CVE patches were previously not included in release tarballs.

Rename:
    - 1001-LZW-decompress-fix-for-CVE-2011-2895-From-xorg-lib-X.patch =>
      1001-LZW-decompress-fix-for-CVE-2011-2895-From-xorg-.full.patch
    - 1002-Fix-CVE-2011-4028-File-disclosure-vulnerability.-ups.patch =>
      1002-Fix-CVE-2011-4028-File-disclosure-vulnerability.full.patch
    - 1003-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch =>
      1003-Avoid-use-after-free-in-dix-dixfonts.c-doImageT.full.patch
    - 1004-CVE-2013-6462-unlimited-sscanf-overflows-stack-buffe.patch =>
      1004-CVE-2013-6462-unlimited-sscanf-overflows-stack-.full.patch
    - 1005-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch =>
      1005-CVE-2014-0209-integer-overflow-of-realloc-size-.full.patch
    - 1006-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch =>
      1006-CVE-2014-0209-integer-overflow-of-realloc-size-.full.patch
    - 1007-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch =>
      1007-CVE-2014-0210-unvalidated-length-in-_fs_recv_co.full.patch
    - 1008-Don-t-crash-when-we-receive-an-FS_Error-from-the-fon.patch =>
      1008-Don-t-crash-when-we-receive-an-FS_Error-from-th.full.patch
    - 1009-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch =>
      1009-CVE-2014-0210-unvalidated-lengths-when-reading-.full.patch
    - 1010-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch =>
      1010-CVE-2014-0211-Integer-overflow-in-fs_get_reply-.full.patch
    - 1011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch =>
      1011-CVE-2014-0210-unvalidated-length-fields-in-fs_r.full.patch
    - 1012-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch =>
      1012-CVE-2014-0211-integer-overflow-in-fs_read_exten.full.patch
    - 1013-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs-fr.patch =>
      1013-CVE-2014-0211-integer-overflow-in-fs_alloc_glyp.full.patch
    - 1014-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch =>
      1014-CVE-2014-0210-unvalidated-length-fields-in-fs_r.full.patch
    - 1015-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch =>
      1015-CVE-2014-0210-unvalidated-length-fields-in-fs_r.full.patch
    - 1016-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch =>
      1016-CVE-2014-0210-unvalidated-length-fields-in-fs_r.full.patch
    - 1017-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch =>
      1017-CVE-2014-0210-unvalidated-length-fields-in-fs_r.full.patch
    - 1018-unchecked-malloc-may-allow-unauthed-client-to-crash-.patch =>
      1018-unchecked-malloc-may-allow-unauthed-client-to-c.full.patch
    - 1019-dix-integer-overflow-in-ProcPutImage-CVE-2014-8092-1.patch =>
      1019-dix-integer-overflow-in-ProcPutImage-CVE-2014-8.full.patch
    - 1020-dix-integer-overflow-in-GetHosts-CVE-2014-8092-2-4.patch =>
      1020-dix-integer-overflow-in-GetHosts-CVE-2014-8092-.full.patch
    - 1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8092-3.patch =>
      1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8.full.patch
    - 1022-dix-integer-overflow-in-REQUEST_FIXED_SIZE-CVE-2014-.patch =>
      1022-dix-integer-overflow-in-REQUEST_FIXED_SIZE-CVE-.full.patch
    - 1023-dbe-unvalidated-lengths-in-DbeSwapBuffers-calls-CVE-.patch =>
      1023-dbe-unvalidated-lengths-in-DbeSwapBuffers-calls.full.patch
    - 1024-Xi-unvalidated-lengths-in-Xinput-extension-CVE-2014-.patch =>
      1024-Xi-unvalidated-lengths-in-Xinput-extension-CVE-.full.patch
    - 1025-xcmisc-unvalidated-length-in-SProcXCMiscGetXIDList-C.patch =>
      1025-xcmisc-unvalidated-length-in-SProcXCMiscGetXIDL.full.patch
    - 1026-Xv-unvalidated-lengths-in-XVideo-extension-swapped-p.patch =>
      1026-Xv-unvalidated-lengths-in-XVideo-extension-swap.full.patch
    - 1027-render-check-request-size-before-reading-it-CVE-2014.patch =>
      1027-render-check-request-size-before-reading-it-CVE.full.patch
    - 1028-render-unvalidated-lengths-in-Render-extn.-swapped-p.patch =>
      1028-render-unvalidated-lengths-in-Render-extn.-swap.full.patch
    - 1029-xfixes-unvalidated-length-in-SProcXFixesSelectSelect.patch =>
      1029-xfixes-unvalidated-length-in-SProcXFixesSelectS.full.patch
    - 1030-randr-unvalidated-lengths-in-RandR-extension-swapped.patch =>
      1030-randr-unvalidated-lengths-in-RandR-extension-sw.full.patch
    - 1031-glx-Be-more-paranoid-about-variable-length-requests-.patch =>
      1031-glx-Be-more-paranoid-about-variable-length-requ.full.patch
    - 1032-glx-Be-more-strict-about-rejecting-invalid-image-siz.patch =>
      1032-glx-Be-more-strict-about-rejecting-invalid-imag.full.patch
    - 1033-glx-Additional-paranoia-in-__glXGetAnswerBuffer-__GL.patch =>
      1033-glx-Additional-paranoia-in-__glXGetAnswerBuffer.full.patch
    - 1034-glx-Add-safe_-add-mul-pad-v3-CVE-2014-8093-4-6-v4.patch =>
      1034-glx-Add-safe_-add-mul-pad-v3-CVE-2014-8093-4-6-.full.patch
    - 1035-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch =>
      1035-glx-Length-checking-for-GLXRender-requests-v2-C.full.patch
    - 1036-glx-Integer-overflow-protection-for-non-generated-re.patch =>
      1036-glx-Integer-overflow-protection-for-non-generat.full.patch
    - 1037-glx-Top-level-length-checking-for-swapped-VendorPriv.patch =>
      1037-glx-Top-level-length-checking-for-swapped-Vendo.full.patch
    - 1038-glx-Length-checking-for-non-generated-single-request.patch =>
      1038-glx-Length-checking-for-non-generated-single-re.full.patch
    - 1039-glx-Length-checking-for-RenderLarge-requests-v2-CVE-.patch =>
      1039-glx-Length-checking-for-RenderLarge-requests-v2.full.patch
    - 1040-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch =>
      1040-glx-Pass-remaining-request-length-into-varsize-.full.patch
    - 1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch =>
      1041-nx-X11-lib-font-fc-fserve.c-initialize-remainin.full.patch
    - 1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch =>
      1042-Do-proper-input-validation-to-fix-for-CVE-2011-.full.patch
    - 1101-Coverity-844-845-846-Fix-memory-leaks.patch =>
      1101-Coverity-844-845-846-Fix-memory-leaks.full.patch
    - 1102-include-introduce-byte-counting-functions.patch =>
      1102-include-introduce-byte-counting-functions.full.patch
    - 1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input-buff.patch =>
      1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch
    - 1104-xkb-Check-strings-length-against-request-size.patch =>
      1104-xkb-Check-strings-length-against-request-size.full.patch

1 files changed, 205 insertions, 0 deletions

diff --git a/debian/patches/1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8.full.patch b/debian/patches/1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8.full.patch
new file mode 100644
index 000000000..a189cd537
--- /dev/null
+++ b/debian/patches/1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8.full.patch
@@ -0,0 +1,205 @@
+From ed1e13a1f4e316bcf0dc0d4b2c16b1df3f075005 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Wed, 22 Jan 2014 22:37:15 -0800
+Subject: [PATCH 21/40] dix: integer overflow in RegionSizeof() [CVE-2014-8092
+ 3/4]
+
+RegionSizeof contains several integer overflows if a large length
+value is passed in.  Once we fix it to return 0 on overflow, we
+also have to fix the callers to handle this error condition
+
+v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau.
+v3: backport to nx-libs 3.6.x (Mike DePaulo)
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Julien Cristau <jcristau@debian.org>
+
+Conflicts:
+	dix/region.c
+	include/regionstr.h
+---
+ nx-X11/programs/Xserver/include/regionstr.h | 10 +++++---
+ nx-X11/programs/Xserver/mi/miregion.c       | 39 ++++++++++++++++++++---------
+ 2 files changed, 34 insertions(+), 15 deletions(-)
+
+diff --git a/nx-X11/programs/Xserver/include/regionstr.h b/nx-X11/programs/Xserver/include/regionstr.h
+index 000bf3f..cf41170 100644
+--- a/nx-X11/programs/Xserver/include/regionstr.h
++++ b/nx-X11/programs/Xserver/include/regionstr.h
+@@ -53,6 +53,9 @@ SOFTWARE.
+ 
+ typedef struct _Region RegionRec, *RegionPtr;
+ 
++#include <stddef.h>
++#include <limits.h>
++
+ #include "miscstruct.h"
+ 
+ /* Return values from RectIn() */
+@@ -93,7 +96,7 @@ extern RegDataRec miBrokenData;
+ #define REGION_BOX(reg,i) (&REGION_BOXPTR(reg)[i])
+ #define REGION_TOP(reg) REGION_BOX(reg, (reg)->data->numRects)
+ #define REGION_END(reg) REGION_BOX(reg, (reg)->data->numRects - 1)
+-#define REGION_SZOF(n) (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)))
++#define REGION_SZOF(n) (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)) ?  sizeof(RegDataRec) + ((n) * sizeof(BoxRec)) : 0)
+ 
+ /* Keith recommends weaning the region code of pScreen argument */
+ #define REG_pScreen	screenInfo.screens[0]
+@@ -257,9 +260,10 @@ extern RegDataRec miBrokenData;
+     } \
+     else \
+     { \
++        size_t rgnSize; \
+         (_pReg)->extents = miEmptyBox; \
+-        if (((_size) > 1) && ((_pReg)->data = \
+-                             (RegDataPtr)xalloc(REGION_SZOF(_size)))) \
++        if (((_size) > 1) && ((rgnSize = REGION_SZOF(_size)) > 0) && \
++            ((_pReg)->data = (RegDataPtr)xalloc(rgnSize))) \
+         { \
+             (_pReg)->data->size = (_size); \
+             (_pReg)->data->numRects = 0; \
+diff --git a/nx-X11/programs/Xserver/mi/miregion.c b/nx-X11/programs/Xserver/mi/miregion.c
+index df33248..5ec4ec5 100644
+--- a/nx-X11/programs/Xserver/mi/miregion.c
++++ b/nx-X11/programs/Xserver/mi/miregion.c
+@@ -172,7 +172,6 @@ Equipment Corporation.
+         ((r1)->y1 <= (r2)->y1) && \
+         ((r1)->y2 >= (r2)->y2) )
+ 
+-#define xallocData(n) (RegDataPtr)xalloc(REGION_SZOF(n))
+ #define xfreeData(reg) if ((reg)->data && (reg)->data->size) xfree((reg)->data)
+ 
+ #define RECTALLOC_BAIL(pReg,n,bail) \
+@@ -209,8 +208,9 @@ if (!(pReg)->data || (((pReg)->data->numRects + (n)) > (pReg)->data->size)) \
+ #define DOWNSIZE(reg,numRects)						 \
+ if (((numRects) < ((reg)->data->size >> 1)) && ((reg)->data->size > 50)) \
+ {									 \
+-    RegDataPtr NewData;							 \
+-    NewData = (RegDataPtr)xrealloc((reg)->data, REGION_SZOF(numRects));	 \
++    size_t NewSize = REGION_SZOF(numRects);				 \
++    RegDataPtr NewData =						 \
++	(NewSize > 0) ? (RegDataPtr)xrealloc((reg)->data, NewSize) : NULL;	 \
+     if (NewData)							 \
+     {									 \
+ 	NewData->size = (numRects);					 \
+@@ -337,7 +337,7 @@ miRegionCreate(rect, size)
+     int size;
+ {
+     register RegionPtr pReg;
+-   
++    size_t newSize;
+     pReg = (RegionPtr)xalloc(sizeof(RegionRec));
+     if (!pReg)
+ 	return &miBrokenRegion;
+@@ -349,7 +349,9 @@ miRegionCreate(rect, size)
+     else
+     {
+ 	pReg->extents = miEmptyBox;
+-	if ((size > 1) && (pReg->data = xallocData(size)))
++	newSize = REGION_SZOF(size);
++	if ((size > 1) && (newSize > 0) &&
++	    (pReg->data = xalloc(newSize)))
+ 	{
+ 	    pReg->data->size = size;
+ 	    pReg->data->numRects = 0;
+@@ -371,6 +373,8 @@ miRegionInit(pReg, rect, size)
+     BoxPtr rect;
+     int size;
+ {
++    size_t newSize;
++
+     if (rect)
+     {
+ 	pReg->extents = *rect;
+@@ -379,7 +383,9 @@ miRegionInit(pReg, rect, size)
+     else
+     {
+ 	pReg->extents = miEmptyBox;
+-	if ((size > 1) && (pReg->data = xallocData(size)))
++	newSize = REGION_SZOF(size);
++	if ((size > 1) && (newSize > 0) &&
++	    (pReg->data = xalloc(newSize)))
+ 	{
+ 	    pReg->data->size = size;
+ 	    pReg->data->numRects = 0;
+@@ -423,11 +429,13 @@ miRectAlloc(
+     int n)
+ {
+     RegDataPtr	data;
++    size_t rgnSize;
+     
+     if (!pRgn->data)
+     {
+ 	n++;
+-	pRgn->data = xallocData(n);
++	rgnSize = REGION_SZOF(n);
++	pRgn->data = (rgnSize > 0) ? xalloc(rgnSize) : NULL;
+ 	if (!pRgn->data)
+ 	    return miRegionBreak (pRgn);
+ 	pRgn->data->numRects = 1;
+@@ -435,7 +443,8 @@ miRectAlloc(
+     }
+     else if (!pRgn->data->size)
+     {
+-	pRgn->data = xallocData(n);
++	rgnSize = REGION_SZOF(n);
++	pRgn->data = (rgnSize > 0) ? xalloc(rgnSize) : NULL;
+ 	if (!pRgn->data)
+ 	    return miRegionBreak (pRgn);
+ 	pRgn->data->numRects = 0;
+@@ -449,7 +458,8 @@ miRectAlloc(
+ 		n = 250;
+ 	}
+ 	n += pRgn->data->numRects;
+-	data = (RegDataPtr)xrealloc(pRgn->data, REGION_SZOF(n));
++	rgnSize = REGION_SZOF(n);
++	data = (rgnSize > 0) ? xrealloc(pRgn->data, rgnSize) : NULL;
+ 	if (!data)
+ 	    return miRegionBreak (pRgn);
+ 	pRgn->data = data;
+@@ -476,8 +486,10 @@ miRegionCopy(dst, src)
+     }
+     if (!dst->data || (dst->data->size < src->data->numRects))
+     {
++	size_t newSize = REGION_SZOF(src->data->numRects);
+ 	xfreeData(dst);
+-	dst->data = xallocData(src->data->numRects);
++
++	dst->data = newSize > 0 ? xalloc(newSize) : NULL;
+ 	if (!dst->data)
+ 	    return miRegionBreak (dst);
+ 	dst->data->size = src->data->numRects;
+@@ -1667,6 +1679,7 @@ miRectsToRegion(nrects, prect, ctype)
+     register BoxPtr	pBox;
+     register int        i;
+     int			x1, y1, x2, y2;
++    size_t newSize;
+ 
+     pRgn = miRegionCreate(NullBox, 0);
+     if (REGION_NAR (pRgn))
+@@ -1691,7 +1704,8 @@ miRectsToRegion(nrects, prect, ctype)
+ 	}
+ 	return pRgn;
+     }
+-    pData = xallocData(nrects);
++    newSize = REGION_SZOF(nrects);
++    pData = newSize > 0 ? xalloc(newSize) : NULL;
+     if (!pData)
+     {
+ 	miRegionBreak (pRgn);
+@@ -2206,8 +2220,9 @@ miRegionDataCopy(
+     }
+     if (!dst->data || (dst->data->size < src->data->numRects))
+     {
++	size_t newSize = REGION_SZOF(src->data->numRects);
+ 	xfreeData(dst);
+-	dst->data = xallocData(src->data->numRects);
++	dst->data = newSize > 0 ? xalloc(newSize) : NULL;
+ 	if (!dst->data)
+ 	    return miRegionBreak (dst);
+     }
+-- 
+2.1.4
+