From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 8/8] gnu: libxvmc: Fix CVE-2016-7953. Date: Wed, 5 Oct 2016 13:56:01 -0400 Message-ID: <47fc9418d8af2e0455a9df8e48d0da7adea85adc.1475690088.git.leo@famulari.name> References: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:51912) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1brqQw-0004UR-57 for guix-devel@gnu.org; Wed, 05 Oct 2016 13:56:49 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1brqQt-0000zS-Km for guix-devel@gnu.org; Wed, 05 Oct 2016 13:56:45 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:39427) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1brqQs-0000wI-B1 for guix-devel@gnu.org; Wed, 05 Oct 2016 13:56:43 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id EC49DF2D2A for ; Wed, 5 Oct 2016 13:56:25 -0400 (EDT) In-Reply-To: In-Reply-To: References: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org * gnu/packages/patches/libxvmc-CVE-2016-7953.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/xorg.scm (libxvmc)[replacement]: New field. (libxvmc/fixed): New variable. --- gnu/local.mk | 1 + gnu/packages/patches/libxvmc-CVE-2016-7953.patch | 42 ++++++++++++++++++++++++ gnu/packages/xorg.scm | 8 +++++ 3 files changed, 51 insertions(+) create mode 100644 gnu/packages/patches/libxvmc-CVE-2016-7953.patch diff --git a/gnu/local.mk b/gnu/local.mk index 92b5e66..867946d 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -678,6 +678,7 @@ dist_patch_DATA = \ %D%/packages/patches/libxrender-CVE-2016-7950.patch \ %D%/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch \ %D%/packages/patches/libxv-CVE-2016-5407.patch \ + %D%/packages/patches/libxvmc-CVE-2016-7953.patch \ %D%/packages/patches/libxslt-generated-ids.patch \ %D%/packages/patches/lirc-localstatedir.patch \ %D%/packages/patches/llvm-for-extempore.patch \ diff --git a/gnu/packages/patches/libxvmc-CVE-2016-7953.patch b/gnu/packages/patches/libxvmc-CVE-2016-7953.patch new file mode 100644 index 0000000..737abde --- /dev/null +++ b/gnu/packages/patches/libxvmc-CVE-2016-7953.patch @@ -0,0 +1,42 @@ +Fix CVE-2016-7953: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7953 + +Patch copied from upstream source repository: + +https://cgit.freedesktop.org/xorg/lib/libXvMC/commit/?id=2cd95e7da8367cccdcdd5c9b160012d1dec5cbdb + +From 2cd95e7da8367cccdcdd5c9b160012d1dec5cbdb Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann +Date: Sun, 25 Sep 2016 22:34:27 +0200 +Subject: [PATCH] Avoid buffer underflow on empty strings. + +If an empty string is received from an x-server, do not underrun the +buffer by accessing "rep.nameLen - 1" unconditionally, which could end +up being -1. + +Signed-off-by: Tobias Stoeckmann +Reviewed-by: Matthieu Herrb +--- + src/XvMC.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/XvMC.c b/src/XvMC.c +index 7336760..3ee4212 100644 +--- a/src/XvMC.c ++++ b/src/XvMC.c +@@ -576,9 +576,9 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, + if (*name && *busID && tmpBuf) { + _XRead(dpy, tmpBuf, realSize); + strncpy(*name,tmpBuf,rep.nameLen); +- (*name)[rep.nameLen - 1] = '\0'; ++ (*name)[rep.nameLen == 0 ? 0 : rep.nameLen - 1] = '\0'; + strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); +- (*busID)[rep.busIDLen - 1] = '\0'; ++ (*busID)[rep.busIDLen == 0 ? 0 : rep.busIDLen - 1] = '\0'; + XFree(tmpBuf); + } else { + XFree(*name); +-- +2.10.1 + diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm index 448ac65..aa2b99a 100644 --- a/gnu/packages/xorg.scm +++ b/gnu/packages/xorg.scm @@ -4998,6 +4998,7 @@ new API's in libXft, or the legacy API's in libX11.") (define-public libxvmc (package (name "libxvmc") + (replacement libxvmc/fixed) (version "1.0.9") (source (origin @@ -5023,6 +5024,13 @@ new API's in libXft, or the legacy API's in libX11.") (description "Xorg XvMC library.") (license license:x11))) +(define libxvmc/fixed + (package + (inherit libxvmc) + (source (origin + (inherit (package-source libxvmc)) + (patches (search-patches + "libxvmc-CVE-2016-7953.patch")))))) (define-public libxxf86vm (package -- 2.10.1