diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2015-05-05 06:49:48 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2015-05-05 07:00:33 +0000 |
| commit | c5f1ff545ff87ffa10bd27c349f185fe902a2844 (patch) | |
| tree | f4568b17d7d4b62fc3142159189bc6d5b6eae903 /main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch | |
| parent | 87d2e400facc8da0681a7872a67de56bccd50c6c (diff) | |
| download | aports-c5f1ff545ff87ffa10bd27c349f185fe902a2844.tar.bz2 aports-c5f1ff545ff87ffa10bd27c349f185fe902a2844.tar.xz | |
main/libxfont: security upgrade to 1.4.9
Diffstat (limited to 'main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch')
| -rw-r--r-- | main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch | 42 |
1 files changed, 0 insertions, 42 deletions
diff --git a/main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch b/main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch deleted file mode 100644 index 1056b61f91..0000000000 --- a/main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch +++ /dev/null @@ -1,42 +0,0 @@ -From a3f21421537620fc4e1f844a594a4bcd9f7e2bd8 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Fri, 25 Apr 2014 23:03:05 -0700 -Subject: [PATCH 09/12] CVE-2014-0210: unvalidated length fields in - fs_read_extent_info() - -Looping over the extents in the reply could go past the end of the -reply buffer if the reply indicated more extents than could fit in -the specified reply length. - -Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> -Reviewed-by: Adam Jackson <ajax@redhat.com> -Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> ---- - src/fc/fserve.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/src/fc/fserve.c b/src/fc/fserve.c -index 96abd0e..232e969 100644 ---- a/src/fc/fserve.c -+++ b/src/fc/fserve.c -@@ -1059,6 +1059,16 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) - #endif - pCI = NULL; - } -+ else if (numExtents > ((rep->length - LENGTHOF(fsQueryXExtents16Reply)) -+ / LENGTHOF(fsXCharInfo))) { -+#ifdef DEBUG -+ fprintf(stderr, -+ "fsQueryXExtents16: numExtents (%d) > (%d - %d) / %d\n", -+ numExtents, rep->length, -+ LENGTHOF(fsQueryXExtents16Reply), LENGTHOF(fsXCharInfo)); -+#endif -+ pCI = NULL; -+ } - else - pCI = malloc(sizeof(CharInfoRec) * numInfos); - --- -1.7.10 - |