From 1476a4f2f4f84290a60b64a79123454f8227f80a Mon Sep 17 00:00:00 2001 From: Natanael Copa Date: Wed, 14 May 2014 08:49:55 +0000 Subject: main/libxfont: security fixes for CVE-2014-0209, CVE-2014-0210, CVE-2014-0211 fixes #2885 --- ...09-integer-overflow-of-realloc-size-in-Fo.patch | 47 ++++++ ...09-integer-overflow-of-realloc-size-in-le.patch | 50 +++++++ ...10-unvalidated-length-in-_fs_recv_conn_se.patch | 76 ++++++++++ ...10-unvalidated-lengths-when-reading-repli.patch | 162 +++++++++++++++++++++ ...11-Integer-overflow-in-fs_get_reply-_fs_s.patch | 68 +++++++++ ...10-unvalidated-length-fields-in-fs_read_q.patch | 127 ++++++++++++++++ ...11-integer-overflow-in-fs_read_extent_inf.patch | 52 +++++++ ...-0211-integer-overflow-in-fs_alloc_glyphs.patch | 38 +++++ ...10-unvalidated-length-fields-in-fs_read_e.patch | 42 ++++++ ...10-unvalidated-length-fields-in-fs_read_g.patch | 79 ++++++++++ ...10-unvalidated-length-fields-in-fs_read_l.patch | 62 ++++++++ ...10-unvalidated-length-fields-in-fs_read_l.patch | 111 ++++++++++++++ main/libxfont/APKBUILD | 73 +++++++++- 13 files changed, 980 insertions(+), 7 deletions(-) create mode 100644 main/libxfont/0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch create mode 100644 main/libxfont/0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch create mode 100644 main/libxfont/0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch create mode 100644 main/libxfont/0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch create mode 100644 main/libxfont/0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch create mode 100644 main/libxfont/0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch create mode 100644 main/libxfont/0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch create mode 100644 main/libxfont/0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch create mode 100644 main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch create mode 100644 main/libxfont/0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch create mode 100644 main/libxfont/0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch create mode 100644 main/libxfont/0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch diff --git a/main/libxfont/0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch b/main/libxfont/0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch new file mode 100644 index 0000000000..1f57476558 --- /dev/null +++ b/main/libxfont/0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch @@ -0,0 +1,47 @@ +From 2f5e57317339c526e6eaee1010b0e2ab8089c42e Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:01:11 -0700 +Subject: [PATCH 01/12] CVE-2014-0209: integer overflow of realloc() size in + FontFileAddEntry() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +FontFileReadDirectory() opens a fonts.dir file, and reads over every +line in an fscanf loop. For each successful entry read (font name, +file name) a call is made to FontFileAddFontFile(). + +FontFileAddFontFile() will add a font file entry (for the font name +and file) each time it’s called, by calling FontFileAddEntry(). +FontFileAddEntry() will do the actual adding. If the table it has +to add to is full, it will do a realloc, adding 100 more entries +to the table size without checking to see if that will overflow the +int used to store the size. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fontfile/fontdir.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/fontfile/fontdir.c b/src/fontfile/fontdir.c +index ef7ffa5..7271603 100644 +--- a/src/fontfile/fontdir.c ++++ b/src/fontfile/fontdir.c +@@ -177,6 +177,11 @@ FontFileAddEntry(FontTablePtr table, FontEntryPtr prototype) + if (table->sorted) + return (FontEntryPtr) 0; /* "cannot" happen */ + if (table->used == table->size) { ++ if (table->size >= ((INT32_MAX / sizeof(FontEntryRec)) - 100)) ++ /* If we've read so many entries we're going to ask for 2gb ++ or more of memory, something is so wrong with this font ++ directory that we should just give up before we overflow. */ ++ return NULL; + newsize = table->size + 100; + entry = realloc(table->entries, newsize * sizeof(FontEntryRec)); + if (!entry) +-- +1.7.10 + diff --git a/main/libxfont/0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch b/main/libxfont/0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch new file mode 100644 index 0000000000..2cd080581a --- /dev/null +++ b/main/libxfont/0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch @@ -0,0 +1,50 @@ +From 05c8020a49416dd8b7510cbba45ce4f3fc81a7dc Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:01:48 -0700 +Subject: [PATCH 02/12] CVE-2014-0209: integer overflow of realloc() size in + lexAlias() + +lexAlias() reads from a file in a loop. It does this by starting with a +64 byte buffer. If that size limit is hit, it does a realloc of the +buffer size << 1, basically doubling the needed length every time the +length limit is hit. + +Eventually, this will shift out to 0 (for a length of ~4gig), and that +length will be passed on to realloc(). A length of 0 (with a valid +pointer) causes realloc to free the buffer on most POSIX platforms, +but the caller will still have a pointer to it, leading to use after +free issues. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fontfile/dirfile.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/fontfile/dirfile.c b/src/fontfile/dirfile.c +index cb28333..38ced75 100644 +--- a/src/fontfile/dirfile.c ++++ b/src/fontfile/dirfile.c +@@ -42,6 +42,7 @@ in this Software without prior written authorization from The Open Group. + #include + #include + #include ++#include + + static Bool AddFileNameAliases ( FontDirectoryPtr dir ); + static int ReadFontAlias ( char *directory, Bool isFile, +@@ -376,6 +377,9 @@ lexAlias(FILE *file, char **lexToken) + int nsize; + char *nbuf; + ++ if (tokenSize >= (INT_MAX >> 2)) ++ /* Stop before we overflow */ ++ return EALLOC; + nsize = tokenSize ? (tokenSize << 1) : 64; + nbuf = realloc(tokenBuf, nsize); + if (!nbuf) +-- +1.7.10 + diff --git a/main/libxfont/0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch b/main/libxfont/0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch new file mode 100644 index 0000000000..1b467fb2fb --- /dev/null +++ b/main/libxfont/0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch @@ -0,0 +1,76 @@ +From 891e084b26837162b12f841060086a105edde86d Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:02:00 -0700 +Subject: [PATCH 03/12] CVE-2014-0210: unvalidated length in + _fs_recv_conn_setup() + +The connection setup reply from the font server can include a list +of alternate servers to contact if this font server stops working. + +The reply specifies a total size of all the font server names, and +then provides a list of names. _fs_recv_conn_setup() allocated the +specified total size for copying the names to, but didn't check to +make sure it wasn't copying more data to that buffer than the size +it had allocated. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fserve.c | 20 ++++++++++++++++++-- + 1 file changed, 18 insertions(+), 2 deletions(-) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index 3585951..aa9acdb 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -2784,7 +2784,7 @@ _fs_recv_conn_setup (FSFpePtr conn) + int ret = FSIO_ERROR; + fsConnSetup *setup; + FSFpeAltPtr alts; +- int i, alt_len; ++ unsigned int i, alt_len; + int setup_len; + char *alt_save, *alt_names; + +@@ -2811,8 +2811,9 @@ _fs_recv_conn_setup (FSFpePtr conn) + } + if (setup->num_alternates) + { ++ size_t alt_name_len = setup->alternate_len << 2; + alts = malloc (setup->num_alternates * sizeof (FSFpeAltRec) + +- (setup->alternate_len << 2)); ++ alt_name_len); + if (alts) + { + alt_names = (char *) (setup + 1); +@@ -2821,10 +2822,25 @@ _fs_recv_conn_setup (FSFpePtr conn) + { + alts[i].subset = alt_names[0]; + alt_len = alt_names[1]; ++ if (alt_len >= alt_name_len) { ++ /* ++ * Length is longer than setup->alternate_len ++ * told us to allocate room for, assume entire ++ * alternate list is corrupted. ++ */ ++#ifdef DEBUG ++ fprintf (stderr, ++ "invalid alt list (length %lx >= %lx)\n", ++ (long) alt_len, (long) alt_name_len); ++#endif ++ free(alts); ++ return FSIO_ERROR; ++ } + alts[i].name = alt_save; + memcpy (alt_save, alt_names + 2, alt_len); + alt_save[alt_len] = '\0'; + alt_save += alt_len + 1; ++ alt_name_len -= alt_len + 1; + alt_names += _fs_pad_length (alt_len + 2); + } + conn->numAlts = setup->num_alternates; +-- +1.7.10 + diff --git a/main/libxfont/0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch b/main/libxfont/0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch new file mode 100644 index 0000000000..ca5d3aeb93 --- /dev/null +++ b/main/libxfont/0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch @@ -0,0 +1,162 @@ +From cbb64aef35960b2882be721f4b8fbaa0fb649d12 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:02:12 -0700 +Subject: [PATCH 04/12] CVE-2014-0210: unvalidated lengths when reading + replies from font server + +Functions to handle replies to font server requests were casting replies +from the generic form to reply specific structs without first checking +that the reply was at least as long as the struct being cast to. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fserve.c | 44 ++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 38 insertions(+), 6 deletions(-) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index aa9acdb..f08028f 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -91,6 +91,12 @@ in this Software without prior written authorization from The Open Group. + (pci)->descent || \ + (pci)->characterWidth) + ++/* ++ * SIZEOF(r) is in bytes, length fields in the protocol are in 32-bit words, ++ * so this converts for doing size comparisons. ++ */ ++#define LENGTHOF(r) (SIZEOF(r) >> 2) ++ + extern void ErrorF(const char *f, ...); + + static int fs_read_glyphs ( FontPathElementPtr fpe, FSBlockDataPtr blockrec ); +@@ -206,9 +212,22 @@ _fs_add_rep_log (FSFpePtr conn, fsGenericReply *rep) + rep->sequenceNumber, + conn->reqbuffer[i].opcode); + } ++ ++#define _fs_reply_failed(rep, name, op) do { \ ++ if (rep) { \ ++ if (rep->type == FS_Error) \ ++ fprintf (stderr, "Error: %d Request: %s\n", \ ++ ((fsError *)rep)->request, #name); \ ++ else \ ++ fprintf (stderr, "Bad Length for %s Reply: %d %s %d\n", \ ++ #name, rep->length, op, LENGTHOF(name)); \ ++ } \ ++} while (0) ++ + #else + #define _fs_add_req_log(conn,op) ((conn)->current_seq++) + #define _fs_add_rep_log(conn,rep) ++#define _fs_reply_failed(rep,name,op) + #endif + + static Bool +@@ -682,13 +701,15 @@ fs_read_open_font(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + int ret; + + rep = (fsOpenBitmapFontReply *) fs_get_reply (conn, &ret); +- if (!rep || rep->type == FS_Error) ++ if (!rep || rep->type == FS_Error || ++ (rep->length != LENGTHOF(fsOpenBitmapFontReply))) + { + if (ret == FSIO_BLOCK) + return StillWorking; + if (rep) + _fs_done_read (conn, rep->length << 2); + fs_cleanup_bfont (bfont); ++ _fs_reply_failed (rep, fsOpenBitmapFontReply, "!="); + return BadFontName; + } + +@@ -824,13 +845,15 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + int ret; + + rep = (fsQueryXInfoReply *) fs_get_reply (conn, &ret); +- if (!rep || rep->type == FS_Error) ++ if (!rep || rep->type == FS_Error || ++ (rep->length < LENGTHOF(fsQueryXInfoReply))) + { + if (ret == FSIO_BLOCK) + return StillWorking; + if (rep) + _fs_done_read (conn, rep->length << 2); + fs_cleanup_bfont (bfont); ++ _fs_reply_failed (rep, fsQueryXInfoReply, "<"); + return BadFontName; + } + +@@ -951,13 +974,15 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + FontInfoRec *fi = &bfont->pfont->info; + + rep = (fsQueryXExtents16Reply *) fs_get_reply (conn, &ret); +- if (!rep || rep->type == FS_Error) ++ if (!rep || rep->type == FS_Error || ++ (rep->length < LENGTHOF(fsQueryXExtents16Reply))) + { + if (ret == FSIO_BLOCK) + return StillWorking; + if (rep) + _fs_done_read (conn, rep->length << 2); + fs_cleanup_bfont (bfont); ++ _fs_reply_failed (rep, fsQueryXExtents16Reply, "<"); + return BadFontName; + } + +@@ -1823,13 +1848,15 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + unsigned long minchar, maxchar; + + rep = (fsQueryXBitmaps16Reply *) fs_get_reply (conn, &ret); +- if (!rep || rep->type == FS_Error) ++ if (!rep || rep->type == FS_Error || ++ (rep->length < LENGTHOF(fsQueryXBitmaps16Reply))) + { + if (ret == FSIO_BLOCK) + return StillWorking; + if (rep) + _fs_done_read (conn, rep->length << 2); + err = AllocError; ++ _fs_reply_failed (rep, fsQueryXBitmaps16Reply, "<"); + goto bail; + } + +@@ -2232,12 +2259,14 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + int err; + + rep = (fsListFontsReply *) fs_get_reply (conn, &ret); +- if (!rep || rep->type == FS_Error) ++ if (!rep || rep->type == FS_Error || ++ (rep->length < LENGTHOF(fsListFontsReply))) + { + if (ret == FSIO_BLOCK) + return StillWorking; + if (rep) + _fs_done_read (conn, rep->length << 2); ++ _fs_reply_failed (rep, fsListFontsReply, "<"); + return AllocError; + } + data = (char *) rep + SIZEOF (fsListFontsReply); +@@ -2356,12 +2385,15 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + _fs_free_props (&binfo->info); + + rep = (fsListFontsWithXInfoReply *) fs_get_reply (conn, &ret); +- if (!rep || rep->type == FS_Error) ++ if (!rep || rep->type == FS_Error || ++ ((rep->nameLength != 0) && ++ (rep->length < LENGTHOF(fsListFontsWithXInfoReply)))) + { + if (ret == FSIO_BLOCK) + return StillWorking; + binfo->status = FS_LFWI_FINISHED; + err = AllocError; ++ _fs_reply_failed (rep, fsListFontsWithXInfoReply, "<"); + goto done; + } + /* +-- +1.7.10 + diff --git a/main/libxfont/0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch b/main/libxfont/0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch new file mode 100644 index 0000000000..b3921f3e81 --- /dev/null +++ b/main/libxfont/0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch @@ -0,0 +1,68 @@ +From 0f1a5d372c143f91a602bdf10c917d7eabaee09b Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:02:25 -0700 +Subject: [PATCH 05/12] CVE-2014-0211: Integer overflow in + fs_get_reply/_fs_start_read + +fs_get_reply() would take any reply size, multiply it by 4 and pass to +_fs_start_read. If that size was bigger than the current reply buffer +size, _fs_start_read would add it to the existing buffer size plus the +buffer size increment constant and realloc the buffer to that result. + +This math could overflow, causing the code to allocate a smaller +buffer than the amount it was about to read into that buffer from +the network. It could also succeed, allowing the remote font server +to cause massive allocations in the X server, possibly using up all +the address space in a 32-bit X server, allowing the triggering of +other bugs in code that fails to handle malloc failure properly. + +This patch protects against both problems, by disconnecting any +font server trying to feed us more than (the somewhat arbitrary) +64 mb in a single reply. + +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fserve.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index f08028f..3abbacf 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -97,6 +97,9 @@ in this Software without prior written authorization from The Open Group. + */ + #define LENGTHOF(r) (SIZEOF(r) >> 2) + ++/* Somewhat arbitrary limit on maximum reply size we'll try to read. */ ++#define MAX_REPLY_LENGTH ((64 * 1024 * 1024) >> 2) ++ + extern void ErrorF(const char *f, ...); + + static int fs_read_glyphs ( FontPathElementPtr fpe, FSBlockDataPtr blockrec ); +@@ -619,6 +622,21 @@ fs_get_reply (FSFpePtr conn, int *error) + + rep = (fsGenericReply *) buf; + ++ /* ++ * Refuse to accept replies longer than a maximum reasonable length, ++ * before we pass to _fs_start_read, since it will try to resize the ++ * incoming connection buffer to this size. Also avoids integer overflow ++ * on 32-bit systems. ++ */ ++ if (rep->length > MAX_REPLY_LENGTH) ++ { ++ ErrorF("fserve: reply length %d > MAX_REPLY_LENGTH, disconnecting" ++ " from font server\n", rep->length); ++ _fs_connection_died (conn); ++ *error = FSIO_ERROR; ++ return 0; ++ } ++ + ret = _fs_start_read (conn, rep->length << 2, &buf); + if (ret != FSIO_READY) + { +-- +1.7.10 + diff --git a/main/libxfont/0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch b/main/libxfont/0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch new file mode 100644 index 0000000000..ecd2c3f0de --- /dev/null +++ b/main/libxfont/0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch @@ -0,0 +1,127 @@ +From 491291cabf78efdeec8f18b09e14726a9030cc8f Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:02:34 -0700 +Subject: [PATCH 06/12] CVE-2014-0210: unvalidated length fields in + fs_read_query_info() + +fs_read_query_info() parses a reply from the font server. The reply +contains embedded length fields, none of which are validated. This +can cause out of bound reads in either fs_read_query_info() or in +_fs_convert_props() which it calls to parse the fsPropInfo in the reply. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fsconvert.c | 9 +++++++++ + src/fc/fserve.c | 37 +++++++++++++++++++++++++++++++++++++ + 2 files changed, 46 insertions(+) + +diff --git a/src/fc/fsconvert.c b/src/fc/fsconvert.c +index 75b5372..dfa1317 100644 +--- a/src/fc/fsconvert.c ++++ b/src/fc/fsconvert.c +@@ -118,6 +118,10 @@ _fs_convert_props(fsPropInfo *pi, fsPropOffset *po, pointer pd, + for (i = 0; i < nprops; i++, dprop++, is_str++) + { + memcpy(&local_off, off_adr, SIZEOF(fsPropOffset)); ++ if ((local_off.name.position >= pi->data_len) || ++ (local_off.name.length > ++ (pi->data_len - local_off.name.position))) ++ goto bail; + dprop->name = MakeAtom(&pdc[local_off.name.position], + local_off.name.length, 1); + if (local_off.type != PropTypeString) { +@@ -125,10 +129,15 @@ _fs_convert_props(fsPropInfo *pi, fsPropOffset *po, pointer pd, + dprop->value = local_off.value.position; + } else { + *is_str = TRUE; ++ if ((local_off.value.position >= pi->data_len) || ++ (local_off.value.length > ++ (pi->data_len - local_off.value.position))) ++ goto bail; + dprop->value = (INT32) MakeAtom(&pdc[local_off.value.position], + local_off.value.length, 1); + if (dprop->value == BAD_RESOURCE) + { ++ bail: + free (pfi->props); + pfi->nprops = 0; + pfi->props = 0; +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index 3abbacf..ec5336e 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -854,6 +854,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + FSFpePtr conn = (FSFpePtr) fpe->private; + fsQueryXInfoReply *rep; + char *buf; ++ long bufleft; /* length of reply left to use */ + fsPropInfo *pi; + fsPropOffset *po; + pointer pd; +@@ -885,6 +886,9 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + buf = (char *) rep; + buf += SIZEOF(fsQueryXInfoReply); + ++ bufleft = rep->length << 2; ++ bufleft -= SIZEOF(fsQueryXInfoReply); ++ + /* move the data over */ + fsUnpack_XFontInfoHeader(rep, pInfo); + +@@ -892,17 +896,50 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + _fs_init_fontinfo(conn, pInfo); + + /* Compute offsets into the reply */ ++ if (bufleft < SIZEOF(fsPropInfo)) ++ { ++ ret = -1; ++#ifdef DEBUG ++ fprintf(stderr, "fsQueryXInfo: bufleft (%ld) < SIZEOF(fsPropInfo)\n", ++ bufleft); ++#endif ++ goto bail; ++ } + pi = (fsPropInfo *) buf; + buf += SIZEOF (fsPropInfo); ++ bufleft -= SIZEOF(fsPropInfo); + ++ if ((bufleft / SIZEOF(fsPropOffset)) < pi->num_offsets) ++ { ++ ret = -1; ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsQueryXInfo: bufleft (%ld) / SIZEOF(fsPropOffset) < %d\n", ++ bufleft, pi->num_offsets); ++#endif ++ goto bail; ++ } + po = (fsPropOffset *) buf; + buf += pi->num_offsets * SIZEOF(fsPropOffset); ++ bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); + ++ if (bufleft < pi->data_len) ++ { ++ ret = -1; ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", ++ bufleft, pi->data_len); ++#endif ++ goto bail; ++ } + pd = (pointer) buf; + buf += pi->data_len; ++ bufleft -= pi->data_len; + + /* convert the properties and step over the reply */ + ret = _fs_convert_props(pi, po, pd, pInfo); ++ bail: + _fs_done_read (conn, rep->length << 2); + + if (ret == -1) +-- +1.7.10 + diff --git a/main/libxfont/0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch b/main/libxfont/0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch new file mode 100644 index 0000000000..b093bd9a83 --- /dev/null +++ b/main/libxfont/0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch @@ -0,0 +1,52 @@ +From c578408c1fd4db09e4e3173f8a9e65c81cc187c1 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:02:42 -0700 +Subject: [PATCH 07/12] CVE-2014-0211: integer overflow in + fs_read_extent_info() + +fs_read_extent_info() parses a reply from the font server. +The reply contains a 32bit number of elements field which is used +to calculate a buffer length. There is an integer overflow in this +calculation which can lead to memory corruption. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fserve.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index ec5336e..96abd0e 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -70,6 +70,7 @@ in this Software without prior written authorization from The Open Group. + #include "fservestr.h" + #include + #include ++#include + + #include + #define Time_t time_t +@@ -1050,7 +1051,16 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + numInfos *= 2; + haveInk = TRUE; + } +- ci = pCI = malloc(sizeof(CharInfoRec) * numInfos); ++ if (numInfos >= (INT_MAX / sizeof(CharInfoRec))) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsQueryXExtents16: numInfos (%d) >= %ld\n", ++ numInfos, (INT_MAX / sizeof(CharInfoRec))); ++#endif ++ pCI = NULL; ++ } ++ else ++ pCI = malloc(sizeof(CharInfoRec) * numInfos); + + if (!pCI) + { +-- +1.7.10 + diff --git a/main/libxfont/0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch b/main/libxfont/0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch new file mode 100644 index 0000000000..4de103cabd --- /dev/null +++ b/main/libxfont/0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch @@ -0,0 +1,38 @@ +From a42f707f8a62973f5e8bbcd08afb10a79e9cee33 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:02:54 -0700 +Subject: [PATCH 08/12] CVE-2014-0211: integer overflow in fs_alloc_glyphs() + +fs_alloc_glyphs() is a malloc wrapper used by the font code. +It contains a classic integer overflow in the malloc() call, +which can cause memory corruption. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fsconvert.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/fc/fsconvert.c b/src/fc/fsconvert.c +index dfa1317..18b0c0d 100644 +--- a/src/fc/fsconvert.c ++++ b/src/fc/fsconvert.c +@@ -721,7 +721,12 @@ fs_alloc_glyphs (FontPtr pFont, int size) + FSGlyphPtr glyphs; + FSFontPtr fsfont = (FSFontPtr) pFont->fontPrivate; + +- glyphs = malloc (sizeof (FSGlyphRec) + size); ++ if (size < (INT_MAX - sizeof (FSGlyphRec))) ++ glyphs = malloc (sizeof (FSGlyphRec) + size); ++ else ++ glyphs = NULL; ++ if (glyphs == NULL) ++ return NULL; + glyphs->next = fsfont->glyphs; + fsfont->glyphs = glyphs; + return (pointer) (glyphs + 1); +-- +1.7.10 + diff --git a/main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch b/main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch new file mode 100644 index 0000000000..1056b61f91 --- /dev/null +++ b/main/libxfont/0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch @@ -0,0 +1,42 @@ +From a3f21421537620fc4e1f844a594a4bcd9f7e2bd8 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:03:05 -0700 +Subject: [PATCH 09/12] CVE-2014-0210: unvalidated length fields in + fs_read_extent_info() + +Looping over the extents in the reply could go past the end of the +reply buffer if the reply indicated more extents than could fit in +the specified reply length. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fserve.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index 96abd0e..232e969 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -1059,6 +1059,16 @@ fs_read_extent_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + #endif + pCI = NULL; + } ++ else if (numExtents > ((rep->length - LENGTHOF(fsQueryXExtents16Reply)) ++ / LENGTHOF(fsXCharInfo))) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsQueryXExtents16: numExtents (%d) > (%d - %d) / %d\n", ++ numExtents, rep->length, ++ LENGTHOF(fsQueryXExtents16Reply), LENGTHOF(fsXCharInfo)); ++#endif ++ pCI = NULL; ++ } + else + pCI = malloc(sizeof(CharInfoRec) * numInfos); + +-- +1.7.10 + diff --git a/main/libxfont/0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch b/main/libxfont/0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch new file mode 100644 index 0000000000..4d40c5cf54 --- /dev/null +++ b/main/libxfont/0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch @@ -0,0 +1,79 @@ +From 520683652564c2a4e42328ae23eef9bb63271565 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 25 Apr 2014 23:03:24 -0700 +Subject: [PATCH 10/12] CVE-2014-0210: unvalidated length fields in + fs_read_glyphs() + +fs_read_glyphs() parses a reply from the font server. The reply +contains embedded length fields, none of which are validated. +This can cause out of bound reads when looping over the glyph +bitmaps in the reply. + +Reported-by: Ilja Van Sprundel +Signed-off-by: Alan Coopersmith +Reviewed-by: Adam Jackson +Reviewed-by: Matthieu Herrb +--- + src/fc/fserve.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index 232e969..581bb1b 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -1907,6 +1907,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + FontInfoPtr pfi = &pfont->info; + fsQueryXBitmaps16Reply *rep; + char *buf; ++ long bufleft; /* length of reply left to use */ + fsOffset32 *ppbits; + fsOffset32 local_off; + char *off_adr; +@@ -1938,9 +1939,33 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + buf = (char *) rep; + buf += SIZEOF (fsQueryXBitmaps16Reply); + ++ bufleft = rep->length << 2; ++ bufleft -= SIZEOF (fsQueryXBitmaps16Reply); ++ ++ if ((bufleft / SIZEOF (fsOffset32)) < rep->num_chars) ++ { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsQueryXBitmaps16: num_chars (%d) > bufleft (%ld) / %d\n", ++ rep->num_chars, bufleft, SIZEOF (fsOffset32)); ++#endif ++ err = AllocError; ++ goto bail; ++ } + ppbits = (fsOffset32 *) buf; + buf += SIZEOF (fsOffset32) * (rep->num_chars); ++ bufleft -= SIZEOF (fsOffset32) * (rep->num_chars); + ++ if (bufleft < rep->nbytes) ++ { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsQueryXBitmaps16: nbytes (%d) > bufleft (%ld)\n", ++ rep->nbytes, bufleft); ++#endif ++ err = AllocError; ++ goto bail; ++ } + pbitmaps = (pointer ) buf; + + if (blockrec->type == FS_LOAD_GLYPHS) +@@ -1998,7 +2023,9 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + */ + if (NONZEROMETRICS(&fsdata->encoding[minchar].metrics)) + { +- if (local_off.length) ++ if (local_off.length && ++ (local_off.position < rep->nbytes) && ++ (local_off.length <= (rep->nbytes - local_off.position))) + { + bits = allbits; + allbits += local_off.length; +-- +1.7.10 + diff --git a/main/libxfont/0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch b/main/libxfont/0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch new file mode 100644 index 0000000000..54abe8766d --- /dev/null +++ b/main/libxfont/0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch @@ -0,0 +1,62 @@ +From 5fa73ac18474be3032ee7af9c6e29deab163ea39 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 2 May 2014 19:24:17 -0700 +Subject: [PATCH 11/12] CVE-2014-0210: unvalidated length fields in + fs_read_list() + +fs_read_list() parses a reply from the font server. The reply +contains a list of strings with embedded length fields, none of +which are validated. This can cause out of bound reads when looping +over the strings in the reply. + +Signed-off-by: Alan Coopersmith +--- + src/fc/fserve.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index 581bb1b..4dcdc04 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -2355,6 +2355,7 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + FSBlockedListPtr blist = (FSBlockedListPtr) blockrec->data; + fsListFontsReply *rep; + char *data; ++ long dataleft; /* length of reply left to use */ + int length, + i, + ret; +@@ -2372,16 +2373,30 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + return AllocError; + } + data = (char *) rep + SIZEOF (fsListFontsReply); ++ dataleft = (rep->length << 2) - SIZEOF (fsListFontsReply); + + err = Successful; + /* copy data into FontPathRecord */ + for (i = 0; i < rep->nFonts; i++) + { ++ if (dataleft < 1) ++ break; + length = *(unsigned char *)data++; ++ dataleft--; /* used length byte */ ++ if (length > dataleft) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsListFonts: name length (%d) > dataleft (%ld)\n", ++ length, dataleft); ++#endif ++ err = BadFontName; ++ break; ++ } + err = AddFontNamesName(blist->names, data, length); + if (err != Successful) + break; + data += length; ++ dataleft -= length; + } + _fs_done_read (conn, rep->length << 2); + return err; +-- +1.7.10 + diff --git a/main/libxfont/0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch b/main/libxfont/0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch new file mode 100644 index 0000000000..15971fbb41 --- /dev/null +++ b/main/libxfont/0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch @@ -0,0 +1,111 @@ +From d338f81df1e188eb16e1d6aeea7f4800f89c1218 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 2 May 2014 19:24:17 -0700 +Subject: [PATCH 12/12] CVE-2014-0210: unvalidated length fields in + fs_read_list_info() + +fs_read_list_info() parses a reply from the font server. The reply +contains a number of additional data items with embedded length or +count fields, none of which are validated. This can cause out of +bound reads when looping over these items in the reply. + +Signed-off-by: Alan Coopersmith +--- + src/fc/fserve.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 54 insertions(+) + +diff --git a/src/fc/fserve.c b/src/fc/fserve.c +index 4dcdc04..c1cf9d6 100644 +--- a/src/fc/fserve.c ++++ b/src/fc/fserve.c +@@ -2491,6 +2491,7 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + FSBlockedListInfoPtr binfo = (FSBlockedListInfoPtr) blockrec->data; + fsListFontsWithXInfoReply *rep; + char *buf; ++ long bufleft; + FSFpePtr conn = (FSFpePtr) fpe->private; + fsPropInfo *pi; + fsPropOffset *po; +@@ -2527,6 +2528,7 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + } + + buf = (char *) rep + SIZEOF (fsListFontsWithXInfoReply); ++ bufleft = (rep->length << 2) - SIZEOF (fsListFontsWithXInfoReply); + + /* + * The original FS implementation didn't match +@@ -2535,19 +2537,71 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) + */ + if (conn->fsMajorVersion <= 1) + { ++ if (rep->nameLength > bufleft) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsListFontsWithXInfo: name length (%d) > bufleft (%ld)\n", ++ (int) rep->nameLength, bufleft); ++#endif ++ err = AllocError; ++ goto done; ++ } ++ /* binfo->name is a 256 char array, rep->nameLength is a CARD8 */ + memcpy (binfo->name, buf, rep->nameLength); + buf += _fs_pad_length (rep->nameLength); ++ bufleft -= _fs_pad_length (rep->nameLength); + } + pi = (fsPropInfo *) buf; ++ if (SIZEOF (fsPropInfo) > bufleft) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsListFontsWithXInfo: PropInfo length (%d) > bufleft (%ld)\n", ++ (int) SIZEOF (fsPropInfo), bufleft); ++#endif ++ err = AllocError; ++ goto done; ++ } ++ bufleft -= SIZEOF (fsPropInfo); + buf += SIZEOF (fsPropInfo); + po = (fsPropOffset *) buf; ++ if (pi->num_offsets > (bufleft / SIZEOF (fsPropOffset))) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsListFontsWithXInfo: offset length (%d * %d) > bufleft (%ld)\n", ++ pi->num_offsets, (int) SIZEOF (fsPropOffset), bufleft); ++#endif ++ err = AllocError; ++ goto done; ++ } ++ bufleft -= pi->num_offsets * SIZEOF (fsPropOffset); + buf += pi->num_offsets * SIZEOF (fsPropOffset); + pd = (pointer) buf; ++ if (pi->data_len > bufleft) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsListFontsWithXInfo: data length (%d) > bufleft (%ld)\n", ++ pi->data_len, bufleft); ++#endif ++ err = AllocError; ++ goto done; ++ } ++ bufleft -= pi->data_len; + buf += pi->data_len; + if (conn->fsMajorVersion > 1) + { ++ if (rep->nameLength > bufleft) { ++#ifdef DEBUG ++ fprintf(stderr, ++ "fsListFontsWithXInfo: name length (%d) > bufleft (%ld)\n", ++ (int) rep->nameLength, bufleft); ++#endif ++ err = AllocError; ++ goto done; ++ } ++ /* binfo->name is a 256 char array, rep->nameLength is a CARD8 */ + memcpy (binfo->name, buf, rep->nameLength); + buf += _fs_pad_length (rep->nameLength); ++ bufleft -= _fs_pad_length (rep->nameLength); + } + + #ifdef DEBUG +-- +1.7.10 + diff --git a/main/libxfont/APKBUILD b/main/libxfont/APKBUILD index 205c733231..b5c0a41f81 100644 --- a/main/libxfont/APKBUILD +++ b/main/libxfont/APKBUILD @@ -1,7 +1,7 @@ # Maintainer: Natanael Copa pkgname=libxfont pkgver=1.4.7 -pkgrel=0 +pkgrel=1 pkgdesc="X11 font rasterisation library" url="http://xorg.freedesktop.org/" arch="all" @@ -11,20 +11,79 @@ depends= install= depends_dev="xproto fontsproto libfontenc-dev freetype-dev" makedepends="$depends_dev xtrans zlib-dev" -source="http://xorg.freedesktop.org/archive/individual/lib/libXfont-$pkgver.tar.bz2" +source="http://xorg.freedesktop.org/archive/individual/lib/libXfont-$pkgver.tar.bz2 + 0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch + 0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch + 0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch + 0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch + 0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch + 0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch + 0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch + 0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch + 0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch + 0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch + 0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch + 0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch + " + +_builddir="$srcdir"/libXfont-$pkgver +prepare() { + cd "$_builddir" + for i in $source; do + case $i in + *.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;; + esac + done +} build() { - cd "$srcdir"/libXfont-$pkgver + cd "$_builddir" ./configure --prefix=/usr --sysconfdir=/etc || return 1 make || return 1 } package() { - cd "$srcdir"/libXfont-$pkgver + cd "$_builddir" make DESTDIR="$pkgdir" install || return 1 rm "$pkgdir"/usr/lib/*.la || return 1 install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING } -md5sums="b21ee5739d5d2e5028b302fbf9fe630b libXfont-1.4.7.tar.bz2" -sha256sums="d16ea3541835d296b19cfb05d7e64fc62173d8e7eb93284402ec761b951d1543 libXfont-1.4.7.tar.bz2" -sha512sums="508e12fb5150b3a5c849b54e0ef9ece892c6c928a3dfd8e834e41c2475e5e14ce0d71dd507804abcb06349aa5e57c543791531fac3f82c54130da90c5fccdf99 libXfont-1.4.7.tar.bz2" +md5sums="b21ee5739d5d2e5028b302fbf9fe630b libXfont-1.4.7.tar.bz2 +668afc297c74ecf43181a4e74f809bb9 0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch +7937d8a986b630fe9644aaf54f5682a8 0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch +6f564f692b7e2c2be3b9c7401412ea8c 0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch +e4fd1232c4302c50713dbe50d36d4d89 0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch +cf0cb5b812e19fe51fa3fb2815809e57 0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch +01bab2b702009dbeeac8b606fddbd5f5 0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch +52837a81d1fc78e2e5b5d293f6232e40 0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch +83415b6f84483b0bc65bf240f207c8ed 0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch +105701747318cc10c53ada565789431b 0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch +0c82f29bc9ab1b979b26cc63a143a1aa 0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch +5124af8241ccfa9cf89d81d3ce03ca6d 0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch +0174e6c3785aaa619ed0525988401628 0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch" +sha256sums="d16ea3541835d296b19cfb05d7e64fc62173d8e7eb93284402ec761b951d1543 libXfont-1.4.7.tar.bz2 +93f9fa2a1a568c1d0b7180bfb33c56b5f59f3e8ab456105999903da358f1c6d3 0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch +b296e783fba96cefc762e461953df15a9f9810f7b5a5e2ef045230bdc98aa389 0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch +3a459adeca97e1c6737569dffeb172237f32a30e1ba4f5c5a71e0e568ad8508c 0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch +8a3271471f3537fef1f770968c290758f85df4eb30337df89f2b0b2484f717d3 0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch +77c6c2326d941ef883a3a637c492aad54847ca40dd274bb72ccb66a98d0b9b7b 0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch +28484e16edf30e8de3288636115227f4c3dff293291c06ca84a56b591c1faa67 0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch +3c0aa567a96560e2685313db9b0309d4f0fcd86589d558bd21d35ebfa9969196 0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch +3a029c190bca24edc3986d296a35424d4987927cbb846c7dad65d2c00966152f 0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch +11c5716b6de231269c66d3fdefd3b6e0e8806554d691d40c0b7959b7729f0434 0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch +d344e3dd1d10fea90f47e804238eb1f4a8ff0c72054d79472986114793064e3c 0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch +6d15c9adbcac3d3e699ccd6463d51fa77cea1c1786b71e2e44ad0271e6cd0f56 0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch +4e89190f900e4e50097f530182f69b97af48968460817c9348d3cf3930fda9c9 0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch" +sha512sums="508e12fb5150b3a5c849b54e0ef9ece892c6c928a3dfd8e834e41c2475e5e14ce0d71dd507804abcb06349aa5e57c543791531fac3f82c54130da90c5fccdf99 libXfont-1.4.7.tar.bz2 +a86f2ec600e469ad54e51b9ce1c6b1d0a3101608003feb27e23fc7e2260cbf37b050ac9d5db881f83642d0be5d1b2ff76015061d1d9214be52ad84cc6a5a7664 0001-CVE-2014-0209-integer-overflow-of-realloc-size-in-Fo.patch +3a04b613bc8bdc27fb64583351d26781bd174434e561b6164f3b1d12db81dfd25ffa63151f743c2815d21c2c91d5c31ff837df86901446b43a82bf0088e25fde 0002-CVE-2014-0209-integer-overflow-of-realloc-size-in-le.patch +06702b6d0a6f056f75c34712d2859f56b1befb83af44c3a097a65d89d19212ae42066162b2efc260e49b1cd69206157a29aaafba926392b5aa64b5b7e2a3fd1c 0003-CVE-2014-0210-unvalidated-length-in-_fs_recv_conn_se.patch +4e8a48685046f7a3e798c8266f2d90af2a3ae6374f32fe2a71f625d03bd76d11df9a9435a3e345ba8c3c99c9a767acdc32155861aef8ed0280c2ef2aca87e278 0004-CVE-2014-0210-unvalidated-lengths-when-reading-repli.patch +71a56adf04ffb9e1c66d83a7eb04d7975ab713e78aa874839e52669c2781a7428c7449a0c6369cce328e6f007a977f26754d0cfb9710ae891fadc09881933609 0005-CVE-2014-0211-Integer-overflow-in-fs_get_reply-_fs_s.patch +e0e7f95f37a3cae7d3aa3141cd1036dfa05d64f49e0c73c5c803ff85da41486bb3103bb219978a46515881eb9882439bd503cfa8ee046d78336194d186eca570 0006-CVE-2014-0210-unvalidated-length-fields-in-fs_read_q.patch +63bb4f3553dd8fc34ded4ccf804588a463d185477b0b6c5812d7a4a8a8c7760329901e217190433575238a46ea87fc50eb237de98a61c1f88f7379b8445bac51 0007-CVE-2014-0211-integer-overflow-in-fs_read_extent_inf.patch +6504a1a347000b2a1b289d31ef25d868745bee1ac4814caa2d18c8b3cef3c5f9ea0b0d5e87648609a52e2d19475e8f90ed689073bbd25ef5614a08a87c3f26b3 0008-CVE-2014-0211-integer-overflow-in-fs_alloc_glyphs.patch +5d25ce9617e3b01a213c6fe9710af47b74106e843e4c25288e6e0879b0a62d97483deae332df9d3bf0c2e5fd5f0cd0b0410bd1f3def7cdd9d2e519991b0148fa 0009-CVE-2014-0210-unvalidated-length-fields-in-fs_read_e.patch +18deb576f49f165d53436429002a89fe49cd4eed1a0c4bd27aed46575463496b0e0715a990543ba87c6df732af8164851388951ad595ab3c4b44b853e313d3c3 0010-CVE-2014-0210-unvalidated-length-fields-in-fs_read_g.patch +a4bb8bf7777a3d2c9ca19e2d0452d52f117b6a5d40c6d58b4792358caa3c66dd0b0e71c2034d9c70f06e0663de950a1464167dc81d5f8a0bccd18e33318743b3 0011-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch +80bcc61be9830b3d7427d9aba3eeec34c7583400c073d31fe54aff1f8b00811f9a3f8374696ca815b54bde1daf297e7b9a66a91b9aa1bed14cb48466703207d2 0012-CVE-2014-0210-unvalidated-length-fields-in-fs_read_l.patch" -- cgit v1.2.3