aboutsummaryrefslogtreecommitdiff
path: root/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch')
-rw-r--r--debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch110
1 files changed, 0 insertions, 110 deletions
diff --git a/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch b/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch
deleted file mode 100644
index e16e7a7be..000000000
--- a/debian/patches/1103-xkb-Don-t-swap-XkbSetGeometry-data-in-the-input.full.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-From 9308c79ba2757cb1a64e0040176b8290b435544f Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Fri, 16 Jan 2015 20:08:59 +0100
-Subject: [PATCH 3/4] xkb: Don't swap XkbSetGeometry data in the input buffer
-
-The XkbSetGeometry request embeds data which needs to be swapped when the
-server and the client have different endianess.
-
-_XkbSetGeometry() invokes functions that swap these data directly in the
-input buffer.
-
-However, ProcXkbSetGeometry() may call _XkbSetGeometry() more than once
-(if there is more than one keyboard), thus causing on swapped clients the
-same data to be swapped twice in memory, further causing a server crash
-because the strings lengths on the second time are way off bounds.
-
-To allow _XkbSetGeometry() to run reliably more than once with swapped
-clients, do not swap the data in the buffer, use variables instead.
-
-v3: backport to nx-libs 3.6.x as a prereq for
-the CVE-2015-0255 fix (Mike DePaulo)
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
-(cherry picked from commit 81c90dc8f0aae3b65730409b1b615b5fa7280ebd)
-(cherry picked from commit 29be310c303914090298ddda93a5bd5d00a94945)
-Signed-off-by: Julien Cristau <jcristau@debian.org>
-index 2405090..7db0959 100644
----
- nx-X11/programs/Xserver/xkb/xkb.c | 35 +++++++++++++++++++----------------
- 1 file changed, 19 insertions(+), 16 deletions(-)
-
---- a/nx-X11/programs/Xserver/xkb/xkb.c
-+++ b/nx-X11/programs/Xserver/xkb/xkb.c
-@@ -4441,15 +4441,14 @@ static char *
- _GetCountedString(char **wire_inout,Bool swap)
- {
- char * wire,*str;
--CARD16 len,*plen;
-+CARD16 len;
-
- wire= *wire_inout;
-- plen= (CARD16 *)wire;
-+ len= (CARD16 *)wire;
- if (swap) {
- register int n;
-- swaps(plen,n);
-+ swaps(&len, n);
- }
-- len= *plen;
- str= (char *)_XkbAlloc(len+1);
- if (str) {
- memcpy(str,&wire[2],len);
-@@ -4468,26 +4467,29 @@ _CheckSetDoodad( char ** wire_inout,
- {
- char * wire;
- xkbDoodadWireDesc * dWire;
-+xkbAnyDoodadWireDesc any;
-+xkbTextDoodadWireDesc text;
- XkbDoodadPtr doodad;
-
- dWire= (xkbDoodadWireDesc *)(*wire_inout);
-+ any = dWire->any;
- wire= (char *)&dWire[1];
- if (client->swapped) {
- register int n;
-- swapl(&dWire->any.name,n);
-- swaps(&dWire->any.top,n);
-- swaps(&dWire->any.left,n);
-- swaps(&dWire->any.angle,n);
-+ swapl(&any.name, n);
-+ swaps(&any.top, n);
-+ swaps(&any.left, n);
-+ swaps(&any.angle, n);
- }
- CHK_ATOM_ONLY(dWire->any.name);
-- doodad= XkbAddGeomDoodad(geom,section,dWire->any.name);
-+ doodad = XkbAddGeomDoodad(geom, section, any.name);
- if (!doodad)
- return BadAlloc;
- doodad->any.type= dWire->any.type;
- doodad->any.priority= dWire->any.priority;
-- doodad->any.top= dWire->any.top;
-- doodad->any.left= dWire->any.left;
-- doodad->any.angle= dWire->any.angle;
-+ doodad->any.top = any.top;
-+ doodad->any.left = any.left;
-+ doodad->any.angle = any.angle;
- switch (doodad->any.type) {
- case XkbOutlineDoodad:
- case XkbSolidDoodad:
-@@ -4510,13 +4512,14 @@ XkbDoodadPtr doodad;
- dWire->text.colorNdx);
- return BadMatch;
- }
-+ text = dWire->text;
- if (client->swapped) {
- register int n;
-- swaps(&dWire->text.width,n);
-- swaps(&dWire->text.height,n);
-+ swaps(&text.width, n);
-+ swaps(&text.height, n);
- }
-- doodad->text.width= dWire->text.width;
-- doodad->text.height= dWire->text.height;
-+ doodad->text.width= text.width;
-+ doodad->text.height= text.height;
- doodad->text.color_ndx= dWire->text.colorNdx;
- doodad->text.text= _GetCountedString(&wire,client->swapped);
- doodad->text.font= _GetCountedString(&wire,client->swapped);