From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: [PATCH 2/8] gnu: libxfixes: Fix CVE-2016-7944. Date: Wed, 5 Oct 2016 13:55:55 -0400 Message-ID: <801fb6cbdac29f4cf585a4acda7697ee317d24e6.1475690088.git.leo@famulari.name> References: Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:51868) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1brqQs-0004T6-1u for guix-devel@gnu.org; Wed, 05 Oct 2016 13:56:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1brqQn-0000wN-I0 for guix-devel@gnu.org; Wed, 05 Oct 2016 13:56:40 -0400 Received: from out1-smtp.messagingengine.com ([66.111.4.25]:37858) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1brqQl-0000tR-4q for guix-devel@gnu.org; Wed, 05 Oct 2016 13:56:37 -0400 Received: from localhost.localdomain (c-73-188-17-148.hsd1.pa.comcast.net [73.188.17.148]) by mail.messagingengine.com (Postfix) with ESMTPA id 03117F2C78 for ; Wed, 5 Oct 2016 13:56:24 -0400 (EDT) In-Reply-To: In-Reply-To: References: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org * gnu/packages/patches/libxfixes-CVE-2016-7944.patch: New file. * gnu/local.mk (dist_patch_DATA): Add it. * gnu/packages/xorg.scm (libxfixes)[replacement]: New field. (libxfixes/fixed): New variable. --- gnu/local.mk | 1 + gnu/packages/patches/libxfixes-CVE-2016-7944.patch | 62 ++++++++++++++++++++++ gnu/packages/xorg.scm | 8 +++ 3 files changed, 71 insertions(+) create mode 100644 gnu/packages/patches/libxfixes-CVE-2016-7944.patch diff --git a/gnu/local.mk b/gnu/local.mk index 03d07f6..9e875de 100644 --- a/gnu/local.mk +++ b/gnu/local.mk @@ -671,6 +671,7 @@ dist_patch_DATA = \ %D%/packages/patches/libwmf-CVE-2015-4696.patch \ %D%/packages/patches/libx11-CVE-2016-7942.patch \ %D%/packages/patches/libx11-CVE-2016-7943.patch \ + %D%/packages/patches/libxfixes-CVE-2016-7944.patch \ %D%/packages/patches/libxslt-generated-ids.patch \ %D%/packages/patches/lirc-localstatedir.patch \ %D%/packages/patches/llvm-for-extempore.patch \ diff --git a/gnu/packages/patches/libxfixes-CVE-2016-7944.patch b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch new file mode 100644 index 0000000..2ce463f --- /dev/null +++ b/gnu/packages/patches/libxfixes-CVE-2016-7944.patch @@ -0,0 +1,62 @@ +Fix CVE-2016-7944: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7944 + +Patch copied from upstream source repository: + +https://cgit.freedesktop.org/xorg/lib/libXfixes/commit/?id=61c1039ee23a2d1de712843bed3480654d7ef42e + +From 61c1039ee23a2d1de712843bed3480654d7ef42e Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann +Date: Sun, 25 Sep 2016 22:38:44 +0200 +Subject: [PATCH] Integer overflow on illegal server response + +The 32 bit field "rep.length" is not checked for validity, which allows +an integer overflow on 32 bit systems. + +A malicious server could send INT_MAX as length, which gets multiplied +by the size of XRectangle. In that case the client won't read the whole +data from server, getting out of sync. + +Signed-off-by: Tobias Stoeckmann +Reviewed-by: Matthieu Herrb +--- + src/Region.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/Region.c b/src/Region.c +index cb0cf6e..59bcc1a 100644 +--- a/src/Region.c ++++ b/src/Region.c +@@ -23,6 +23,7 @@ + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include "Xfixesint.h" + + XserverRegion +@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display *dpy, + bounds->y = rep.y; + bounds->width = rep.width; + bounds->height = rep.height; +- nbytes = (long) rep.length << 2; +- nrects = rep.length >> 1; +- rects = Xmalloc (nrects * sizeof (XRectangle)); ++ ++ if (rep.length < (INT_MAX >> 2)) { ++ nbytes = (long) rep.length << 2; ++ nrects = rep.length >> 1; ++ rects = Xmalloc (nrects * sizeof (XRectangle)); ++ } else { ++ nbytes = 0; ++ nrects = 0; ++ rects = NULL; ++ } ++ + if (!rects) + { + _XEatDataWords(dpy, rep.length); +-- +2.10.1 + diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm index 83dfd5d..5bd3aee 100644 --- a/gnu/packages/xorg.scm +++ b/gnu/packages/xorg.scm @@ -4823,6 +4823,7 @@ an X Window System display.") (define-public libxfixes (package (name "libxfixes") + (replacement libxfixes/fixed) (version "5.0.1") (source (origin @@ -4847,6 +4848,13 @@ an X Window System display.") (description "Library for the XFixes Extension to the X11 protocol.") (license license:x11))) +(define libxfixes/fixed + (package + (inherit libxfixes) + (source (origin + (inherit (package-source libxfixes)) + (patches (search-patches + "libxfixes-CVE-2016-7944.patch")))))) (define-public libxfont (package -- 2.10.1