1 files changed, 61 insertions, 0 deletions
diff --git a/debian/patches/1016-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch b/debian/patches/1016-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch
new file mode 100644
index 000000000..b5bc8c582
--- /dev/null
+++ b/debian/patches/1016-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch
@@ -0,0 +1,61 @@
+From ef439da38d3a4c00a4e03e7d8f83cb359cd9a230 Mon Sep 17 00:00:00 2001
+From: Mike DePaulo <mikedep333@gmail.com>
+Date: Sun, 8 Feb 2015 22:35:21 -0500
+Subject: [PATCH 16/40] CVE-2014-0210: unvalidated length fields in
+ fs_read_list() from xorg/lib/libXfont commit
+ 5fa73ac18474be3032ee7af9c6e29deab163ea39
+
+fs_read_list() parses a reply from the font server.  The reply
+contains a list of strings with embedded length fields, none of
+which are validated. This can cause out of bound reads when looping
+over the strings in the reply.
+---
+ nx-X11/lib/font/fc/fserve.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c
+index 26218e5..60d9017 100644
+--- a/nx-X11/lib/font/fc/fserve.c
++++ b/nx-X11/lib/font/fc/fserve.c
+@@ -2365,6 +2365,7 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+     FSBlockedListPtr	blist = (FSBlockedListPtr) blockrec->data;
+     fsListFontsReply	*rep;
+     char		*data;
++    long		dataleft; /* length of reply left to use */
+     int			length,
+ 			i,
+ 			ret;
+@@ -2382,16 +2383,30 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec)
+ 	return AllocError;
+     }
+     data = (char *) rep + SIZEOF (fsListFontsReply);
++    dataleft = (rep->length << 2) - SIZEOF (fsListFontsReply);
+ 
+     err = Successful;
+     /* copy data into FontPathRecord */
+     for (i = 0; i < rep->nFonts; i++) 
+     {
++	if (dataleft < 1)
++	    break;
+ 	length = *(unsigned char *)data++;
++	dataleft--; /* used length byte */
++	if (length > dataleft) {
++#ifdef DEBUG
++	    fprintf(stderr,
++		    "fsListFonts: name length (%d) > dataleft (%ld)\n",
++		    length, dataleft);
++#endif
++	    err = BadFontName;
++	    break;
++	}
+ 	err = AddFontNamesName(blist->names, data, length);
+ 	if (err != Successful)
+ 	    break;
+ 	data += length;
++	dataleft -= length;
+     }
+     _fs_done_read (conn, rep->length << 2);
+     return err;
+-- 
+2.1.4
+