nx-libs/nx-X11/programs/Xserver/include, branch pr/render-cleanup

include: introduce byte counting functions.

2015-02-18T02:23:43+00:00

This patch adds the following three functions: bits_to_bytes(bits) - the number of bytes needed to hold 'bits' bytes_to_int32(bytes) - the number of 4-byte units to hold 'bytes' pad_to_int32(bytes) - the closest multiple of 4 equal to or larger than 'bytes'. All three operations are common in protocol processing and currently the server has ((foo + 7)/8 + 3)/4 operations all over the place. A common set of functions reduce the error rate of these (albeit simple) calculations and improve readability of the code. The functions do not check for overflow. v2: backport to nx-libs 3.6.x as a prereq for the CVE-2015-0255 fix (Mike DePaulo) Signed-off-by: Peter Hutterer

Xi: unvalidated lengths in Xinput extension [CVE-2014-8095]

2015-02-14T15:14:32+00:00

Multiple functions in the Xinput extension handling of requests from clients failed to check that the length of the request sent by the client was large enough to perform all the required operations and thus could read or write to memory outside the bounds of the request buffer. This commit includes the creation of a new REQUEST_AT_LEAST_EXTRA_SIZE macro in include/dix.h for the common case of needing to ensure a request is large enough to include both the request itself and a minimum amount of extra data following the request header. v2: backport to nx-libs 3.6.x (Mike DePaulo) Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Conflicts: Xi/chgdctl.c Xi/chgfctl.c Xi/xiallowev.c Xi/xichangecursor.c Xi/xichangehierarchy.c Xi/xigetclientpointer.c Xi/xigrabdev.c Xi/xipassivegrab.c Xi/xiproperty.c Xi/xiquerydevice.c Xi/xiquerypointer.c Xi/xiselectev.c Xi/xisetclientpointer.c Xi/xisetdevfocus.c Xi/xiwarppointer.c [RHEL5: Xi/xi* files are XI2 ]

dix: integer overflow in REQUEST_FIXED_SIZE() [CVE-2014-8092 4/4]

2015-02-14T15:14:32+00:00

Force use of 64-bit integers when evaluating data provided by clients in 32-bit fields which can overflow when added or multiplied during checks. Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer RHEL5: add #include for uint64_t v3: backport to nx-libs 3.6.x (Mike DePaulo)

dix: integer overflow in RegionSizeof() [CVE-2014-8092 3/4]

2015-02-14T15:14:32+00:00

RegionSizeof contains several integer overflows if a large length value is passed in. Once we fix it to return 0 on overflow, we also have to fix the callers to handle this error condition v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau. v3: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Reviewed-by: Julien Cristau Conflicts: dix/region.c include/regionstr.h

Provide build support for aarch64 architecture (606_nx-X11_build-on-aarch64.full.patch).

2015-02-13T12:37:33+00:00

drop .original files from the current code base

2015-02-02T14:04:01+00:00

Imported nx-X11-3.1.0-1.tar.gz

2011-10-10T15:43:39+00:00

Summary: Imported nx-X11-3.1.0-1.tar.gz Keywords: Imported nx-X11-3.1.0-1.tar.gz into Git repository