nx-libs/nx-X11/programs/Xserver/GL, branch pr/render-cve-fixes

library clean-up: Don't build and link libXfont.a anymore. Use system's libXfont shared library and link dynamically.

2015-04-22T04:22:37+00:00

glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8] (V3)

2015-02-14T15:14:32+00:00

v2: Handle more multiplies in indirect_reqsize.c (Julien Cristau) v3: RHEL5 backport v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Julien Cristau Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3)

2015-02-14T15:14:32+00:00

This is a half-measure until we start passing request length into the varsize function, but it's better than the nothing we had before. v2: Verify that there's at least a large render header's worth of dataBytes (Julien Cristau) v3: backport to RHEL5 v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie fixup swap

glx: Length checking for non-generated single requests (v2) [CVE-2014-8098 7/8]

2015-02-14T15:14:32+00:00

v2: Fix single versus vendor-private length checking for ARB_imaging subset extensions. (Julien Cristau) v3: Fix single versus vendor-private length checking for ARB_imaging subset extensions. (Julien Cristau) v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Julien Cristau Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie fix safe_Add

glx: Top-level length checking for swapped VendorPrivate requests [CVE-2014-8098 4/8]

2015-02-14T15:14:32+00:00

v2: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Keith Packard Reviewed-by: Julien Cristau Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

glx: Integer overflow protection for non-generated render requests (v3) [CVE-2014-8093 5/6]

2015-02-14T15:14:32+00:00

v2: Fix constants in __glXMap2fReqSize (Michal Srb) Validate w/h/d for proxy targets too (Keith Packard) v3: Fix Map[12]Size to correctly reject order == 0 (Julien Cristau) v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Keith Packard Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

glx: Length checking for GLXRender requests (v2) [CVE-2014-8098 2/8] (v3)

2015-02-14T15:14:32+00:00

v2: Remove can't-happen comparison for cmdlen < 0 (Michal Srb) v3: backport to RHEL5 hit old paths v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Adam Jackson Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Julien Cristau Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

glx: Add safe_{add,mul,pad} (v3) [CVE-2014-8093 4/6] (v4)

2015-02-14T15:14:32+00:00

These are paranoid about integer overflow, and will return -1 if their operation would overflow a (signed) integer or if either argument is negative. Note that RenderLarge requests are sized with a uint32_t so in principle this could be sketchy there, but dix limits bigreqs to 128M so you shouldn't ever notice, and honestly if you're sending more than 2G of rendering commands you're already doing something very wrong. v2: Use INT_MAX for consistency with the rest of the server (jcristau) v3: Reject negative arguments (anholt) v4: RHEL5: add limits.h, use inline v5: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Keith Packard Reviewed-by: Julien Cristau Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

glx: Additional paranoia in glXGetAnswerBuffer / GLX_GET_ANSWER_BUFFER (v2) [CVE-2014-8093 3/6]

2015-02-14T15:14:32+00:00

If the computed reply size is negative, something went wrong, treat it as an error. v2: Be more careful about size_t being unsigned (Matthieu Herrb) v3: SIZE_MAX not SIZE_T_MAX (Alan Coopersmith) v4: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Julien Cristau Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6]

2015-02-14T15:14:32+00:00

Before this we'd just clamp the image size to 0, which was just hideously stupid; if the parameters were such that they'd overflow an integer, you'd allocate a small buffer, then pass huge values into (say) ReadPixels, and now you're scribbling over arbitrary server memory. v2: backport to nx-libs 3.6.x (Mike DePaulo) Reviewed-by: Keith Packard Reviewed-by: Julien Cristau Reviewed-by: Michal Srb Reviewed-by: Andy Ritger Signed-off-by: Adam Jackson Signed-off-by: Alan Coopersmith Signed-off-by: Fedora X Ninjas Signed-off-by: Dave Airlie

nx-libs/nx-X11/programs/Xserver/GL, branch pr/render-cve-fixes

library clean-up: Don't build and link libXfont.a anymore. Use system's libXfont shared library and link dynamically.

glx: Pass remaining request length into ->varsize (v2) [CVE-2014-8098 8/8] (V3)

glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3)

glx: Length checking for non-generated single requests (v2) [CVE-2014-8098 7/8]

glx: Top-level length checking for swapped VendorPrivate requests [CVE-2014-8098 4/8]

glx: Integer overflow protection for non-generated render requests (v3) [CVE-2014-8093 5/6]

glx: Length checking for GLXRender requests (v2) [CVE-2014-8098 2/8] (v3)

glx: Add safe_{add,mul,pad} (v3) [CVE-2014-8093 4/6] (v4)

glx: Additional paranoia in __glXGetAnswerBuffer / __GLX_GET_ANSWER_BUFFER (v2) [CVE-2014-8093 3/6]

glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6]

glx: Additional paranoia in glXGetAnswerBuffer / GLX_GET_ANSWER_BUFFER (v2) [CVE-2014-8093 3/6]