diff options
Diffstat (limited to 'debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch')
-rw-r--r-- | debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch | 110 |
1 files changed, 0 insertions, 110 deletions
diff --git a/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch b/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch deleted file mode 100644 index e16e7a7be..000000000 --- a/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 9308c79ba2757cb1a64e0040176b8290b435544f Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan <ofourdan@redhat.com> -Date: Fri, 16 Jan 2015 20:08:59 +0100 -Subject: [PATCH 3/4] xkb: Don't swap XkbSetGeometry data in the input buffer - -The XkbSetGeometry request embeds data which needs to be swapped when the -server and the client have different endianess. - -_XkbSetGeometry() invokes functions that swap these data directly in the -input buffer. - -However, ProcXkbSetGeometry() may call _XkbSetGeometry() more than once -(if there is more than one keyboard), thus causing on swapped clients the -same data to be swapped twice in memory, further causing a server crash -because the strings lengths on the second time are way off bounds. - -To allow _XkbSetGeometry() to run reliably more than once with swapped -clients, do not swap the data in the buffer, use variables instead. - -v3: backport to nx-libs 3.6.x as a prereq for -the CVE-2015-0255 fix (Mike DePaulo) - -Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> -Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> -(cherry picked from commit 81c90dc8f0aae3b65730409b1b615b5fa7280ebd) -(cherry picked from commit 29be310c303914090298ddda93a5bd5d00a94945) -Signed-off-by: Julien Cristau <jcristau@debian.org> -index 2405090..7db0959 100644 ---- - nx-X11/programs/Xserver/xkb/xkb.c | 35 +++++++++++++++++++---------------- - 1 file changed, 19 insertions(+), 16 deletions(-) - ---- a/nx-X11/programs/Xserver/xkb/xkb.c -+++ b/nx-X11/programs/Xserver/xkb/xkb.c -@@ -4441,15 +4441,14 @@ static char * - _GetCountedString(char **wire_inout,Bool swap) - { - char * wire,*str; --CARD16 len,*plen; -+CARD16 len; - - wire= *wire_inout; -- plen= (CARD16 *)wire; -+ len= (CARD16 *)wire; - if (swap) { - register int n; -- swaps(plen,n); -+ swaps(&len, n); - } -- len= *plen; - str= (char *)_XkbAlloc(len+1); - if (str) { - memcpy(str,&wire[2],len); -@@ -4468,26 +4467,29 @@ _CheckSetDoodad( char ** wire_inout, - { - char * wire; - xkbDoodadWireDesc * dWire; -+xkbAnyDoodadWireDesc any; -+xkbTextDoodadWireDesc text; - XkbDoodadPtr doodad; - - dWire= (xkbDoodadWireDesc *)(*wire_inout); -+ any = dWire->any; - wire= (char *)&dWire[1]; - if (client->swapped) { - register int n; -- swapl(&dWire->any.name,n); -- swaps(&dWire->any.top,n); -- swaps(&dWire->any.left,n); -- swaps(&dWire->any.angle,n); -+ swapl(&any.name, n); -+ swaps(&any.top, n); -+ swaps(&any.left, n); -+ swaps(&any.angle, n); - } - CHK_ATOM_ONLY(dWire->any.name); -- doodad= XkbAddGeomDoodad(geom,section,dWire->any.name); -+ doodad = XkbAddGeomDoodad(geom, section, any.name); - if (!doodad) - return BadAlloc; - doodad->any.type= dWire->any.type; - doodad->any.priority= dWire->any.priority; -- doodad->any.top= dWire->any.top; -- doodad->any.left= dWire->any.left; -- doodad->any.angle= dWire->any.angle; -+ doodad->any.top = any.top; -+ doodad->any.left = any.left; -+ doodad->any.angle = any.angle; - switch (doodad->any.type) { - case XkbOutlineDoodad: - case XkbSolidDoodad: -@@ -4510,13 +4512,14 @@ XkbDoodadPtr doodad; - dWire->text.colorNdx); - return BadMatch; - } -+ text = dWire->text; - if (client->swapped) { - register int n; -- swaps(&dWire->text.width,n); -- swaps(&dWire->text.height,n); -+ swaps(&text.width, n); -+ swaps(&text.height, n); - } -- doodad->text.width= dWire->text.width; -- doodad->text.height= dWire->text.height; -+ doodad->text.width= text.width; -+ doodad->text.height= text.height; - doodad->text.color_ndx= dWire->text.colorNdx; - doodad->text.text= _GetCountedString(&wire,client->swapped); - doodad->text.font= _GetCountedString(&wire,client->swapped); |