aboutsummaryrefslogtreecommitdiffstats
path: root/main/libxcursor
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2013-05-24 08:32:13 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2013-05-24 08:32:13 +0000
commit12fb9608ca0d7e1478f57863518a56e57fc759bc (patch)
tree0b2780f3f58ad40145579820d8788c03fe4328b5 /main/libxcursor
parentde43558cd1904b59c2358a05514aea1d20fab1c2 (diff)
downloadaports-12fb9608ca0d7e1478f57863518a56e57fc759bc.tar.bz2
aports-12fb9608ca0d7e1478f57863518a56e57fc759bc.tar.xz
main/libxcursor: fix CVE-2013-2003
ref #1931
Diffstat (limited to 'main/libxcursor')
-rw-r--r--main/libxcursor/APKBUILD30
-rw-r--r--main/libxcursor/CVE-2013-2003.patch34
2 files changed, 57 insertions, 7 deletions
diff --git a/main/libxcursor/APKBUILD b/main/libxcursor/APKBUILD
index cc57d89804..e769d48313 100644
--- a/main/libxcursor/APKBUILD
+++ b/main/libxcursor/APKBUILD
@@ -1,19 +1,30 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=libxcursor
pkgver=1.1.13
-pkgrel=0
+pkgrel=1
pkgdesc="X cursor management library"
url="http://xorg.freedesktop.org/"
arch="all"
license="custom"
subpackages="$pkgname-dev $pkgname-doc"
depends=
-makedepends="pkgconfig libxfixes-dev libx11-dev libxrender-dev"
-source="http://xorg.freedesktop.org/releases/individual/lib/libXcursor-$pkgver.tar.bz2"
-
depends_dev="xproto libx11-dev libxrender-dev libxfixes-dev"
+makedepends="$depends_dev"
+source="http://xorg.freedesktop.org/releases/individual/lib/libXcursor-$pkgver.tar.bz2
+ CVE-2013-2003.patch"
+
+_builddir="$srcdir"/libXcursor-$pkgver
+prepare() {
+ cd "$_builddir"
+ for i in $source; do
+ case $i in
+ *.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
+ esac
+ done
+}
+
build() {
- cd "$srcdir"/libXcursor-$pkgver
+ cd "$_builddir"
./configure --prefix=/usr \
--sysconfdir=/etc \
|| return 1
@@ -21,8 +32,13 @@ build() {
}
package() {
- cd "$srcdir"/libXcursor-$pkgver
+ cd "$_builddir"
make DESTDIR="$pkgdir" install || return 1
rm "$pkgdir"/usr/lib/*.la || return 1
}
-md5sums="52efa81b7f26c8eda13510a2fba98eea libXcursor-1.1.13.tar.bz2"
+md5sums="52efa81b7f26c8eda13510a2fba98eea libXcursor-1.1.13.tar.bz2
+e604d93c5dfcc22078129959acc9a6d5 CVE-2013-2003.patch"
+sha256sums="f78827de4a1b7ce8cceca24a9ab9d1b1d2f6a61362f505166ffc19b07c0bad8f libXcursor-1.1.13.tar.bz2
+9d7d03d476f92b3527daa825c7d7986f3048ced65cf548ab2667b3834b3560c8 CVE-2013-2003.patch"
+sha512sums="81e9523c8181341b6607a97e493f065ac094638479a6094360d1adbccd637c9c7397c28b700e2abd568f42f4ba43a62153186371f6706b06959980b435bb45cc libXcursor-1.1.13.tar.bz2
+c471d5a3823d8206ee2dfe27482ed83559444a989aeeee49b67bf0d77c6a6dd6fb74d2708766b41c3e28cc89249c6ba5c41454aac2df3aeb57d2c1cc706effa0 CVE-2013-2003.patch"
diff --git a/main/libxcursor/CVE-2013-2003.patch b/main/libxcursor/CVE-2013-2003.patch
new file mode 100644
index 0000000000..a4f41e1453
--- /dev/null
+++ b/main/libxcursor/CVE-2013-2003.patch
@@ -0,0 +1,34 @@
+From 8f677eaea05290531d007d1fec2768119926088d Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 04:17:28 +0000
+Subject: signedness bug & integer overflow in _XcursorFileHeaderCreate() [CVE-2013-2003]
+
+When parsing cursor files, a user defined (e.g. through environment
+variables) cursor file is opened and parsed.
+
+The header is read in _XcursorReadFileHeader(), which reads an unsigned
+int for the number of toc structures in the header, but it was being
+passed to _XcursorFileHeaderCreate() as a signed int to allocate those
+structures. If the number was negative, it would pass the bounds check
+and could overflow the calculation for how much memory to allocate to
+store the data being read, leading to overflowing the buffer with the
+data read from the user controlled file.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+diff --git a/src/file.c b/src/file.c
+index efe6d4b..ce9de78 100644
+--- a/src/file.c
++++ b/src/file.c
+@@ -205,7 +205,7 @@ _XcursorFileHeaderDestroy (XcursorFileHeader *fileHeader)
+ }
+
+ static XcursorFileHeader *
+-_XcursorFileHeaderCreate (int ntoc)
++_XcursorFileHeaderCreate (XcursorUInt ntoc)
+ {
+ XcursorFileHeader *fileHeader;
+
+--
+cgit v0.9.0.2-2-gbebe