aboutsummaryrefslogtreecommitdiff
path: root/debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
diff options
context:
space:
mode:
authorMihai Moldovan <ionic@ionic.de>2015-05-26 18:00:00 +0200
committerMihai Moldovan <ionic@ionic.de>2015-05-26 18:00:00 +0200
commitc19b58d09070aa54eb7458b0377bd4bd975e539d (patch)
tree8d9cb74eed536d203a9d6b37cdd020fe473b1e74 /debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
parent5a9f8294ce2f9c4265c5359323d7ad157974d016 (diff)
downloadnx-libs-c19b58d09070aa54eb7458b0377bd4bd975e539d.tar.gz
nx-libs-c19b58d09070aa54eb7458b0377bd4bd975e539d.tar.bz2
nx-libs-c19b58d09070aa54eb7458b0377bd4bd975e539d.zip
Security fixes: X.Org CVE-2014-8100:
v3: port to NXrender.c rather than render.c (Mike DePaulo) v4: backport v3 to nx-libs 3.5.0.x (Mihai Moldovan) Changes: - 1027-render-check-request-size-before-reading-it-CVE.full.patch
Diffstat (limited to 'debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch')
-rw-r--r--debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch24
1 files changed, 18 insertions, 6 deletions
diff --git a/debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch b/debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
index 9540ddeda..7e8fe352f 100644
--- a/debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
+++ b/debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
@@ -7,6 +7,8 @@ Subject: [PATCH 27/40] render: check request size before reading it
Otherwise we may be reading outside of the client request.
v2: backport to nx-libs 3.6.x (Mike DePaulo)
+v3: port to NXrender.c rather than render.c (Mike DePaulo)
+v4: backport v3 to nx-libs 3.5.0.x (Mihai Moldovan)
Signed-off-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
@@ -18,11 +20,24 @@ Conflicts:
nx-X11/programs/Xserver/render/render.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/nx-X11/programs/Xserver/render/render.c b/nx-X11/programs/Xserver/render/render.c
-index d25d497..ebbce81 100644
--- a/nx-X11/programs/Xserver/render/render.c
+++ b/nx-X11/programs/Xserver/render/render.c
-@@ -283,10 +283,11 @@ ProcRenderQueryVersion (ClientPtr client)
+@@ -283,10 +283,11 @@ ProcRenderQueryVersion (ClientPtr client
+ register int n;
+ REQUEST(xRenderQueryVersionReq);
+
++ REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
++
+ pRenderClient->major_version = stuff->majorVersion;
+ pRenderClient->minor_version = stuff->minorVersion;
+
+- REQUEST_SIZE_MATCH(xRenderQueryVersionReq);
+ rep.type = X_Reply;
+ rep.length = 0;
+ rep.sequenceNumber = client->sequence;
+--- a/nx-X11/programs/Xserver/hw/nxagent/NXrender.c
++++ b/nx-X11/programs/Xserver/hw/nxagent/NXrender.c
+@@ -326,10 +326,11 @@ ProcRenderQueryVersion (ClientPtr client
register int n;
REQUEST(xRenderQueryVersionReq);
@@ -35,6 +50,3 @@ index d25d497..ebbce81 100644
rep.type = X_Reply;
rep.length = 0;
rep.sequenceNumber = client->sequence;
---
-2.1.4
-