diff options
author | Mihai Moldovan <ionic@ionic.de> | 2017-12-15 12:55:17 +0100 |
---|---|---|
committer | Mihai Moldovan <ionic@ionic.de> | 2017-12-15 12:55:17 +0100 |
commit | 1dad092caf01d733990648e6df64cbf964df5143 (patch) | |
tree | 39de0e643e76754a3e23ca9dd0350b8ba4f76250 /debian/patches/1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch | |
parent | 6d70b9e3c47f27a166f4aacb522c5c1e49092dd9 (diff) | |
parent | 2b9025f797ee322e21077e100c2ee27c2e7fa0e0 (diff) | |
download | nx-libs-1dad092caf01d733990648e6df64cbf964df5143.tar.gz nx-libs-1dad092caf01d733990648e6df64cbf964df5143.tar.bz2 nx-libs-1dad092caf01d733990648e6df64cbf964df5143.zip |
Merge branch '3.6.x'
Diffstat (limited to 'debian/patches/1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch')
-rw-r--r-- | debian/patches/1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch | 153 |
1 files changed, 0 insertions, 153 deletions
diff --git a/debian/patches/1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch b/debian/patches/1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch deleted file mode 100644 index eded3517a..000000000 --- a/debian/patches/1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch +++ /dev/null @@ -1,153 +0,0 @@ -From 50e80a06c84375e39af02b24f01a949cb565a49d Mon Sep 17 00:00:00 2001 -From: Mike DePaulo <mikedep333@gmail.com> -Date: Sun, 8 Feb 2015 21:39:55 -0500 -Subject: [PATCH 09/40] CVE-2014-0210: unvalidated lengths when reading replies - from font server from xorg/lib/libXfont commit - cbb64aef35960b2882be721f4b8fbaa0fb649d12 - -Functions to handle replies to font server requests were casting replies -from the generic form to reply specific structs without first checking -that the reply was at least as long as the struct being cast to. ---- - nx-X11/lib/font/fc/fserve.c | 44 ++++++++++++++++++++++++++++++++++++++------ - 1 file changed, 38 insertions(+), 6 deletions(-) - ---- a/nx-X11/lib/font/fc/fserve.c -+++ b/nx-X11/lib/font/fc/fserve.c -@@ -94,6 +94,12 @@ in this Software without prior written a - (pci)->descent || \ - (pci)->characterWidth) - -+/* -+ * SIZEOF(r) is in bytes, length fields in the protocol are in 32-bit words, -+ * so this converts for doing size comparisons. -+ */ -+#define LENGTHOF(r) (SIZEOF(r) >> 2) -+ - extern void ErrorF(const char *f, ...); - - static int fs_read_glyphs ( FontPathElementPtr fpe, FSBlockDataPtr blockrec ); -@@ -209,9 +215,22 @@ _fs_add_rep_log (FSFpePtr conn, fsGeneri - rep->sequenceNumber, - conn->reqbuffer[i].opcode); - } -+ -+#define _fs_reply_failed(rep, name, op) do { \ -+ if (rep) { \ -+ if (rep->type == FS_Error) \ -+ fprintf (stderr, "Error: %d Request: %s\n", \ -+ ((fsError *)rep)->request, #name); \ -+ else \ -+ fprintf (stderr, "Bad Length for %s Reply: %d %s %d\n", \ -+ #name, rep->length, op, LENGTHOF(name)); \ -+ } \ -+} while (0) -+ - #else - #define _fs_add_req_log(conn,op) ((conn)->current_seq++) - #define _fs_add_rep_log(conn,rep) -+#define _fs_reply_failed(rep,name,op) - #endif - - static Bool -@@ -693,13 +712,15 @@ fs_read_open_font(FontPathElementPtr fpe - int ret; - - rep = (fsOpenBitmapFontReply *) fs_get_reply (conn, &ret); -- if (!rep || rep->type == FS_Error) -+ if (!rep || rep->type == FS_Error || -+ (rep->length != LENGTHOF(fsOpenBitmapFontReply))) - { - if (ret == FSIO_BLOCK) - return StillWorking; - if (rep) - _fs_done_read (conn, rep->length << 2); - fs_cleanup_bfont (bfont); -+ _fs_reply_failed (rep, fsOpenBitmapFontReply, "!="); - return BadFontName; - } - -@@ -835,13 +856,15 @@ fs_read_query_info(FontPathElementPtr fp - int ret; - - rep = (fsQueryXInfoReply *) fs_get_reply (conn, &ret); -- if (!rep || rep->type == FS_Error) -+ if (!rep || rep->type == FS_Error || -+ (rep->length < LENGTHOF(fsQueryXInfoReply))) - { - if (ret == FSIO_BLOCK) - return StillWorking; - if (rep) - _fs_done_read (conn, rep->length << 2); - fs_cleanup_bfont (bfont); -+ _fs_reply_failed (rep, fsQueryXInfoReply, "<"); - return BadFontName; - } - -@@ -962,13 +985,15 @@ fs_read_extent_info(FontPathElementPtr f - FontInfoRec *fi = &bfont->pfont->info; - - rep = (fsQueryXExtents16Reply *) fs_get_reply (conn, &ret); -- if (!rep || rep->type == FS_Error) -+ if (!rep || rep->type == FS_Error || -+ (rep->length < LENGTHOF(fsQueryXExtents16Reply))) - { - if (ret == FSIO_BLOCK) - return StillWorking; - if (rep) - _fs_done_read (conn, rep->length << 2); - fs_cleanup_bfont (bfont); -+ _fs_reply_failed (rep, fsQueryXExtents16Reply, "<"); - return BadFontName; - } - -@@ -1833,13 +1858,15 @@ fs_read_glyphs(FontPathElementPtr fpe, F - unsigned long minchar, maxchar; - - rep = (fsQueryXBitmaps16Reply *) fs_get_reply (conn, &ret); -- if (!rep || rep->type == FS_Error) -+ if (!rep || rep->type == FS_Error || -+ (rep->length < LENGTHOF(fsQueryXBitmaps16Reply))) - { - if (ret == FSIO_BLOCK) - return StillWorking; - if (rep) - _fs_done_read (conn, rep->length << 2); - err = AllocError; -+ _fs_reply_failed (rep, fsQueryXBitmaps16Reply, "<"); - goto bail; - } - -@@ -2243,12 +2270,14 @@ fs_read_list(FontPathElementPtr fpe, FSB - int err; - - rep = (fsListFontsReply *) fs_get_reply (conn, &ret); -- if (!rep || rep->type == FS_Error) -+ if (!rep || rep->type == FS_Error || -+ (rep->length < LENGTHOF(fsListFontsReply))) - { - if (ret == FSIO_BLOCK) - return StillWorking; - if (rep) - _fs_done_read (conn, rep->length << 2); -+ _fs_reply_failed (rep, fsListFontsReply, "<"); - return AllocError; - } - data = (char *) rep + SIZEOF (fsListFontsReply); -@@ -2366,12 +2395,15 @@ fs_read_list_info(FontPathElementPtr fpe - _fs_free_props (&binfo->info); - - rep = (fsListFontsWithXInfoReply *) fs_get_reply (conn, &ret); -- if (!rep || rep->type == FS_Error) -+ if (!rep || rep->type == FS_Error || -+ ((rep->nameLength != 0) && -+ (rep->length < LENGTHOF(fsListFontsWithXInfoReply)))) - { - if (ret == FSIO_BLOCK) - return StillWorking; - binfo->status = FS_LFWI_FINISHED; - err = AllocError; -+ _fs_reply_failed (rep, fsListFontsWithXInfoReply, "<"); - goto done; - } - /* |