aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--main/libxcb/APKBUILD12
-rw-r--r--main/libxcb/CVE-2013-2064.patch44
2 files changed, 4 insertions, 52 deletions
diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD
index 3ef9e93890..1657306f5b 100644
--- a/main/libxcb/APKBUILD
+++ b/main/libxcb/APKBUILD
@@ -1,6 +1,6 @@
# Maintainer: Natanael Copa <ncopa@alpinelinux.org>
pkgname=libxcb
-pkgver=1.9
+pkgver=1.9.1
pkgrel=1
pkgdesc="X11 client-side library"
url="http://xcb.freedesktop.org/"
@@ -11,7 +11,6 @@ subpackages="$pkgname-dev $pkgname-doc"
depends_dev="libpthread-stubs libxau-dev libxdmcp-dev xcb-proto"
makedepends="$depends_dev libxslt python"
source="http://xcb.freedesktop.org/dist/$pkgname-$pkgver.tar.bz2
- CVE-2013-2064.patch
"
_builddir="$srcdir"/$pkgname-$pkgver
@@ -40,9 +39,6 @@ package() {
rm "$pkgdir"/usr/lib/*.la || return 1
install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
}
-md5sums="2b05856e9d1cb37836aae7406f2f4ce2 libxcb-1.9.tar.bz2
-343285a0a015ef099e33fe8fb9615760 CVE-2013-2064.patch"
-sha256sums="8857e62b3aae2976c7e10043643e45a85964fd1dcb4469dfde0d04d3d1b12c96 libxcb-1.9.tar.bz2
-83ca3f8b02799468822a5e2fbe559a43cb57c03f450ccd58f59ce7a054b859c3 CVE-2013-2064.patch"
-sha512sums="799f68b21df296e1e03cb5b5bfa065764c08652a4fd47e4b3ebc9d217f2f9fefabbae28b8ffacadab57917189616e09821e6ef6dcd1ffc24f5d82541997fdfb0 libxcb-1.9.tar.bz2
-31d5a1486d57970bdf0b0ffd8345c416e6a7a0e1cc2f93ab63fa0aea3d31b2d061bb8cf5f778aa88c59863d5e551d0a9558c2b05b9e5abcf3818e839c5f9421f CVE-2013-2064.patch"
+md5sums="ed632cb0dc31b6fbd7ea5c0f931cf5a4 libxcb-1.9.1.tar.bz2"
+sha256sums="d44a5ff4eb0b9569e6f7183b51fdaf6f58da90e7d6bfc36b612d7263f83e362f libxcb-1.9.1.tar.bz2"
+sha512sums="541d6e07b1a0da61c3cc1dbdae50ce4e55f1a27e79e277db5af192d02c8360bb3958c597d6692f2c6afcf009ae7b312459f65e8c8d2f1bcc446f7f512bacdd41 libxcb-1.9.1.tar.bz2"
diff --git a/main/libxcb/CVE-2013-2064.patch b/main/libxcb/CVE-2013-2064.patch
deleted file mode 100644
index 32fc268156..0000000000
--- a/main/libxcb/CVE-2013-2064.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Thu, 02 May 2013 00:59:31 +0000
-Subject: integer overflow in read_packet() [CVE-2013-2064]
-
-Ensure that when calculating the size of the incoming response from the
-Xserver, we don't overflow the integer used in the calculations when we
-multiply the int32_t length by 4 and add it to the default response size.
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
----
-diff --git a/src/xcb_in.c b/src/xcb_in.c
-index b810783..8a7af92 100644
---- a/src/xcb_in.c
-+++ b/src/xcb_in.c
-@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
- static int read_packet(xcb_connection_t *c)
- {
- xcb_generic_reply_t genrep;
-- int length = 32;
-- int eventlength = 0; /* length after first 32 bytes for GenericEvents */
-+ uint64_t length = 32;
-+ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
-+ uint64_t bufsize;
- void *buf;
- pending_reply *pend = 0;
- struct event_list *event;
-@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
- if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
- eventlength = genrep.length * 4;
-
-- buf = malloc(length + eventlength +
-- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
-+ bufsize = length + eventlength +
-+ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
-+ if (bufsize < INT32_MAX)
-+ buf = malloc((size_t) bufsize);
-+ else
-+ buf = NULL;
- if(!buf)
- {
- _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
---
-cgit v0.9.0.2-2-gbebe