diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2013-05-24 07:02:18 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2013-05-24 07:03:29 +0000 |
| commit | 682ed1fa3f5d7338fff3b497e1b95d45b2481e79 (patch) | |
| tree | 91c28d39de74fdfc413ec352b9fa4591fd95aeeb /main/libxcb | |
| parent | e70ea58e626c1bdf300f7499d1db0d7bb9d58530 (diff) | |
| download | aports-682ed1fa3f5d7338fff3b497e1b95d45b2481e79.tar.bz2 aports-682ed1fa3f5d7338fff3b497e1b95d45b2481e79.tar.xz | |
main/libxcb: security fix (CVE-2013-2064)
ref #1931
Diffstat (limited to 'main/libxcb')
| -rw-r--r-- | main/libxcb/APKBUILD | 22 | ||||
| -rw-r--r-- | main/libxcb/CVE-2013-2064.patch | 44 |
2 files changed, 63 insertions, 3 deletions
diff --git a/main/libxcb/APKBUILD b/main/libxcb/APKBUILD index 2643c73de1..3ef9e93890 100644 --- a/main/libxcb/APKBUILD +++ b/main/libxcb/APKBUILD @@ -11,10 +11,21 @@ subpackages="$pkgname-dev $pkgname-doc" depends_dev="libpthread-stubs libxau-dev libxdmcp-dev xcb-proto" makedepends="$depends_dev libxslt python" source="http://xcb.freedesktop.org/dist/$pkgname-$pkgver.tar.bz2 + CVE-2013-2064.patch " +_builddir="$srcdir"/$pkgname-$pkgver +prepare() { + cd "$_builddir" + for i in $source; do + case $i in + *.patch) msg $i; patch -p1 -i "$srcdir"/$i || return 1;; + esac + done +} + build() { - cd "$srcdir"/$pkgname-$pkgver + cd "$_builddir" ./configure --prefix=/usr \ --enable-xkb \ --enable-xinput \ @@ -24,9 +35,14 @@ build() { } package() { - cd "$srcdir"/$pkgname-$pkgver + cd "$_builddir" make DESTDIR="$pkgdir" install || return 1 rm "$pkgdir"/usr/lib/*.la || return 1 install -Dm644 COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING } -md5sums="2b05856e9d1cb37836aae7406f2f4ce2 libxcb-1.9.tar.bz2" +md5sums="2b05856e9d1cb37836aae7406f2f4ce2 libxcb-1.9.tar.bz2 +343285a0a015ef099e33fe8fb9615760 CVE-2013-2064.patch" +sha256sums="8857e62b3aae2976c7e10043643e45a85964fd1dcb4469dfde0d04d3d1b12c96 libxcb-1.9.tar.bz2 +83ca3f8b02799468822a5e2fbe559a43cb57c03f450ccd58f59ce7a054b859c3 CVE-2013-2064.patch" +sha512sums="799f68b21df296e1e03cb5b5bfa065764c08652a4fd47e4b3ebc9d217f2f9fefabbae28b8ffacadab57917189616e09821e6ef6dcd1ffc24f5d82541997fdfb0 libxcb-1.9.tar.bz2 +31d5a1486d57970bdf0b0ffd8345c416e6a7a0e1cc2f93ab63fa0aea3d31b2d061bb8cf5f778aa88c59863d5e551d0a9558c2b05b9e5abcf3818e839c5f9421f CVE-2013-2064.patch" diff --git a/main/libxcb/CVE-2013-2064.patch b/main/libxcb/CVE-2013-2064.patch new file mode 100644 index 0000000000..32fc268156 --- /dev/null +++ b/main/libxcb/CVE-2013-2064.patch @@ -0,0 +1,44 @@ +From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith <alan.coopersmith@oracle.com> +Date: Thu, 02 May 2013 00:59:31 +0000 +Subject: integer overflow in read_packet() [CVE-2013-2064] + +Ensure that when calculating the size of the incoming response from the +Xserver, we don't overflow the integer used in the calculations when we +multiply the int32_t length by 4 and add it to the default response size. + +Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> +--- +diff --git a/src/xcb_in.c b/src/xcb_in.c +index b810783..8a7af92 100644 +--- a/src/xcb_in.c ++++ b/src/xcb_in.c +@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete + static int read_packet(xcb_connection_t *c) + { + xcb_generic_reply_t genrep; +- int length = 32; +- int eventlength = 0; /* length after first 32 bytes for GenericEvents */ ++ uint64_t length = 32; ++ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */ ++ uint64_t bufsize; + void *buf; + pending_reply *pend = 0; + struct event_list *event; +@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c) + if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT) + eventlength = genrep.length * 4; + +- buf = malloc(length + eventlength + +- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t))); ++ bufsize = length + eventlength + ++ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)); ++ if (bufsize < INT32_MAX) ++ buf = malloc((size_t) bufsize); ++ else ++ buf = NULL; + if(!buf) + { + _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT); +-- +cgit v0.9.0.2-2-gbebe |