main/libxcursor: fix CVE-2013-2003

ref #1931

2 files changed, 57 insertions, 7 deletions

diff --git a/main/libxcursor/APKBUILD b/main/libxcursor/APKBUILD
index cc57d89804..e769d48313 100644
--- a/main/libxcursor/APKBUILD
+++ b/main/libxcursor/APKBUILD
@@ -1,19 +1,30 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=libxcursor
 pkgver=1.1.13
-pkgrel=0
+pkgrel=1
 pkgdesc="X cursor management library"
 url="http://xorg.freedesktop.org/"
 arch="all"
 license="custom"
 subpackages="$pkgname-dev $pkgname-doc"
 depends=
-makedepends="pkgconfig libxfixes-dev libx11-dev libxrender-dev"
-source="http://xorg.freedesktop.org/releases/individual/lib/libXcursor-$pkgver.tar.bz2"
-
 depends_dev="xproto libx11-dev libxrender-dev libxfixes-dev"
+makedepends="$depends_dev"
+source="http://xorg.freedesktop.org/releases/individual/lib/libXcursor-$pkgver.tar.bz2
+	CVE-2013-2003.patch"
+
+_builddir="$srcdir"/libXcursor-$pkgver
+prepare() {
+	cd "$_builddir"
+	for i in $source; do
+		case $i in
+		*.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
+		esac
+	done
+}
+
 build() {
-	cd "$srcdir"/libXcursor-$pkgver
+	cd "$_builddir"
 	./configure --prefix=/usr \
 		--sysconfdir=/etc \
 		|| return 1
@@ -21,8 +32,13 @@ build() {
 }
 
 package() {
-	cd "$srcdir"/libXcursor-$pkgver
+	cd "$_builddir"
 	make DESTDIR="$pkgdir" install || return 1
 	rm "$pkgdir"/usr/lib/*.la || return 1
 }
-md5sums="52efa81b7f26c8eda13510a2fba98eea  libXcursor-1.1.13.tar.bz2"
+md5sums="52efa81b7f26c8eda13510a2fba98eea  libXcursor-1.1.13.tar.bz2
+e604d93c5dfcc22078129959acc9a6d5  CVE-2013-2003.patch"
+sha256sums="f78827de4a1b7ce8cceca24a9ab9d1b1d2f6a61362f505166ffc19b07c0bad8f  libXcursor-1.1.13.tar.bz2
+9d7d03d476f92b3527daa825c7d7986f3048ced65cf548ab2667b3834b3560c8  CVE-2013-2003.patch"
+sha512sums="81e9523c8181341b6607a97e493f065ac094638479a6094360d1adbccd637c9c7397c28b700e2abd568f42f4ba43a62153186371f6706b06959980b435bb45cc  libXcursor-1.1.13.tar.bz2
+c471d5a3823d8206ee2dfe27482ed83559444a989aeeee49b67bf0d77c6a6dd6fb74d2708766b41c3e28cc89249c6ba5c41454aac2df3aeb57d2c1cc706effa0  CVE-2013-2003.patch"
diff --git a/main/libxcursor/CVE-2013-2003.patch b/main/libxcursor/CVE-2013-2003.patch
new file mode 100644
index 0000000000..a4f41e1453
--- /dev/null
+++ b/main/libxcursor/CVE-2013-2003.patch
@@ -0,0 +1,34 @@
+From 8f677eaea05290531d007d1fec2768119926088d Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 04:17:28 +0000
+Subject: signedness bug & integer overflow in _XcursorFileHeaderCreate() [CVE-2013-2003]
+
+When parsing cursor files, a user defined (e.g. through environment
+variables) cursor file is opened and parsed.
+
+The header is read in _XcursorReadFileHeader(), which reads an unsigned
+int for the number of toc structures in the header, but it was being
+passed to _XcursorFileHeaderCreate() as a signed int to allocate those
+structures.  If the number was negative, it would pass the bounds check
+and could overflow the calculation for how much memory to allocate to
+store the data being read, leading to overflowing the buffer with the
+data read from the user controlled file.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+diff --git a/src/file.c b/src/file.c
+index efe6d4b..ce9de78 100644
+--- a/src/file.c
++++ b/src/file.c
+@@ -205,7 +205,7 @@ _XcursorFileHeaderDestroy (XcursorFileHeader *fileHeader)
+ }
+ 
+ static XcursorFileHeader *
+-_XcursorFileHeaderCreate (int ntoc)
++_XcursorFileHeaderCreate (XcursorUInt ntoc)
+ {
+     XcursorFileHeader	*fileHeader;
+ 
+--
+cgit v0.9.0.2-2-gbebe