Commit bfa00153 authored by Natanael Copa's avatar Natanael Copa
Browse files

main/libxcb: security fix (CVE-2013-2064)

ref #1931
fixes #1987

(cherry picked from commit 682ed1fa)

Conflicts:

	main/libxcb/APKBUILD
(cherry picked from commit 9688473a)

Conflicts:

	main/libxcb/APKBUILD
parent 7338a7f1
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=libxcb
pkgver=1.7
pkgrel=3
pkgrel=4
pkgdesc="X11 client-side library"
url="http://xcb.freedesktop.org/"
arch="all"
......@@ -10,20 +10,32 @@ depends=
subpackages="$pkgname-dev $pkgname-doc"
makedepends="xcb-proto libxdmcp-dev libxau-dev libxslt libpthread-stubs python"
source="http://xcb.freedesktop.org/dist/$pkgname-$pkgver.tar.bz2
CVE-2013-2064.patch
"
depends_dev="libpthread-stubs libxau-dev libxdmcp-dev"
_builddir="$srcdir"/$pkgname-$pkgver
prepare() {
cd "$_builddir"
for i in $source; do
case $i in
*.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
esac
done
}
build() {
cd "$srcdir"/$pkgname-$pkgver
cd "$_builddir"
./configure --prefix=/usr \
--enable-xinput || return 1
make || return 1
}
package() {
cd "$srcdir"/$pkgname-$pkgver
cd "$_builddir"
make DESTDIR="$pkgdir" install || return 1
rm "$pkgdir"/usr/lib/*.la || return 1
install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
}
md5sums="925699df361b99491165ebc12068056b libxcb-1.7.tar.bz2"
md5sums="925699df361b99491165ebc12068056b libxcb-1.7.tar.bz2
343285a0a015ef099e33fe8fb9615760 CVE-2013-2064.patch"
From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu, 02 May 2013 00:59:31 +0000
Subject: integer overflow in read_packet() [CVE-2013-2064]
Ensure that when calculating the size of the incoming response from the
Xserver, we don't overflow the integer used in the calculations when we
multiply the int32_t length by 4 and add it to the default response size.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
diff --git a/src/xcb_in.c b/src/xcb_in.c
index b810783..8a7af92 100644
--- a/src/xcb_in.c
+++ b/src/xcb_in.c
@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
static int read_packet(xcb_connection_t *c)
{
xcb_generic_reply_t genrep;
- int length = 32;
- int eventlength = 0; /* length after first 32 bytes for GenericEvents */
+ uint64_t length = 32;
+ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
+ uint64_t bufsize;
void *buf;
pending_reply *pend = 0;
struct event_list *event;
@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
eventlength = genrep.length * 4;
- buf = malloc(length + eventlength +
- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
+ bufsize = length + eventlength +
+ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
+ if (bufsize < INT32_MAX)
+ buf = malloc((size_t) bufsize);
+ else
+ buf = NULL;
if(!buf)
{
_xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
--
cgit v0.9.0.2-2-gbebe
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment