xrsr->modes[i].nameLength);
 443         names[xrsr->modes[i].nameLength] = '\0';
 444         names += xrsr->modes[i].nameLength + 1;
 445 --
 446 2.10.1
 447