NXv3 (redistributed) https://cgit.arctica-project.org/nx-libs/atom?h=3.5.99.14 2015-04-22T04:22:37+00:00 2015-04-22T04:22:37+00:00 Mike Gabriel mike.gabriel@das-netzwerkteam.de 2015-04-14T07:24:55+00:00 urn:sha1:70b77a0fc329e2e205a596a738c7307d354e7b1c 2015-02-16T04:47:25+00:00 Mike DePaulo mikedep333@gmail.com 2015-02-09T03:08:09+00:00 urn:sha1:e29bbd5bf0565eaf7c02f85a57b87f66531fa6b3 fs_read_query_info() parses a reply from the font server. The reply contains embedded length fields, none of which are validated. This can cause out of bound reads in either fs_read_query_info() or in _fs_convert_props() which it calls to parse the fsPropInfo in the reply. v2: apply correctly on nx-libs 3.6.x (Mihai Moldovan) 2015-02-16T04:26:40+00:00 Mihai Moldovan ionic@ionic.de 2015-02-16T04:26:40+00:00 urn:sha1:5fc2f57fb5520bb61e2c1f8b6fd2522b203b3b9d This reverts commit c6aebf9284855a0e24ad9c5ffdd36aa65e16bec7. 2015-02-14T15:14:31+00:00 Mike DePaulo mikedep333@gmail.com 2015-02-09T03:23:51+00:00 urn:sha1:a0bed4d9fce8ffc96f13ca13b95d2a7913d20719 fs_alloc_glyphs() is a malloc wrapper used by the font code. It contains a classic integer overflow in the malloc() call, which can cause memory corruption. 2015-02-14T15:14:31+00:00 Mike DePaulo mikedep333@gmail.com 2015-02-09T03:08:09+00:00 urn:sha1:c6aebf9284855a0e24ad9c5ffdd36aa65e16bec7 fs_read_query_info() parses a reply from the font server. The reply contains embedded length fields, none of which are validated. This can cause out of bound reads in either fs_read_query_info() or in _fs_convert_props() which it calls to parse the fsPropInfo in the reply. 2011-10-10T15:43:39+00:00 Reinhard Tartler siretart@tauware.de 2011-10-10T15:43:39+00:00 urn:sha1:f4092abdf94af6a99aff944d6264bc1284e8bdd4 Summary: Imported nx-X11-3.1.0-1.tar.gz Keywords: Imported nx-X11-3.1.0-1.tar.gz into Git repository