aboutsummaryrefslogtreecommitdiffstats
path: root/main
diff options
context:
space:
mode:
authorNatanael Copa <ncopa@alpinelinux.org>2013-05-24 09:28:38 +0000
committerNatanael Copa <ncopa@alpinelinux.org>2013-05-24 09:28:38 +0000
commita04d1c8ff925273f3caf3a46393cf73ac2b96ab5 (patch)
tree23a563825641ef144859bb0ada124d462b61b143 /main
parentb262cf6c02f0e15dc88618b6a9e1298ace184057 (diff)
downloadaports-a04d1c8ff925273f3caf3a46393cf73ac2b96ab5.tar.bz2
aports-a04d1c8ff925273f3caf3a46393cf73ac2b96ab5.tar.xz
ref #1931
Diffstat (limited to 'main')
-rw-r--r--main/libxv/0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch93
-rw-r--r--main/libxv/0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch43
-rw-r--r--main/libxv/0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch47
-rw-r--r--main/libxv/0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch37
-rw-r--r--main/libxv/0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch35
-rw-r--r--main/libxv/APKBUILD48
6 files changed, 296 insertions, 7 deletions
diff --git a/main/libxv/0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch b/main/libxv/0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch
new file mode 100644
index 0000000000..0e33952a60
--- /dev/null
+++ b/main/libxv/0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch
@@ -0,0 +1,93 @@
+From 79362c764a6df7e7fbe5247756bdbf60f3a58baf Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 00:28:34 -0700
+Subject: [PATCH 1/5] Use _XEatDataWords to avoid overflow of rep.length
+ shifting
+
+rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ configure.ac | 6 ++++++
+ src/Xv.c | 22 +++++++++++++++++++---
+ 2 files changed, 25 insertions(+), 3 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 5494b5d..6a335db 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -43,6 +43,12 @@ XORG_CHECK_MALLOC_ZERO
+ # Obtain compiler/linker options for depedencies
+ PKG_CHECK_MODULES(XV, x11 xext xextproto videoproto)
+
++# Check for _XEatDataWords function that may be patched into older Xlib release
++SAVE_LIBS="$LIBS"
++LIBS="$XV_LIBS"
++AC_CHECK_FUNCS([_XEatDataWords])
++LIBS="$SAVE_LIBS"
++
+ # Allow checking code with lint, sparse, etc.
+ XORG_WITH_LINT
+ XORG_LINT_LIBRARY([Xv])
+diff --git a/src/Xv.c b/src/Xv.c
+index b081e8a..5be1d95 100644
+--- a/src/Xv.c
++++ b/src/Xv.c
+@@ -49,11 +49,27 @@ SOFTWARE.
+ **
+ */
+
++#ifdef HAVE_CONFIG_H
++# include "config.h"
++#endif
++
+ #include <stdio.h>
+ #include "Xvlibint.h"
+ #include <X11/extensions/Xext.h>
+ #include <X11/extensions/extutil.h>
+ #include <X11/extensions/XShm.h>
++#include <limits.h>
++
++#ifndef HAVE__XEATDATAWORDS
++static inline void _XEatDataWords(Display *dpy, unsigned long n)
++{
++# ifndef LONG64
++ if (n >= (ULONG_MAX >> 2))
++ _XIOError(dpy);
++# endif
++ _XEatData (dpy, n << 2);
++}
++#endif
+
+ static XExtensionInfo _xv_info_data;
+ static XExtensionInfo *xv_info = &_xv_info_data;
+@@ -853,7 +869,7 @@ XvQueryPortAttributes(Display *dpy, XvPortID port, int *num)
+ (*num)++;
+ }
+ } else
+- _XEatData(dpy, rep.length << 2);
++ _XEatDataWords(dpy, rep.length);
+ }
+
+ UnlockDisplay(dpy);
+@@ -923,7 +939,7 @@ XvImageFormatValues * XvListImageFormats (
+ (*num)++;
+ }
+ } else
+- _XEatData(dpy, rep.length << 2);
++ _XEatDataWords(dpy, rep.length);
+ }
+
+ UnlockDisplay(dpy);
+@@ -976,7 +992,7 @@ XvImage * XvCreateImage (
+ _XRead(dpy, (char*)(ret->pitches), rep.num_planes << 2);
+ _XRead(dpy, (char*)(ret->offsets), rep.num_planes << 2);
+ } else
+- _XEatData(dpy, rep.length << 2);
++ _XEatDataWords(dpy, rep.length);
+
+ UnlockDisplay(dpy);
+ SyncHandle();
+--
+1.8.2.3
+
diff --git a/main/libxv/0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch b/main/libxv/0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch
new file mode 100644
index 0000000000..707f99b02b
--- /dev/null
+++ b/main/libxv/0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch
@@ -0,0 +1,43 @@
+From 6e1b743a276651195be3cd68dff41e38426bf3ab Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 00:03:03 -0700
+Subject: [PATCH 2/5] integer overflow in XvQueryPortAttributes()
+ [CVE-2013-1989 1/3]
+
+The num_attributes & text_size members of the reply are both CARD32s
+and need to be bounds checked before multiplying & adding them together
+to come up with the total size to allocate, to avoid integer overflow
+leading to underallocation and writing data from the network past the
+end of the allocated buffer.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/Xv.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/Xv.c b/src/Xv.c
+index 5be1d95..3cbad35 100644
+--- a/src/Xv.c
++++ b/src/Xv.c
+@@ -851,9 +851,15 @@ XvQueryPortAttributes(Display *dpy, XvPortID port, int *num)
+ }
+
+ if(rep.num_attributes) {
+- int size = (rep.num_attributes * sizeof(XvAttribute)) + rep.text_size;
++ unsigned long size;
++ /* limit each part to no more than one half the max size */
++ if ((rep.num_attributes < ((INT_MAX / 2) / sizeof(XvAttribute))) &&
++ (rep.text_size < (INT_MAX / 2))) {
++ size = (rep.num_attributes * sizeof(XvAttribute)) + rep.text_size;
++ ret = Xmalloc(size);
++ }
+
+- if((ret = Xmalloc(size))) {
++ if (ret != NULL) {
+ char* marker = (char*)(&ret[rep.num_attributes]);
+ xvAttributeInfo Info;
+ int i;
+--
+1.8.2.3
+
diff --git a/main/libxv/0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch b/main/libxv/0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch
new file mode 100644
index 0000000000..24e1c1b8b3
--- /dev/null
+++ b/main/libxv/0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch
@@ -0,0 +1,47 @@
+From 15ab7dec17d686c38f2c82ac23a17cac5622322a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 00:16:14 -0700
+Subject: [PATCH 3/5] buffer overflow in XvQueryPortAttributes()
+ [CVE-2013-2066]
+
+Each attribute returned in the reply includes the number of bytes
+to read for its marker. We had been always trusting it, and never
+validating that it wouldn't cause us to write past the end of the
+buffer we allocated based on the reported text_size.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/Xv.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/src/Xv.c b/src/Xv.c
+index 3cbad35..f9813eb 100644
+--- a/src/Xv.c
++++ b/src/Xv.c
+@@ -864,14 +864,20 @@ XvQueryPortAttributes(Display *dpy, XvPortID port, int *num)
+ xvAttributeInfo Info;
+ int i;
+
++ /* keep track of remaining room for text strings */
++ size = rep.text_size;
++
+ for(i = 0; i < rep.num_attributes; i++) {
+ _XRead(dpy, (char*)(&Info), sz_xvAttributeInfo);
+ ret[i].flags = (int)Info.flags;
+ ret[i].min_value = Info.min;
+ ret[i].max_value = Info.max;
+ ret[i].name = marker;
+- _XRead(dpy, marker, Info.size);
+- marker += Info.size;
++ if (Info.size <= size) {
++ _XRead(dpy, marker, Info.size);
++ marker += Info.size;
++ size -= Info.size;
++ }
+ (*num)++;
+ }
+ } else
+--
+1.8.2.3
+
diff --git a/main/libxv/0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch b/main/libxv/0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch
new file mode 100644
index 0000000000..b80f47a1d7
--- /dev/null
+++ b/main/libxv/0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch
@@ -0,0 +1,37 @@
+From 59301c1b5095f7dc6359d5b396dbbcdee7038270 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 00:03:03 -0700
+Subject: [PATCH 4/5] integer overflow in XvListImageFormats() [CVE-2013-1989
+ 2/3]
+
+num_formats is a CARD32 and needs to be bounds checked before multiplying
+by sizeof(XvImageFormatValues) to come up with the total size to allocate,
+to avoid integer overflow leading to underallocation and writing data from
+the network past the end of the allocated buffer.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/Xv.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/Xv.c b/src/Xv.c
+index f9813eb..0a07d9d 100644
+--- a/src/Xv.c
++++ b/src/Xv.c
+@@ -918,9 +918,10 @@ XvImageFormatValues * XvListImageFormats (
+ }
+
+ if(rep.num_formats) {
+- int size = (rep.num_formats * sizeof(XvImageFormatValues));
++ if (rep.num_formats < (INT_MAX / sizeof(XvImageFormatValues)))
++ ret = Xmalloc(rep.num_formats * sizeof(XvImageFormatValues));
+
+- if((ret = Xmalloc(size))) {
++ if (ret != NULL) {
+ xvImageFormatInfo Info;
+ int i;
+
+--
+1.8.2.3
+
diff --git a/main/libxv/0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch b/main/libxv/0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch
new file mode 100644
index 0000000000..2be6900c33
--- /dev/null
+++ b/main/libxv/0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch
@@ -0,0 +1,35 @@
+From 50fc4cb18069cb9450a02c13f80223ef23511409 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 13 Apr 2013 00:03:03 -0700
+Subject: [PATCH 5/5] integer overflow in XvCreateImage() [CVE-2013-1989 3/3]
+
+num_planes is a CARD32 and needs to be bounds checked before bit shifting
+and adding to sizeof(XvImage) to come up with the total size to allocate,
+to avoid integer overflow leading to underallocation and writing data from
+the network past the end of the allocated buffer.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/Xv.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/src/Xv.c b/src/Xv.c
+index 0a07d9d..f268f8e 100644
+--- a/src/Xv.c
++++ b/src/Xv.c
+@@ -992,7 +992,10 @@ XvImage * XvCreateImage (
+ return NULL;
+ }
+
+- if((ret = (XvImage*)Xmalloc(sizeof(XvImage) + (rep.num_planes << 3)))) {
++ if (rep.num_planes < ((INT_MAX >> 3) - sizeof(XvImage)))
++ ret = Xmalloc(sizeof(XvImage) + (rep.num_planes << 3));
++
++ if (ret != NULL) {
+ ret->id = id;
+ ret->width = rep.width;
+ ret->height = rep.height;
+--
+1.8.2.3
+
diff --git a/main/libxv/APKBUILD b/main/libxv/APKBUILD
index d66f33db52..efb6b10857 100644
--- a/main/libxv/APKBUILD
+++ b/main/libxv/APKBUILD
@@ -1,28 +1,62 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=libxv
pkgver=1.0.7
-pkgrel=0
+pkgrel=1
pkgdesc="X11 Video extension library"
url="http://xorg.freedesktop.org/"
arch="all"
license="custom"
subpackages="$pkgname-dev $pkgname-doc"
depends=
-makedepends="pkgconfig libxext-dev libx11-dev videoproto"
-source="http://xorg.freedesktop.org/releases/individual/lib/libXv-$pkgver.tar.bz2"
-
depends_dev="xproto videoproto libx11-dev libxext-dev"
+makedepends="$depends_dev libtool autoconf automake util-macros"
+source="http://xorg.freedesktop.org/releases/individual/lib/libXv-$pkgver.tar.bz2
+ 0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch
+ 0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch
+ 0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch
+ 0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch
+ 0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch
+ "
+
+_builddir="$srcdir"/libXv-$pkgver
+prepare() {
+ cd "$_builddir"
+ for i in $source; do
+ case $i in
+ *.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;;
+ esac
+ done
+ libtoolize --force && aclocal && autoheader && autoconf \
+ && automake --add-missing
+}
build() {
- cd "$srcdir"/libXv-$pkgver
+ cd "$_builddir"
./configure --prefix=/usr
make || return 1
}
package() {
- cd "$srcdir"/libXv-$pkgver
+ cd "$_builddir"
make DESTDIR="$pkgdir" install || return 1
rm "$pkgdir"/usr/lib/*.la || return 1
install -D -m644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
}
-md5sums="5e1ac203ccd3ce3e89755ed1fbe75b0b libXv-1.0.7.tar.bz2"
+md5sums="5e1ac203ccd3ce3e89755ed1fbe75b0b libXv-1.0.7.tar.bz2
+cbd5367f2b5717cab78b819aaaacd7d9 0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch
+ff8da08c2883bdc98cbac78e448e81e6 0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch
+108ba64a9d7d5f3763cfbb00ffe53eb2 0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch
+53dbcb31cb08325b3a5329f16ddab3dd 0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch
+0844dd0e117d36a70f603019af580f13 0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch"
+sha256sums="5d664aeb641f8c867331a0c6b4574a5e7e420f00bf5fcefd874e8d003ea59010 libXv-1.0.7.tar.bz2
+993a72fc67e9de4df9b19eeedd32c70b325ed5d97fdc9e476a585d5fd151469e 0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch
+583d3d8192bd11902e464213b462f24f632424c449eaa68c238910a2b1b223fb 0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch
+7525a4f5df082913d614683219795e5ecaafd999fbe7696ab2e48857f1455b8c 0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch
+51edf32e1da0ef2afa7f11ef9b96c29f7d886f1a88b5610118753a36afc140ce 0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch
+4debde18842840d7872ba3b367ca9bb5c40b2565d0d7d2c984961b10a2971955 0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch"
+sha512sums="25c81cc6d112a6b07de1c53fa5fc8bb9d886d19cffc2bcd65c4668ba53808051cf4d4720413b5c436ba356bb76f9ca05decf61909839ee19ccf9cbc7263e373b libXv-1.0.7.tar.bz2
+b4a8c457380ff3d1dd2b4da0b80f83cf577fe1345a3b8c49686e9ad88ce77f49ade7e4a7c5042bf0dff6e43af8a6adcb5706067ea87ecf5b84e74849b65cfbc9 0001-Use-_XEatDataWords-to-avoid-overflow-of-rep.length-s.patch
+fb07656fcd4779c246546ec8d2cc3dd16b013d77380ecf21cf2b2ee7f37910cf9a5f016c8b97a68e5499b5af88b5cdbbe19399c278136daa72ad3321f343d66a 0002-integer-overflow-in-XvQueryPortAttributes-CVE-2013-1.patch
+2ecc22e831cad3ed4701c42665d25b6c2da358a3464d8a0a29e6f081a83cdd79ce50b67692ee93e6d114f518250a979920df93e7366a5063a36ee69bdc8fd2c8 0003-buffer-overflow-in-XvQueryPortAttributes-CVE-2013-20.patch
+0b63e9966e854b51df7c9db1359f4c8c868f607b0effd0c6f6f5838c9451e57e0951ae32fbe5b2cac14765e6738ba50b688539c9f5c08bc05bb794ef572c27f6 0004-integer-overflow-in-XvListImageFormats-CVE-2013-1989.patch
+628cc07629f6819a435bd29f9e6d79a9cc13ee7ed6abef3c9d322c32cd78a75e386a448191fa38f01fe4597ef66e9347f0e7ed8724bb7974520cb9a7ffd5a7ef 0005-integer-overflow-in-XvCreateImage-CVE-2013-1989-3-3.patch"