Fix integer overflow in read_packet (CVE-2013-2064)

0001-integer-overflow-in-read_packet-CVE-2013-2064.patch

@@ -0,0 +1,48 @@
+From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Wed, 1 May 2013 17:59:31 -0700
+Subject: [PATCH] integer overflow in read_packet() [CVE-2013-2064]
+
+Ensure that when calculating the size of the incoming response from the
+Xserver, we don't overflow the integer used in the calculations when we
+multiply the int32_t length by 4 and add it to the default response size.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/xcb_in.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/xcb_in.c b/src/xcb_in.c
+index b810783..8a7af92 100644
+--- a/src/xcb_in.c
++++ b/src/xcb_in.c
+@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
+ static int read_packet(xcb_connection_t *c)
+ {
+     xcb_generic_reply_t genrep;
+-    int length = 32;
+-    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
++    uint64_t length = 32;
++    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
++    uint64_t bufsize;
+     void *buf;
+     pending_reply *pend = 0;
+     struct event_list *event;
+@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
+     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
+         eventlength = genrep.length * 4;
+ 
+-    buf = malloc(length + eventlength +
+-            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
++    bufsize = length + eventlength +
++        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
++    if (bufsize < INT32_MAX)
++        buf = malloc((size_t) bufsize);
++    else
++        buf = NULL;
+     if(!buf)
+     {
+         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
+-- 
+1.8.1.4
+

libxcb.spec

@@ -1,6 +1,6 @@
 Name:           libxcb
 Version:        1.9
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A C binding to the X11 protocol
 
 Group:          System Environment/Libraries
@@ -14,6 +14,8 @@ BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 # the pkgconfig file so libs that link against libxcb know this...
 Source1:	pthread-stubs.pc.in
 
+Patch01:        0001-integer-overflow-in-read_packet-CVE-2013-2064.patch
+
 BuildRequires:  autoconf automake libtool pkgconfig
 BuildRequires:  doxygen
 BuildRequires:  graphviz
@@ -48,6 +50,7 @@ The %{name}-doc package contains documentation for the %{name} library.
 
 %prep
 %setup -q 
+%patch01 -p1
 
 %build
 sed -i 's/pthread-stubs //' configure.ac
@@ -108,6 +111,9 @@ rm -rf $RPM_BUILD_ROOT
 %{_datadir}/doc/%{name}-%{version}
 
 %changelog
+* Fri May 24 2013 Peter Hutterer <peter.hutterer@redhat.com> 1.9-3
+- Fix integer overflow in read_packet (CVE-2013-2064)
+
 * Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.9-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild