nx-libs/nx-X11/lib, branch 3.5.99.2

Pending.c: conditionally include stdio.h

2016-10-13T12:05:20+00:00

Add a couple fixups for the security patches

2016-10-12T07:34:39+00:00

Add a couple fixups for the security patches - off-by-one in xkb - memory leak in an error path Backport from debian to NX: Ulrich Sibiller

XListFontsWithInfo: Re-decrement flist[0] before calling free() on it.

2016-10-12T07:34:39+00:00

Freeing a pointer that wasn't returned by malloc() is undefined behavior and produces an error with OpenBSD's implementation. Signed-off-by: Matthieu Herrb Reviewed-by: Alan Coopersmith Signed-off-by: Alan Coopersmith Signed-off-by: Julien Cristau Backported-to-NX-by: Ulrich Sibiller

_XkbReadGetMapReply: reject maxKeyCodes smaller than the minKeyCode

2016-10-12T07:34:39+00:00

Various other bounds checks in the code assume this is true, so enforce it when we first get the data from the X server. Signed-off-by: Alan Coopersmith Signed-off-by: Julien Cristau Backported-to-NX-by: Ulrich Sibiller

Use calloc in XOpenDisplay to initialize structs containing pointers

2016-10-12T07:34:39+00:00

Prevents trying to free uninitialized pointers if we have to bail out partway through setup, such as if we receive a corrupted or incomplete connection setup block from the server. Signed-off-by: Alan Coopersmith Signed-off-by: Julien Cristau Backported-to-NX-by: Ulrich Sibiller

Unbounded recursion in _XimParseStringFile() when parsing include files [CVE-2013-2004 2/2]

2016-10-12T07:34:39+00:00

parseline() can call _XimParseStringFile() which can call parseline() which can call _XimParseStringFile() which can call parseline() .... eventually causing recursive stack overflow and crash. Limit is set to a include depth of 100 files, which should be enough for all known use cases, but could be adjusted later if necessary. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Matthieu Herrb Signed-off-by: Julien Cristau Backported-to-NX-by: Ulrich Sibiller

Unbounded recursion in GetDatabase() when parsing include files [CVE-2013-2004 1/2]

2016-10-12T07:34:39+00:00

GetIncludeFile() can call GetDatabase() which can call GetIncludeFile() which can call GetDatabase() which can call GetIncludeFile() .... eventually causing recursive stack overflow and crash. Easily reproduced with a resource file that #includes itself. Limit is set to a include depth of 100 files, which should be enough for all known use cases, but could be adjusted later if necessary. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Matthieu Herrb Signed-off-by: Julien Cristau Backported-to-NX-by: Ulrich Sibiller

Avoid overflows in XListExtensions() [CVE-2013-1997 15/15]

2016-10-12T07:34:39+00:00

Ensure that when breaking the returned list into individual strings, we don't walk past the end of allocated memory to write the '\0' bytes Signed-off-by: Alan Coopersmith Reviewed-by: Matthieu Herrb Signed-off-by: Julien Cristau Backported-to-NX-by: Ulrich Sibiller

Avoid overflows in XGetFontPath() [CVE-2013-1997 14/15]

2016-10-12T07:34:39+00:00

Avoid overflows in XListFonts() [CVE-2013-1997 13/15]

2016-10-12T07:34:39+00:00