40 patches, fixing several X.Org CVEs in NX.

* Security fixes:
  - Rebase loads of X.Org patches (mainly from RHEL-5) against NX. If not
    all patches from a CVE patch series appear here, then it means that
    the affected file/code is not used in NX at build time.
  - X.Org CVE-2011-2895:
      1001-LZW-decompress-fix-for-CVE-2011-2895-From-xorg-lib-X.patch
  - X.Org CVE-2011-4028:
      1002-Fix-CVE-2011-4028-File-disclosure-vulnerability.-ups.patch
  - X.Org CVE-2013-4396:
      1003-Avoid-use-after-free-in-dix-dixfonts.c-doImageText-C.patch
  - X.Org CVE-2013-6462:
      1004-CVE-2013-6462-unlimited-sscanf-overflows-stack-buffe.patch
  - X.Org CVE-2014-0209:
      1005-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch
      1006-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch
  - X.Org CVE-2014-0210:
      1007-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch
      1009-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch
      1011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch
      1014-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch
      1015-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch
      1016-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch
      1017-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch
  - X.Org CVE-2014-0211:
      1010-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch
      1012-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch
      1013-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs-fr.patch
      1018-unchecked-malloc-may-allow-unauthed-client-to-crash-.patch
  - X.Org CVE-2014-8092:
      1019-dix-integer-overflow-in-ProcPutImage-CVE-2014-8092-1.patch
      1020-dix-integer-overflow-in-GetHosts-CVE-2014-8092-2-4.patch
      1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8092-3.patch
      1022-dix-integer-overflow-in-REQUEST_FIXED_SIZE-CVE-2014-.patch
  - X.Org CVE-2014-8097:
      1023-dbe-unvalidated-lengths-in-DbeSwapBuffers-calls-CVE-.patch
  - X.Org CVE-2014-8095:
      1024-Xi-unvalidated-lengths-in-Xinput-extension-CVE-2014-.patch
  - X.Org CVE-2014-8096:
      1025-xcmisc-unvalidated-length-in-SProcXCMiscGetXIDList-C.patch
  - X.Org CVE-2014-8099:
      1026-Xv-unvalidated-lengths-in-XVideo-extension-swapped-p.patch
  - X.Org CVE-2014-8100:
      1027-render-check-request-size-before-reading-it-CVE-2014.patch
      1028-render-unvalidated-lengths-in-Render-extn.-swapped-p.patch
  - X.Org CVE-2014-8102:
      1029-xfixes-unvalidated-length-in-SProcXFixesSelectSelect.patch
  - X.Org CVE-2014-8101:
      1030-randr-unvalidated-lengths-in-RandR-extension-swapped.patch
  - X.Org CVE-2014-8093:
      1031-glx-Be-more-paranoid-about-variable-length-requests-.patch
      1032-glx-Be-more-strict-about-rejecting-invalid-image-siz.patch
      1033-glx-Additional-paranoia-in-__glXGetAnswerBuffer-__GL.patch
      1034-glx-Add-safe_-add-mul-pad-v3-CVE-2014-8093-4-6-v4.patch
      1036-glx-Integer-overflow-protection-for-non-generated-re.patch
  - X.Org CVE-2014-8098:
      1035-glx-Length-checking-for-GLXRender-requests-v2-CVE-20.patch
      1037-glx-Top-level-length-checking-for-swapped-VendorPriv.patch
      1038-glx-Length-checking-for-non-generated-single-request.patch
      1039-glx-Length-checking-for-RenderLarge-requests-v2-CVE-.patch
      1040-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch
  - Security fixes with no assigned CVE:
      1008-Don-t-crash-when-we-receive-an-FS_Error-from-the-fon.patch

1 files changed, 205 insertions, 0 deletions

diff --git a/debian/patches/1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8092-3.patch b/debian/patches/1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8092-3.patch
new file mode 100644
index 000000000..a189cd537
--- /dev/null
+++ b/debian/patches/1021-dix-integer-overflow-in-RegionSizeof-CVE-2014-8092-3.patch
@@ -0,0 +1,205 @@
+From ed1e13a1f4e316bcf0dc0d4b2c16b1df3f075005 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Wed, 22 Jan 2014 22:37:15 -0800
+Subject: [PATCH 21/40] dix: integer overflow in RegionSizeof() [CVE-2014-8092
+ 3/4]
+
+RegionSizeof contains several integer overflows if a large length
+value is passed in.  Once we fix it to return 0 on overflow, we
+also have to fix the callers to handle this error condition
+
+v2: Fixed limit calculation in RegionSizeof as pointed out by jcristau.
+v3: backport to nx-libs 3.6.x (Mike DePaulo)
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Julien Cristau <jcristau@debian.org>
+
+Conflicts:
+	dix/region.c
+	include/regionstr.h
+---
+ nx-X11/programs/Xserver/include/regionstr.h | 10 +++++---
+ nx-X11/programs/Xserver/mi/miregion.c       | 39 ++++++++++++++++++++---------
+ 2 files changed, 34 insertions(+), 15 deletions(-)
+
+diff --git a/nx-X11/programs/Xserver/include/regionstr.h b/nx-X11/programs/Xserver/include/regionstr.h
+index 000bf3f..cf41170 100644
+--- a/nx-X11/programs/Xserver/include/regionstr.h
++++ b/nx-X11/programs/Xserver/include/regionstr.h
+@@ -53,6 +53,9 @@ SOFTWARE.
+ 
+ typedef struct _Region RegionRec, *RegionPtr;
+ 
++#include <stddef.h>
++#include <limits.h>
++
+ #include "miscstruct.h"
+ 
+ /* Return values from RectIn() */
+@@ -93,7 +96,7 @@ extern RegDataRec miBrokenData;
+ #define REGION_BOX(reg,i) (&REGION_BOXPTR(reg)[i])
+ #define REGION_TOP(reg) REGION_BOX(reg, (reg)->data->numRects)
+ #define REGION_END(reg) REGION_BOX(reg, (reg)->data->numRects - 1)
+-#define REGION_SZOF(n) (sizeof(RegDataRec) + ((n) * sizeof(BoxRec)))
++#define REGION_SZOF(n) (n < ((INT_MAX - sizeof(RegDataRec)) / sizeof(BoxRec)) ?  sizeof(RegDataRec) + ((n) * sizeof(BoxRec)) : 0)
+ 
+ /* Keith recommends weaning the region code of pScreen argument */
+ #define REG_pScreen	screenInfo.screens[0]
+@@ -257,9 +260,10 @@ extern RegDataRec miBrokenData;
+     } \
+     else \
+     { \
++        size_t rgnSize; \
+         (_pReg)->extents = miEmptyBox; \
+-        if (((_size) > 1) && ((_pReg)->data = \
+-                             (RegDataPtr)xalloc(REGION_SZOF(_size)))) \
++        if (((_size) > 1) && ((rgnSize = REGION_SZOF(_size)) > 0) && \
++            ((_pReg)->data = (RegDataPtr)xalloc(rgnSize))) \
+         { \
+             (_pReg)->data->size = (_size); \
+             (_pReg)->data->numRects = 0; \
+diff --git a/nx-X11/programs/Xserver/mi/miregion.c b/nx-X11/programs/Xserver/mi/miregion.c
+index df33248..5ec4ec5 100644
+--- a/nx-X11/programs/Xserver/mi/miregion.c
++++ b/nx-X11/programs/Xserver/mi/miregion.c
+@@ -172,7 +172,6 @@ Equipment Corporation.
+         ((r1)->y1 <= (r2)->y1) && \
+         ((r1)->y2 >= (r2)->y2) )
+ 
+-#define xallocData(n) (RegDataPtr)xalloc(REGION_SZOF(n))
+ #define xfreeData(reg) if ((reg)->data && (reg)->data->size) xfree((reg)->data)
+ 
+ #define RECTALLOC_BAIL(pReg,n,bail) \
+@@ -209,8 +208,9 @@ if (!(pReg)->data || (((pReg)->data->numRects + (n)) > (pReg)->data->size)) \
+ #define DOWNSIZE(reg,numRects)						 \
+ if (((numRects) < ((reg)->data->size >> 1)) && ((reg)->data->size > 50)) \
+ {									 \
+-    RegDataPtr NewData;							 \
+-    NewData = (RegDataPtr)xrealloc((reg)->data, REGION_SZOF(numRects));	 \
++    size_t NewSize = REGION_SZOF(numRects);				 \
++    RegDataPtr NewData =						 \
++	(NewSize > 0) ? (RegDataPtr)xrealloc((reg)->data, NewSize) : NULL;	 \
+     if (NewData)							 \
+     {									 \
+ 	NewData->size = (numRects);					 \
+@@ -337,7 +337,7 @@ miRegionCreate(rect, size)
+     int size;
+ {
+     register RegionPtr pReg;
+-   
++    size_t newSize;
+     pReg = (RegionPtr)xalloc(sizeof(RegionRec));
+     if (!pReg)
+ 	return &miBrokenRegion;
+@@ -349,7 +349,9 @@ miRegionCreate(rect, size)
+     else
+     {
+ 	pReg->extents = miEmptyBox;
+-	if ((size > 1) && (pReg->data = xallocData(size)))
++	newSize = REGION_SZOF(size);
++	if ((size > 1) && (newSize > 0) &&
++	    (pReg->data = xalloc(newSize)))
+ 	{
+ 	    pReg->data->size = size;
+ 	    pReg->data->numRects = 0;
+@@ -371,6 +373,8 @@ miRegionInit(pReg, rect, size)
+     BoxPtr rect;
+     int size;
+ {
++    size_t newSize;
++
+     if (rect)
+     {
+ 	pReg->extents = *rect;
+@@ -379,7 +383,9 @@ miRegionInit(pReg, rect, size)
+     else
+     {
+ 	pReg->extents = miEmptyBox;
+-	if ((size > 1) && (pReg->data = xallocData(size)))
++	newSize = REGION_SZOF(size);
++	if ((size > 1) && (newSize > 0) &&
++	    (pReg->data = xalloc(newSize)))
+ 	{
+ 	    pReg->data->size = size;
+ 	    pReg->data->numRects = 0;
+@@ -423,11 +429,13 @@ miRectAlloc(
+     int n)
+ {
+     RegDataPtr	data;
++    size_t rgnSize;
+     
+     if (!pRgn->data)
+     {
+ 	n++;
+-	pRgn->data = xallocData(n);
++	rgnSize = REGION_SZOF(n);
++	pRgn->data = (rgnSize > 0) ? xalloc(rgnSize) : NULL;
+ 	if (!pRgn->data)
+ 	    return miRegionBreak (pRgn);
+ 	pRgn->data->numRects = 1;
+@@ -435,7 +443,8 @@ miRectAlloc(
+     }
+     else if (!pRgn->data->size)
+     {
+-	pRgn->data = xallocData(n);
++	rgnSize = REGION_SZOF(n);
++	pRgn->data = (rgnSize > 0) ? xalloc(rgnSize) : NULL;
+ 	if (!pRgn->data)
+ 	    return miRegionBreak (pRgn);
+ 	pRgn->data->numRects = 0;
+@@ -449,7 +458,8 @@ miRectAlloc(
+ 		n = 250;
+ 	}
+ 	n += pRgn->data->numRects;
+-	data = (RegDataPtr)xrealloc(pRgn->data, REGION_SZOF(n));
++	rgnSize = REGION_SZOF(n);
++	data = (rgnSize > 0) ? xrealloc(pRgn->data, rgnSize) : NULL;
+ 	if (!data)
+ 	    return miRegionBreak (pRgn);
+ 	pRgn->data = data;
+@@ -476,8 +486,10 @@ miRegionCopy(dst, src)
+     }
+     if (!dst->data || (dst->data->size < src->data->numRects))
+     {
++	size_t newSize = REGION_SZOF(src->data->numRects);
+ 	xfreeData(dst);
+-	dst->data = xallocData(src->data->numRects);
++
++	dst->data = newSize > 0 ? xalloc(newSize) : NULL;
+ 	if (!dst->data)
+ 	    return miRegionBreak (dst);
+ 	dst->data->size = src->data->numRects;
+@@ -1667,6 +1679,7 @@ miRectsToRegion(nrects, prect, ctype)
+     register BoxPtr	pBox;
+     register int        i;
+     int			x1, y1, x2, y2;
++    size_t newSize;
+ 
+     pRgn = miRegionCreate(NullBox, 0);
+     if (REGION_NAR (pRgn))
+@@ -1691,7 +1704,8 @@ miRectsToRegion(nrects, prect, ctype)
+ 	}
+ 	return pRgn;
+     }
+-    pData = xallocData(nrects);
++    newSize = REGION_SZOF(nrects);
++    pData = newSize > 0 ? xalloc(newSize) : NULL;
+     if (!pData)
+     {
+ 	miRegionBreak (pRgn);
+@@ -2206,8 +2220,9 @@ miRegionDataCopy(
+     }
+     if (!dst->data || (dst->data->size < src->data->numRects))
+     {
++	size_t newSize = REGION_SZOF(src->data->numRects);
+ 	xfreeData(dst);
+-	dst->data = xallocData(src->data->numRects);
++	dst->data = newSize > 0 ? xalloc(newSize) : NULL;
+ 	if (!dst->data)
+ 	    return miRegionBreak (dst);
+     }
+-- 
+2.1.4
+