1 files changed, 0 insertions, 44 deletions
diff --git a/main/libxcb/CVE-2013-2064.patch b/main/libxcb/CVE-2013-2064.patch
deleted file mode 100644
index 32fc268156..0000000000
--- a/main/libxcb/CVE-2013-2064.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001
-From: Alan Coopersmith <alan.coopersmith@oracle.com>
-Date: Thu, 02 May 2013 00:59:31 +0000
-Subject: integer overflow in read_packet() [CVE-2013-2064]
-
-Ensure that when calculating the size of the incoming response from the
-Xserver, we don't overflow the integer used in the calculations when we
-multiply the int32_t length by 4 and add it to the default response size.
-
-Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
----
-diff --git a/src/xcb_in.c b/src/xcb_in.c
-index b810783..8a7af92 100644
---- a/src/xcb_in.c
-+++ b/src/xcb_in.c
-@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
- static int read_packet(xcb_connection_t *c)
- {
-     xcb_generic_reply_t genrep;
--    int length = 32;
--    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
-+    uint64_t length = 32;
-+    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
-+    uint64_t bufsize;
-     void *buf;
-     pending_reply *pend = 0;
-     struct event_list *event;
-@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
-     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
-         eventlength = genrep.length * 4;
- 
--    buf = malloc(length + eventlength +
--            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
-+    bufsize = length + eventlength +
-+        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
-+    if (bufsize < INT32_MAX)
-+        buf = malloc((size_t) bufsize);
-+    else
-+        buf = NULL;
-     if(!buf)
-     {
-         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
---
-cgit v0.9.0.2-2-gbebe