diff options
| -rw-r--r-- | main/libxcb/APKBUILD | 12 | ||||
| -rw-r--r-- | main/libxcb/CVE-2013-2064.patch | 44 |
2 files changed, 4 insertions, 52 deletions
diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD index 3ef9e93890..1657306f5b 100644 --- a/main/libxcb/APKBUILD +++ b/main/libxcb/APKBUILD @@ -1,6 +1,6 @@ # Maintainer: Natanael Copa <ncopa@alpinelinux.org> pkgname=libxcb -pkgver=1.9 +pkgver=1.9.1 pkgrel=1 pkgdesc="X11 client-side library" url="http://xcb.freedesktop.org/" @@ -11,7 +11,6 @@ subpackages="$pkgname-dev $pkgname-doc" depends_dev="libpthread-stubs libxau-dev libxdmcp-dev xcb-proto" makedepends="$depends_dev libxslt python" source="http://xcb.freedesktop.org/dist/$pkgname-$pkgver.tar.bz2 - CVE-2013-2064.patch " _builddir="$srcdir"/$pkgname-$pkgver @@ -40,9 +39,6 @@ package() { rm "$pkgdir"/usr/lib/*.la || return 1 install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING } -md5sums="2b05856e9d1cb37836aae7406f2f4ce2 libxcb-1.9.tar.bz2 -343285a0a015ef099e33fe8fb9615760 CVE-2013-2064.patch" -sha256sums="8857e62b3aae2976c7e10043643e45a85964fd1dcb4469dfde0d04d3d1b12c96 libxcb-1.9.tar.bz2 -83ca3f8b02799468822a5e2fbe559a43cb57c03f450ccd58f59ce7a054b859c3 CVE-2013-2064.patch" -sha512sums="799f68b21df296e1e03cb5b5bfa065764c08652a4fd47e4b3ebc9d217f2f9fefabbae28b8ffacadab57917189616e09821e6ef6dcd1ffc24f5d82541997fdfb0 libxcb-1.9.tar.bz2 -31d5a1486d57970bdf0b0ffd8345c416e6a7a0e1cc2f93ab63fa0aea3d31b2d061bb8cf5f778aa88c59863d5e551d0a9558c2b05b9e5abcf3818e839c5f9421f CVE-2013-2064.patch" +md5sums="ed632cb0dc31b6fbd7ea5c0f931cf5a4 libxcb-1.9.1.tar.bz2" +sha256sums="d44a5ff4eb0b9569e6f7183b51fdaf6f58da90e7d6bfc36b612d7263f83e362f libxcb-1.9.1.tar.bz2" +sha512sums="541d6e07b1a0da61c3cc1dbdae50ce4e55f1a27e79e277db5af192d02c8360bb3958c597d6692f2c6afcf009ae7b312459f65e8c8d2f1bcc446f7f512bacdd41 libxcb-1.9.1.tar.bz2" diff --git a/main/libxcb/CVE-2013-2064.patch b/main/libxcb/CVE-2013-2064.patch deleted file mode 100644 index 32fc268156..0000000000 --- a/main/libxcb/CVE-2013-2064.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith <alan.coopersmith@oracle.com> -Date: Thu, 02 May 2013 00:59:31 +0000 -Subject: integer overflow in read_packet() [CVE-2013-2064] - -Ensure that when calculating the size of the incoming response from the -Xserver, we don't overflow the integer used in the calculations when we -multiply the int32_t length by 4 and add it to the default response size. - -Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> ---- -diff --git a/src/xcb_in.c b/src/xcb_in.c -index b810783..8a7af92 100644 ---- a/src/xcb_in.c -+++ b/src/xcb_in.c -@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete - static int read_packet(xcb_connection_t *c) - { - xcb_generic_reply_t genrep; -- int length = 32; -- int eventlength = 0; /* length after first 32 bytes for GenericEvents */ -+ uint64_t length = 32; -+ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */ -+ uint64_t bufsize; - void *buf; - pending_reply *pend = 0; - struct event_list *event; -@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c) - if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT) - eventlength = genrep.length * 4; - -- buf = malloc(length + eventlength + -- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t))); -+ bufsize = length + eventlength + -+ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)); -+ if (bufsize < INT32_MAX) -+ buf = malloc((size_t) bufsize); -+ else -+ buf = NULL; - if(!buf) - { - _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT); --- -cgit v0.9.0.2-2-gbebe |