diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2013-05-24 09:35:12 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2013-05-24 09:35:12 +0000 |
| commit | dfac4cbecc1c27d53504a0d9a80019146c9c9bfb (patch) | |
| tree | 945b47f0220d364a49d091c098baeeb874db2226 /main/libxvmc/0006-Multiple-unvalidated-patches-in-CVE-2013-1999.patch | |
| parent | a04d1c8ff925273f3caf3a46393cf73ac2b96ab5 (diff) | |
| download | aports-dfac4cbecc1c27d53504a0d9a80019146c9c9bfb.tar.bz2 aports-dfac4cbecc1c27d53504a0d9a80019146c9c9bfb.tar.xz | |
main/libxvmc: fix CVE-2013-1990,CVE-2013-1999
ref #1931
Diffstat (limited to 'main/libxvmc/0006-Multiple-unvalidated-patches-in-CVE-2013-1999.patch')
| -rw-r--r-- | main/libxvmc/0006-Multiple-unvalidated-patches-in-CVE-2013-1999.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/main/libxvmc/0006-Multiple-unvalidated-patches-in-CVE-2013-1999.patch b/main/libxvmc/0006-Multiple-unvalidated-patches-in-CVE-2013-1999.patch new file mode 100644 index 0000000000..725c99339d --- /dev/null +++ b/main/libxvmc/0006-Multiple-unvalidated-patches-in-CVE-2013-1999.patch @@ -0,0 +1,39 @@ +From 8c164524d229adb6141fdac8336b3823e7fe1a5d Mon Sep 17 00:00:00 2001 +From: Dave Airlie <airlied@redhat.com> +Date: Fri, 24 May 2013 14:47:30 +1000 +Subject: [PATCH 6/6] Multiple unvalidated patches in CVE-2013-1999 + +Al Viro pointed out that Debian started segfaulting in Xine for him, + +Reported-by: Al Viro +Signed-off-by: Dave Airlie <airlied@redhat.com> +--- + src/XvMC.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/XvMC.c b/src/XvMC.c +index cb42487..74c8b85 100644 +--- a/src/XvMC.c ++++ b/src/XvMC.c +@@ -585,15 +585,15 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, + if (*name && *busID && tmpBuf) { + _XRead(dpy, tmpBuf, realSize); + strncpy(*name,tmpBuf,rep.nameLen); +- name[rep.nameLen - 1] = '\0'; ++ (*name)[rep.nameLen - 1] = '\0'; + strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); +- busID[rep.busIDLen - 1] = '\0'; ++ (*busID)[rep.busIDLen - 1] = '\0'; + XFree(tmpBuf); + } else { + XFree(*name); + *name = NULL; + XFree(*busID); +- *name = NULL; ++ *busID = NULL; + XFree(tmpBuf); + + _XEatDataWords(dpy, rep.length); +-- +1.8.2.3 + |