main/libxcb: security fix (CVE-2013-2064)

ref #1931

2 files changed, 63 insertions, 3 deletions

diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD
index 2643c73de1..3ef9e93890 100644
--- a/main/libxcb/APKBUILD
+++ b/main/libxcb/APKBUILD
@@ -11,10 +11,21 @@ subpackages="$pkgname-dev $pkgname-doc"
 depends_dev="libpthread-stubs libxau-dev libxdmcp-dev xcb-proto"
 makedepends="$depends_dev libxslt python"
 source="http://xcb.freedesktop.org/dist/$pkgname-$pkgver.tar.bz2
+	CVE-2013-2064.patch
 	"
 
+_builddir="$srcdir"/$pkgname-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in $source; do
+		case $i in
+		*.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
+		esac
+	done
+}
+
 build() {
-	cd "$srcdir"/$pkgname-$pkgver
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		--enable-xkb \
 		--enable-xinput \
@@ -24,9 +35,14 @@ build() {
 }
 
 package() {
-	cd "$srcdir"/$pkgname-$pkgver
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install || return 1
 	rm "$pkgdir"/usr/lib/*.la || return 1
 	install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
 }
-md5sums="2b05856e9d1cb37836aae7406f2f4ce2  libxcb-1.9.tar.bz2"
+md5sums="2b05856e9d1cb37836aae7406f2f4ce2  libxcb-1.9.tar.bz2
+343285a0a015ef099e33fe8fb9615760  CVE-2013-2064.patch"
+sha256sums="8857e62b3aae2976c7e10043643e45a85964fd1dcb4469dfde0d04d3d1b12c96  libxcb-1.9.tar.bz2
+83ca3f8b02799468822a5e2fbe559a43cb57c03f450ccd58f59ce7a054b859c3  CVE-2013-2064.patch"
+sha512sums="799f68b21df296e1e03cb5b5bfa065764c08652a4fd47e4b3ebc9d217f2f9fefabbae28b8ffacadab57917189616e09821e6ef6dcd1ffc24f5d82541997fdfb0  libxcb-1.9.tar.bz2
+31d5a1486d57970bdf0b0ffd8345c416e6a7a0e1cc2f93ab63fa0aea3d31b2d061bb8cf5f778aa88c59863d5e551d0a9558c2b05b9e5abcf3818e839c5f9421f  CVE-2013-2064.patch"
diff --git a/main/libxcb/CVE-2013-2064.patch b/main/libxcb/CVE-2013-2064.patch
new file mode 100644
index 0000000000..32fc268156
--- /dev/null
+++ b/main/libxcb/CVE-2013-2064.patch
@@ -0,0 +1,44 @@
+From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Thu, 02 May 2013 00:59:31 +0000
+Subject: integer overflow in read_packet() [CVE-2013-2064]
+
+Ensure that when calculating the size of the incoming response from the
+Xserver, we don't overflow the integer used in the calculations when we
+multiply the int32_t length by 4 and add it to the default response size.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+diff --git a/src/xcb_in.c b/src/xcb_in.c
+index b810783..8a7af92 100644
+--- a/src/xcb_in.c
++++ b/src/xcb_in.c
+@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
+ static int read_packet(xcb_connection_t *c)
+ {
+     xcb_generic_reply_t genrep;
+-    int length = 32;
+-    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
++    uint64_t length = 32;
++    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
++    uint64_t bufsize;
+     void *buf;
+     pending_reply *pend = 0;
+     struct event_list *event;
+@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
+     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
+         eventlength = genrep.length * 4;
+ 
+-    buf = malloc(length + eventlength +
+-            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
++    bufsize = length + eventlength +
++        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
++    if (bufsize < INT32_MAX)
++        buf = malloc((size_t) bufsize);
++    else
++        buf = NULL;
+     if(!buf)
+     {
+         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
+--
+cgit v0.9.0.2-2-gbebe