| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ProcPutImage() calculates a length field from a width, left pad and depth
specified by the client (if the specified format is XYPixmap).
The calculations for the total amount of memory the server needs for the
pixmap can overflow a 32-bit number, causing out-of-bounds memory writes
on 32-bit systems (since the length is stored in a long int variable).
v2: backport to nx-libs 3.6.x (Mike DePaulo)
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Conflicts:
dix/dispatch.c
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
authdes_ezdecode() calls malloc() using a length provided by the
connection handshake sent by a newly connected client in order
to authenticate to the server, so should be treated as untrusted.
It didn't check if malloc() failed before writing to the newly
allocated buffer, so could lead to a server crash if the server
fails to allocate memory (up to UINT16_MAX bytes, since the len
field is a CARD16 in the X protocol).
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Conflicts:
os/rpcauth.c
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit d338f81df1e188eb16e1d6aeea7f4800f89c1218
fs_read_list_info() parses a reply from the font server. The reply
contains a number of additional data items with embedded length or
count fields, none of which are validated. This can cause out of
bound reads when looping over these items in the reply.
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 5fa73ac18474be3032ee7af9c6e29deab163ea39
fs_read_list() parses a reply from the font server. The reply
contains a list of strings with embedded length fields, none of
which are validated. This can cause out of bound reads when looping
over the strings in the reply.
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 520683652564c2a4e42328ae23eef9bb63271565
fs_read_glyphs() parses a reply from the font server. The reply
contains embedded length fields, none of which are validated.
This can cause out of bound reads when looping over the glyph
bitmaps in the reply.
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit a3f21421537620fc4e1f844a594a4bcd9f7e2bd8
Looping over the extents in the reply could go past the end of the
reply buffer if the reply indicated more extents than could fit in
the specified reply length.
|
|
|
|
|
|
|
|
| |
commit a42f707f8a62973f5e8bbcd08afb10a79e9cee33
fs_alloc_glyphs() is a malloc wrapper used by the font code.
It contains a classic integer overflow in the malloc() call,
which can cause memory corruption.
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit c578408c1fd4db09e4e3173f8a9e65c81cc187c1
fs_read_extent_info() parses a reply from the font server.
The reply contains a 32bit number of elements field which is used
to calculate a buffer length. There is an integer overflow in this
calculation which can lead to memory corruption.
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f
fs_read_query_info() parses a reply from the font server. The reply
contains embedded length fields, none of which are validated. This
can cause out of bound reads in either fs_read_query_info() or in
_fs_convert_props() which it calls to parse the fsPropInfo in the reply.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 0f1a5d372c143f91a602bdf10c917d7eabaee09b
fs_get_reply() would take any reply size, multiply it by 4 and pass to
_fs_start_read. If that size was bigger than the current reply buffer
size, _fs_start_read would add it to the existing buffer size plus the
buffer size increment constant and realloc the buffer to that result.
This math could overflow, causing the code to allocate a smaller
buffer than the amount it was about to read into that buffer from
the network. It could also succeed, allowing the remote font server
to cause massive allocations in the X server, possibly using up all
the address space in a 32-bit X server, allowing the triggering of
other bugs in code that fails to handle malloc failure properly.
This patch protects against both problems, by disconnecting any
font server trying to feed us more than (the somewhat arbitrary)
64 mb in a single reply.
|
|
|
|
|
|
|
|
| |
from xorg/lib/libXfont commit cbb64aef35960b2882be721f4b8fbaa0fb649d12
Functions to handle replies to font server requests were casting replies
from the generic form to reply specific structs without first checking
that the reply was at least as long as the struct being cast to.
|
|
|
|
| |
Jover). from xorg/lib/libXfont commit bfb8a71f4f7e5c5ed4278cb3ee271bf9990d276d
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d
The connection setup reply from the font server can include a list
of alternate servers to contact if this font server stops working.
The reply specifies a total size of all the font server names, and
then provides a list of names. _fs_recv_conn_setup() allocated the
specified total size for copying the names to, but didn't check to
make sure it wasn't copying more data to that buffer than the size
it had allocated.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 05c8020a49416dd8b7510cbba45ce4f3fc81a7dc
lexAlias() reads from a file in a loop. It does this by starting with a
64 byte buffer. If that size limit is hit, it does a realloc of the
buffer size << 1, basically doubling the needed length every time the
length limit is hit.
Eventually, this will shift out to 0 (for a length of ~4gig), and that
length will be passed on to realloc(). A length of 0 (with a valid
pointer) causes realloc to free the buffer on most POSIX platforms,
but the caller will still have a pointer to it, leading to use after
free issues.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
xorg/lib/libXfont commit 2f5e57317339c526e6eaee1010b0e2ab8089c42e
FontFileReadDirectory() opens a fonts.dir file, and reads over every
line in an fscanf loop. For each successful entry read (font name,
file name) a call is made to FontFileAddFontFile().
FontFileAddFontFile() will add a font file entry (for the font name
and file) each time it’s called, by calling FontFileAddEntry().
FontFileAddEntry() will do the actual adding. If the table it has
to add to is full, it will do a realloc, adding 100 more entries
to the table size without checking to see if that will overflow the
int used to store the size.
|
|
|
|
|
|
|
|
| |
bdfReadCharacters() from xorg/lib/libXfont http://lists.x.org/archives/xorg-announce/2014-January/002389.html
Fixes cppcheck warning:
[lib/libXfont/src/bitmap/bdfread.c:341]: (warning)
scanf without field width limits can crash with huge input data.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
xorg/Xserver http://lists.x.org/archives/xorg-announce/2013-October/002332.html
Save a pointer to the passed in closure structure before copying it
and overwriting the *c pointer to point to our copy instead of the
original. If we hit an error, once we free(c), reset c to point to
the original structure before jumping to the cleanup code that
references *c.
Since one of the errors being checked for is whether the server was
able to malloc(c->nChars * itemSize), the client can potentially pass
a number of characters chosen to cause the malloc to fail and the
error path to be taken, resulting in the read from freed memory.
Since the memory is accessed almost immediately afterwards, and the
X server is mostly single threaded, the odds of the free memory having
invalid contents are low with most malloc implementations when not using
memory debugging features, but some allocators will definitely overwrite
the memory there, leading to a likely crash.
|
|
|
|
|
|
|
|
| |
commit 6ba44b91e37622ef8c146d8f2ac92d708a18ed34
use O_NOFOLLOW to open the existing lock file, so symbolic links
aren't followed, thus avoid revealing if it point to an existing
file.
|
|
|
|
|
|
|
|
| |
d11ee5886e9d9ec610051a206b135a4cdc1e09a0
Specially crafted LZW stream can crash an application using libXfont
that is used to open untrusted font files. With X server, this may
allow privilege escalation when exploited
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
nx*/VERSION and hw/nxagent/VERSION.
This commit removes the debian/VERSION file at makes it now unnecessary to
copy/symlink the VERSION file at build time. These build scripts got adapted:
debian/roll-tarballs.sh
debian/rules
nx-libs.spec
Furthermore, all NX component now use the main VERSION file as reference.
typechange: nxcomp/VERSION
typechange: nxcompext/VERSION
typechange: nxcompshad/VERSION
typechange: nxproxy/VERSION
|
|
|
|
|
|
|
|
|
|
| |
(999_nxagent_unbrand-nxagent-brand-x2goagent.full.patch).
When launched with NX Agent flavour, the startup screen gets unbranded by
this patch (the !M logo does not get shown).
When launched with X2Go Agent flavour, the startup screen gets branded
with the X2GO logo.
|
|
|
|
|
|
| |
Former patch file names:
991_fix-hr-typos.full+lite.patch
991_fix-hr-typos.full.patch
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(990_fix-DEBUG-and-TEST-builds.full.patch).
(1) In nx-X11/programs/Xserver/dix:
Fix several compile errors when specifying -DDEBUG globally. Previous GCC
versions were more liberal and the code thus compiled.
Also initialize/reset a count variable correctly.
(2) In nx-X11/programs/Xserver/hw/nxagent/Render.c:
Check for pSrc->pDrawable to exist instead of having nxagent segfault when
it does not.
This enables the possibility of compiling all nxagent modules in TEST mode.
|
|
|
|
| |
(606_nx-X11_build-on-aarch64.full.patch).
|
|
|
|
| |
(603_nx-X11_compilation_warnings.full.patch).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
relinquishing privileges (602_nx-X11_initgroups.full.patch).
The Fedora review of NX (redistributed) caught the following rpmlint issue:
This executable is calling setuid and setgid without setgroups or initgroups.
There is a high probability this mean it didn't relinquish all groups, and this
would be a potential security issue to be fixed. Seek POS36-C on the web for
details about the problem.
Ref POS36-C:
https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges
This patch adds initgroups() calls to the code to initialize the supplemental group list.
|
|
|
|
|
|
|
|
|
|
|
|
| |
(601_nx-X11_build-option-changes-to-not-use-bundled-libraries.full.patch).
This commit has been submitted by Orion in two
portions. One was submitted to X2Go BTS and created
on Wed, 10 Jul 2013.
The other portion has been taken from the Fedora
package by Mike Gabriel and worked into this
patch on Fri, 06 Dec 2013.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(600_nx-X11+nxcompext+nxcompshad_unique-libnames.full.patch).
We really want to make use of rpm's automatic dependency finding.
Binaries are scanned for DT_NEEDED entries, the latter of which are
then used for populating the "Requires"-type deps. The "nxagent"
binary for example would require libX11.so.6. That incurs problems:
1. A package manager told to install nxagent could select xorg-x11
rather than nx-libs, even though nxagent depends on the NX version.
2. A package manager told to install $some_program could select nx-libs
rather than xorg-x11 (since both provide libX11.so.6), but, since
the NX library is in an obscure directory, running $some_program
would fail as libX11.so.6 is not found.
To solve this, give the NX libraries unique names different from the
Xorg ones.
|
|
|
|
| |
(321_nxagent_x2go-specific-keystroke-config.full.patch).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(320_nxagent_configurable-keystrokes.full.patch).
Replaces the hardcoded nxagent keybindings by a configurable
table of keybindings. The default configuration is the same as the
original one, to maintain compatibility. A user/administrator can either
specify a command line parameter, environment variable or place a file
in ~/.nx/config/keystrokes.cfg or /etc/nxagent/keystrokes.cfg to reconfigure
these keybindings.
The configuration file format is XML, a dependency on libxml2 is added
to allow parsing the configuration.
|
|
|
|
|
|
|
|
| |
(302_nx-X11_xkbbasedir-detection.full.patch).
In recent (as of 2014/06) X.org release, the keymap.dir file
has become obsolete. Let's test for the xkb/rules/base file
instead.
|
|
|
|
|
|
|
|
|
|
|
|
| |
Many distributions have a policy to reduce code duplications.
One means to avoid such duplications is to use shared libraries
instead of using libs that are ofter shipped for convenience.
Fedora:
http://fedoraproject.org/wiki/Packaging:Guidelines#Shared_Libraries
Debian (Section 10.7.4 of Debian policy):
http://www.debian.org/doc/debian-policy/ch-files.html
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Depending on the binary name of the agent either NXAgent
or X2GoAgent is set as WM_Class.
This is needed for some window managers (like the one shipped with
Maemo)
The original WM_CLASS patch has been taken from the FreeNX patch
series, author unknown.
The nxagent/x2goagent has been done by the X2Go Project, author
see below.
|
|
|
|
|
|
|
|
|
| |
210_nxagent_save_session_state.full.patch
210_nxcomp_save_session_state.full+lite.patch
This patch adds a "state" option to NX (agent) which
allows one to specify a file where nxagent will write
its session state into.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
(207_nxagent_fix-xfixes-selection.full.patch).
When nxagent has the XFIXES extension enabled copy and
paste from outside applications to applications within the session
that rely on XFixesSelectSelectionInput (e.g. qt applications like
konsole) did never receive any notifications because the nxagent did
not register itself at the real X server to receive them. Fixes X2Go Bug
#585 (http://bugs.x2go.org/585).
|
|
|
|
| |
(206_nxagent_clipboard-as-nxoption.full.patch).
|
|
|
|
| |
(205_nxagent_refresh-adsl.full.patch).
|
|
|
|
| |
(204_nxagent_repaint-solidpict.full.patch).
|
|
|
|
|
|
|
|
|
|
| |
(203_nxagent_disable-rootless-exit.full.patch).
This change enables to launch an nxagent in rootless mode
that waits forever for Xclients to appear.
This feature got added when X2Go introduced Published Applications
support.
|
|
|
|
|
|
|
|
| |
This patch adds Xinerama awareness to NX agent windows.
The advantage of Xinerama awareness is that an NX session window
will only maximize to the dimensions of the active physical
display.
|
|
|
|
|
|
|
| |
(201_nxagent_set-x2go-icon-if-x2goagent-flavour.full.patch).
Depending on the binary name of the agent either nxagent.xpm
or x2go.xpm is used as window icon.
|
|
|
|
|
|
|
|
|
|
| |
(200_nxagent_check-binary-x2go-flavour.full.patch).
Whether the agent runs in X2Go or NX mode is decide by the
name of the binary that executes the code.
Binary name equal to nxagent -> (Free)NX flavour
Binary name equal to x2goagent -> X2Go flavour
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It is allowed to try and allocate a pixmap which is larger than
32767 in either dimension. However, all of the framebuffer code
is buggy and does not reliably draw to such big pixmaps, basically
because the Region data structure operates with signed shorts
for the rectangles in it.
Furthermore, several places in the X server computes the
size in bytes of the pixmap and tries to store it in an
integer. This integer can overflow and cause the allocated size
to be much smaller.
So, such big pixmaps are rejected here with a BadAlloc
Originally contributed by FreeNX Team
|
|
|
|
|
|
| |
Wine close delay.
Originally contributed by FreeNX team (dimbor).
|
|
|
|
|
|
|
|
| |
(107_nxagent_clipboard-compound-text+small-bed-sheets.full.patch).
Do not send COMPOUND_TEXT to client.
Originally contributed by FreeNX Team (dimbor).
|
|
|
|
|
|
| |
Enable UTF-8 clipboard copies.
Originally contributed by FreeNX Team (dimbor).
|
|
|
|
|
|
|
| |
(105_nxagent_export-remote-keyboard-config.full.patch)
Let nxagent write the keyboard configuration to <session_directory>/keyboard
and make it available within the NX session.
|
|
|
|
|
|
|
|
|
| |
(103_nxagent_set-X0-config-path.full.patch).
This patch is needed for Tarball installation and on Distros like
Debian, not reporting this path addition to upstream.
Originally contributed by FreeNX Team.
|
|
|
|
|
|
|
| |
(102_xserver-xext_set-securitypolicy-path.full.patch).
This patch is needed for Tarball installation mode of NX (redistributed)
only, not reporting this path change to upstream.
|