nx-libs/nx-X11/lib/font/fontfile, branch 3.6.x

library clean-up: Don't build and link libXfont.a anymore. Use system's libXfont shared library and link dynamically.

2015-04-22T04:22:37+00:00

old-arch cleanup: Drop CRAY support (i.e., drop code related to CRAY, _CRAY, WORD64, WORD64ALIGN, MUSTCOPY, UNSIGNEDBITFIELDS definitions).

2015-04-16T12:09:07+00:00

Do proper input validation to fix for CVE-2011-2895.

2015-02-16T09:29:36+00:00

It ensures that all valid input can be decompressed, checks that the overflow conditions doesn't happen and generally tightens the validation of the LZW stream and doesn't pessimize the inner loop for no good reason. It's derived from a change in libarchive from 2004. v2: backports to nx-libs 3.6.x (Mihai Moldovan) v3: fix comment lines starting with "+" + whitespace fixes (Mike Gabriel) Signed-off-by: Matthieu Herrb Reviewed-by: Tomas Hoger

Revert "Do proper input validation to fix for CVE-2011-2895."

2015-02-16T09:29:14+00:00

This reverts commit 6acafc9334828da22446380c81af81bde14b5d86.

Do proper input validation to fix for CVE-2011-2895.

2015-02-16T05:16:41+00:00

It ensures that all valid input can be decompressed, checks that the overflow conditions doesn't happen and generally tightens the validation of the LZW stream and doesn't pessimize the inner loop for no good reason. It's derived from a change in libarchive from 2004. v2: backports to nx-libs 3.6.x (Mihai Moldovan) Signed-off-by: Matthieu Herrb Reviewed-by: Tomas Hoger

CVE-2014-0209: integer overflow of realloc() size in lexAlias() from xorg/lib/libXfont commit 05c8020a49416dd8b7510cbba45ce4f3fc81a7dc

2015-02-14T15:14:31+00:00

lexAlias() reads from a file in a loop. It does this by starting with a 64 byte buffer. If that size limit is hit, it does a realloc of the buffer size << 1, basically doubling the needed length every time the length limit is hit. Eventually, this will shift out to 0 (for a length of ~4gig), and that length will be passed on to realloc(). A length of 0 (with a valid pointer) causes realloc to free the buffer on most POSIX platforms, but the caller will still have a pointer to it, leading to use after free issues.

CVE-2014-0209: integer overflow of realloc() size in FontFileAddEntry() from xorg/lib/libXfont commit 2f5e57317339c526e6eaee1010b0e2ab8089c42e

2015-02-14T15:14:31+00:00

FontFileReadDirectory() opens a fonts.dir file, and reads over every line in an fscanf loop. For each successful entry read (font name, file name) a call is made to FontFileAddFontFile(). FontFileAddFontFile() will add a font file entry (for the font name and file) each time it’s called, by calling FontFileAddEntry(). FontFileAddEntry() will do the actual adding. If the table it has to add to is full, it will do a realloc, adding 100 more entries to the table size without checking to see if that will overflow the int used to store the size.

LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0

2015-02-14T15:14:31+00:00

Specially crafted LZW stream can crash an application using libXfont that is used to open untrusted font files. With X server, this may allow privilege escalation when exploited

drop .original files from the current code base

2015-02-02T14:04:01+00:00

Imported nx-X11-3.3.0-7.tar.gz

2011-10-10T15:47:42+00:00

Summary: Imported nx-X11-3.3.0-7.tar.gz Keywords: Imported nx-X11-3.3.0-7.tar.gz into Git repository