today's git snapshot. features DRI2 and input hotplug.
note this will throw one avc every ten seconds until selinux policy is fixed.
This commit is contained in:
Adam Jackson
parent
70fbb3a98f
commit
becf1b4797
@ -1 +1 @@
|
|||||||
xorg-server-20080107.tar.bz2
|
xorg-server-20080215.tar.bz2
|
||||||
|
|||||||
2
commitid
2
commitid
@ -1 +1 @@
|
|||||||
260505e3c5a18044e97d31ea3bcc0955e46335c8
|
0ffb6a3ad010e80fe8f973fc228d549f9dd3effd
|
||||||
|
|||||||
@ -1,27 +0,0 @@
|
|||||||
From bbde5b62a137ba726a747b838d81e92d72c1b42b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
|
|
||||||
Date: Thu, 17 Jan 2008 15:26:41 +0100
|
|
||||||
Subject: [PATCH] Fix for CVE-2007-5760 - XFree86 Misc extension out of bounds array index
|
|
||||||
|
|
||||||
---
|
|
||||||
hw/xfree86/common/xf86MiscExt.c | 4 ++++
|
|
||||||
1 files changed, 4 insertions(+), 0 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/hw/xfree86/common/xf86MiscExt.c b/hw/xfree86/common/xf86MiscExt.c
|
|
||||||
index c1b9c60..40c196a 100644
|
|
||||||
--- a/hw/xfree86/common/xf86MiscExt.c
|
|
||||||
+++ b/hw/xfree86/common/xf86MiscExt.c
|
|
||||||
@@ -548,6 +548,10 @@ MiscExtPassMessage(int scrnIndex, const char *msgtype, const char *msgval,
|
|
||||||
{
|
|
||||||
ScrnInfoPtr pScr = xf86Screens[scrnIndex];
|
|
||||||
|
|
||||||
+ /* should check this in the protocol, but xf86NumScreens isn't exported */
|
|
||||||
+ if (scrnIndex >= xf86NumScreens)
|
|
||||||
+ return BadValue;
|
|
||||||
+
|
|
||||||
if (*pScr->HandleMessage == NULL)
|
|
||||||
return BadImplementation;
|
|
||||||
return (*pScr->HandleMessage)(scrnIndex, msgtype, msgval, retstr);
|
|
||||||
--
|
|
||||||
1.5.3.6
|
|
||||||
|
|
||||||
@ -1,263 +0,0 @@
|
|||||||
From dd5e0f5cd5f3a87fee86d99c073ffa7cf89b0a27 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
|
|
||||||
Date: Thu, 17 Jan 2008 15:27:34 +0100
|
|
||||||
Subject: [PATCH] Fix for CVE-2007-6427 - Xinput extension memory corruption.
|
|
||||||
|
|
||||||
---
|
|
||||||
Xi/chgfctl.c | 7 +------
|
|
||||||
Xi/chgkmap.c | 14 +++++++-------
|
|
||||||
Xi/chgprop.c | 10 +++-------
|
|
||||||
Xi/grabdev.c | 12 +++++-------
|
|
||||||
Xi/grabdevb.c | 10 +++-------
|
|
||||||
Xi/grabdevk.c | 9 ++-------
|
|
||||||
Xi/selectev.c | 11 ++++-------
|
|
||||||
Xi/sendexev.c | 14 ++++++++------
|
|
||||||
8 files changed, 33 insertions(+), 54 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/Xi/chgfctl.c b/Xi/chgfctl.c
|
|
||||||
index 8fc24d5..696b74a 100644
|
|
||||||
--- a/Xi/chgfctl.c
|
|
||||||
+++ b/Xi/chgfctl.c
|
|
||||||
@@ -302,18 +302,13 @@ ChangeStringFeedback(ClientPtr client, DeviceIntPtr dev,
|
|
||||||
xStringFeedbackCtl * f)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
int i, j;
|
|
||||||
KeySym *syms, *sup_syms;
|
|
||||||
|
|
||||||
syms = (KeySym *) (f + 1);
|
|
||||||
if (client->swapped) {
|
|
||||||
swaps(&f->length, n); /* swapped num_keysyms in calling proc */
|
|
||||||
- p = (long *)(syms);
|
|
||||||
- for (i = 0; i < f->num_keysyms; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ SwapLongs((CARD32 *) syms, f->num_keysyms);
|
|
||||||
}
|
|
||||||
|
|
||||||
if (f->num_keysyms > s->ctrl.max_symbols)
|
|
||||||
diff --git a/Xi/chgkmap.c b/Xi/chgkmap.c
|
|
||||||
index 3361e98..df334c1 100644
|
|
||||||
--- a/Xi/chgkmap.c
|
|
||||||
+++ b/Xi/chgkmap.c
|
|
||||||
@@ -75,18 +75,14 @@ int
|
|
||||||
SProcXChangeDeviceKeyMapping(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
- int i, count;
|
|
||||||
+ unsigned int count;
|
|
||||||
|
|
||||||
REQUEST(xChangeDeviceKeyMappingReq);
|
|
||||||
swaps(&stuff->length, n);
|
|
||||||
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
|
|
||||||
- p = (long *)&stuff[1];
|
|
||||||
count = stuff->keyCodes * stuff->keySymsPerKeyCode;
|
|
||||||
- for (i = 0; i < count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
|
|
||||||
+ SwapLongs((CARD32 *) (&stuff[1]), count);
|
|
||||||
return (ProcXChangeDeviceKeyMapping(client));
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -102,10 +98,14 @@ ProcXChangeDeviceKeyMapping(ClientPtr client)
|
|
||||||
int ret;
|
|
||||||
unsigned len;
|
|
||||||
DeviceIntPtr dev;
|
|
||||||
+ unsigned int count;
|
|
||||||
|
|
||||||
REQUEST(xChangeDeviceKeyMappingReq);
|
|
||||||
REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);
|
|
||||||
|
|
||||||
+ count = stuff->keyCodes * stuff->keySymsPerKeyCode;
|
|
||||||
+ REQUEST_FIXED_SIZE(xChangeDeviceKeyMappingReq, count * sizeof(CARD32));
|
|
||||||
+
|
|
||||||
ret = dixLookupDevice(&dev, stuff->deviceid, client, DixSetAttrAccess);
|
|
||||||
if (ret != Success)
|
|
||||||
return ret;
|
|
||||||
diff --git a/Xi/chgprop.c b/Xi/chgprop.c
|
|
||||||
index 58db886..3fb33e1 100644
|
|
||||||
--- a/Xi/chgprop.c
|
|
||||||
+++ b/Xi/chgprop.c
|
|
||||||
@@ -77,19 +77,15 @@ int
|
|
||||||
SProcXChangeDeviceDontPropagateList(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
- int i;
|
|
||||||
|
|
||||||
REQUEST(xChangeDeviceDontPropagateListReq);
|
|
||||||
swaps(&stuff->length, n);
|
|
||||||
REQUEST_AT_LEAST_SIZE(xChangeDeviceDontPropagateListReq);
|
|
||||||
swapl(&stuff->window, n);
|
|
||||||
swaps(&stuff->count, n);
|
|
||||||
- p = (long *)&stuff[1];
|
|
||||||
- for (i = 0; i < stuff->count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ REQUEST_FIXED_SIZE(xChangeDeviceDontPropagateListReq,
|
|
||||||
+ stuff->count * sizeof(CARD32));
|
|
||||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
|
|
||||||
return (ProcXChangeDeviceDontPropagateList(client));
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/Xi/grabdev.c b/Xi/grabdev.c
|
|
||||||
index 110fc6b..0671e0e 100644
|
|
||||||
--- a/Xi/grabdev.c
|
|
||||||
+++ b/Xi/grabdev.c
|
|
||||||
@@ -78,8 +78,6 @@ int
|
|
||||||
SProcXGrabDevice(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
- int i;
|
|
||||||
|
|
||||||
REQUEST(xGrabDeviceReq);
|
|
||||||
swaps(&stuff->length, n);
|
|
||||||
@@ -87,11 +85,11 @@ SProcXGrabDevice(ClientPtr client)
|
|
||||||
swapl(&stuff->grabWindow, n);
|
|
||||||
swapl(&stuff->time, n);
|
|
||||||
swaps(&stuff->event_count, n);
|
|
||||||
- p = (long *)&stuff[1];
|
|
||||||
- for (i = 0; i < stuff->event_count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+
|
|
||||||
+ if (stuff->length != (sizeof(xGrabDeviceReq) >> 2) + stuff->event_count)
|
|
||||||
+ return BadLength;
|
|
||||||
+
|
|
||||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
|
|
||||||
|
|
||||||
return (ProcXGrabDevice(client));
|
|
||||||
}
|
|
||||||
diff --git a/Xi/grabdevb.c b/Xi/grabdevb.c
|
|
||||||
index c2661e8..ce0dcc5 100644
|
|
||||||
--- a/Xi/grabdevb.c
|
|
||||||
+++ b/Xi/grabdevb.c
|
|
||||||
@@ -77,8 +77,6 @@ int
|
|
||||||
SProcXGrabDeviceButton(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
- int i;
|
|
||||||
|
|
||||||
REQUEST(xGrabDeviceButtonReq);
|
|
||||||
swaps(&stuff->length, n);
|
|
||||||
@@ -86,11 +84,9 @@ SProcXGrabDeviceButton(ClientPtr client)
|
|
||||||
swapl(&stuff->grabWindow, n);
|
|
||||||
swaps(&stuff->modifiers, n);
|
|
||||||
swaps(&stuff->event_count, n);
|
|
||||||
- p = (long *)&stuff[1];
|
|
||||||
- for (i = 0; i < stuff->event_count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ REQUEST_FIXED_SIZE(xGrabDeviceButtonReq,
|
|
||||||
+ stuff->event_count * sizeof(CARD32));
|
|
||||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
|
|
||||||
|
|
||||||
return (ProcXGrabDeviceButton(client));
|
|
||||||
}
|
|
||||||
diff --git a/Xi/grabdevk.c b/Xi/grabdevk.c
|
|
||||||
index 43b1928..d4b7fe8 100644
|
|
||||||
--- a/Xi/grabdevk.c
|
|
||||||
+++ b/Xi/grabdevk.c
|
|
||||||
@@ -77,8 +77,6 @@ int
|
|
||||||
SProcXGrabDeviceKey(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
- int i;
|
|
||||||
|
|
||||||
REQUEST(xGrabDeviceKeyReq);
|
|
||||||
swaps(&stuff->length, n);
|
|
||||||
@@ -86,11 +84,8 @@ SProcXGrabDeviceKey(ClientPtr client)
|
|
||||||
swapl(&stuff->grabWindow, n);
|
|
||||||
swaps(&stuff->modifiers, n);
|
|
||||||
swaps(&stuff->event_count, n);
|
|
||||||
- p = (long *)&stuff[1];
|
|
||||||
- for (i = 0; i < stuff->event_count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ REQUEST_FIXED_SIZE(xGrabDeviceKeyReq, stuff->event_count * sizeof(CARD32));
|
|
||||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->event_count);
|
|
||||||
return (ProcXGrabDeviceKey(client));
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/Xi/selectev.c b/Xi/selectev.c
|
|
||||||
index b93618a..d3670ab 100644
|
|
||||||
--- a/Xi/selectev.c
|
|
||||||
+++ b/Xi/selectev.c
|
|
||||||
@@ -127,19 +127,16 @@ int
|
|
||||||
SProcXSelectExtensionEvent(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
- int i;
|
|
||||||
|
|
||||||
REQUEST(xSelectExtensionEventReq);
|
|
||||||
swaps(&stuff->length, n);
|
|
||||||
REQUEST_AT_LEAST_SIZE(xSelectExtensionEventReq);
|
|
||||||
swapl(&stuff->window, n);
|
|
||||||
swaps(&stuff->count, n);
|
|
||||||
- p = (long *)&stuff[1];
|
|
||||||
- for (i = 0; i < stuff->count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ REQUEST_FIXED_SIZE(xSelectExtensionEventReq,
|
|
||||||
+ stuff->count * sizeof(CARD32));
|
|
||||||
+ SwapLongs((CARD32 *) (&stuff[1]), stuff->count);
|
|
||||||
+
|
|
||||||
return (ProcXSelectExtensionEvent(client));
|
|
||||||
}
|
|
||||||
|
|
||||||
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
||||||
index e4e38d7..588c910 100644
|
|
||||||
--- a/Xi/sendexev.c
|
|
||||||
+++ b/Xi/sendexev.c
|
|
||||||
@@ -80,7 +80,7 @@ int
|
|
||||||
SProcXSendExtensionEvent(ClientPtr client)
|
|
||||||
{
|
|
||||||
char n;
|
|
||||||
- long *p;
|
|
||||||
+ CARD32 *p;
|
|
||||||
int i;
|
|
||||||
xEvent eventT;
|
|
||||||
xEvent *eventP;
|
|
||||||
@@ -91,6 +91,11 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
||||||
REQUEST_AT_LEAST_SIZE(xSendExtensionEventReq);
|
|
||||||
swapl(&stuff->destination, n);
|
|
||||||
swaps(&stuff->count, n);
|
|
||||||
+
|
|
||||||
+ if (stuff->length != (sizeof(xSendExtensionEventReq) >> 2) + stuff->count +
|
|
||||||
+ (stuff->num_events * (sizeof(xEvent) >> 2)))
|
|
||||||
+ return BadLength;
|
|
||||||
+
|
|
||||||
eventP = (xEvent *) & stuff[1];
|
|
||||||
for (i = 0; i < stuff->num_events; i++, eventP++) {
|
|
||||||
proc = EventSwapVector[eventP->u.u.type & 0177];
|
|
||||||
@@ -100,11 +105,8 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
||||||
*eventP = eventT;
|
|
||||||
}
|
|
||||||
|
|
||||||
- p = (long *)(((xEvent *) & stuff[1]) + stuff->num_events);
|
|
||||||
- for (i = 0; i < stuff->count; i++) {
|
|
||||||
- swapl(p, n);
|
|
||||||
- p++;
|
|
||||||
- }
|
|
||||||
+ p = (CARD32 *)(((xEvent *) & stuff[1]) + stuff->num_events);
|
|
||||||
+ SwapLongs(p, stuff->count);
|
|
||||||
return (ProcXSendExtensionEvent(client));
|
|
||||||
}
|
|
||||||
|
|
||||||
--
|
|
||||||
1.5.3.6
|
|
||||||
|
|
||||||
@ -1,26 +0,0 @@
|
|||||||
From 7dc1717ff0f96b99271a912b8948dfce5164d5ad Mon Sep 17 00:00:00 2001
|
|
||||||
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
|
|
||||||
Date: Thu, 17 Jan 2008 15:28:03 +0100
|
|
||||||
Subject: [PATCH] Fix for CVE-2007-6428 - TOG-cup extension memory corruption.
|
|
||||||
|
|
||||||
---
|
|
||||||
Xext/cup.c | 3 +++
|
|
||||||
1 files changed, 3 insertions(+), 0 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/Xext/cup.c b/Xext/cup.c
|
|
||||||
index d0e820c..fd1409e 100644
|
|
||||||
--- a/Xext/cup.c
|
|
||||||
+++ b/Xext/cup.c
|
|
||||||
@@ -176,6 +176,9 @@ int ProcGetReservedColormapEntries(
|
|
||||||
|
|
||||||
REQUEST_SIZE_MATCH (xXcupGetReservedColormapEntriesReq);
|
|
||||||
|
|
||||||
+ if (stuff->screen >= screenInfo.numScreens)
|
|
||||||
+ return BadValue;
|
|
||||||
+
|
|
||||||
#ifndef HAVE_SPECIAL_DESKTOP_COLORS
|
|
||||||
citems[CUP_BLACK_PIXEL].pixel =
|
|
||||||
screenInfo.screens[stuff->screen]->blackPixel;
|
|
||||||
--
|
|
||||||
1.5.3.6
|
|
||||||
|
|
||||||
@ -1,218 +0,0 @@
|
|||||||
From 6970d8c3c8b96b294159b4029c1428813568e20b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Dave Airlie <airlied@redhat.com>
|
|
||||||
Date: Sat, 19 Jan 2008 06:37:58 +1000
|
|
||||||
Subject: [PATCH] CVE-2007-6429: EVI and MIT-SHM Vunerability updated patch
|
|
||||||
|
|
||||||
---
|
|
||||||
Xext/EVI.c | 15 ++++++++++++++-
|
|
||||||
Xext/sampleEVI.c | 29 ++++++++++++++++++++++++-----
|
|
||||||
Xext/shm.c | 52 ++++++++++++++++++++++++++++++++++++++++++++--------
|
|
||||||
3 files changed, 82 insertions(+), 14 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/Xext/EVI.c b/Xext/EVI.c
|
|
||||||
index 4bd050c..a637bae 100644
|
|
||||||
--- a/Xext/EVI.c
|
|
||||||
+++ b/Xext/EVI.c
|
|
||||||
@@ -34,6 +34,7 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
||||||
#include <X11/extensions/XEVIstr.h>
|
|
||||||
#include "EVIstruct.h"
|
|
||||||
#include "modinit.h"
|
|
||||||
+#include "scrnintstr.h"
|
|
||||||
|
|
||||||
static EviPrivPtr eviPriv;
|
|
||||||
|
|
||||||
@@ -84,10 +85,22 @@ ProcEVIGetVisualInfo(ClientPtr client)
|
|
||||||
{
|
|
||||||
REQUEST(xEVIGetVisualInfoReq);
|
|
||||||
xEVIGetVisualInfoReply rep;
|
|
||||||
- int n, n_conflict, n_info, sz_info, sz_conflict;
|
|
||||||
+ int i, n, n_conflict, n_info, sz_info, sz_conflict;
|
|
||||||
VisualID32 *conflict;
|
|
||||||
+ unsigned int total_visuals = 0;
|
|
||||||
xExtendedVisualInfo *eviInfo;
|
|
||||||
int status;
|
|
||||||
+
|
|
||||||
+ /*
|
|
||||||
+ * do this first, otherwise REQUEST_FIXED_SIZE can overflow. we assume
|
|
||||||
+ * here that you don't have more than 2^32 visuals over all your screens;
|
|
||||||
+ * this seems like a safe assumption.
|
|
||||||
+ */
|
|
||||||
+ for (i = 0; i < screenInfo.numScreens; i++)
|
|
||||||
+ total_visuals += screenInfo.screens[i]->numVisuals;
|
|
||||||
+ if (stuff->n_visual > total_visuals)
|
|
||||||
+ return BadValue;
|
|
||||||
+
|
|
||||||
REQUEST_FIXED_SIZE(xEVIGetVisualInfoReq, stuff->n_visual * sz_VisualID32);
|
|
||||||
status = eviPriv->getVisualInfo((VisualID32 *)&stuff[1], (int)stuff->n_visual,
|
|
||||||
&eviInfo, &n_info, &conflict, &n_conflict);
|
|
||||||
diff --git a/Xext/sampleEVI.c b/Xext/sampleEVI.c
|
|
||||||
index 7508aa7..b8f39c7 100644
|
|
||||||
--- a/Xext/sampleEVI.c
|
|
||||||
+++ b/Xext/sampleEVI.c
|
|
||||||
@@ -34,6 +34,13 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
||||||
#include <X11/extensions/XEVIstr.h>
|
|
||||||
#include "EVIstruct.h"
|
|
||||||
#include "scrnintstr.h"
|
|
||||||
+
|
|
||||||
+#if HAVE_STDINT_H
|
|
||||||
+#include <stdint.h>
|
|
||||||
+#elif !defined(INT_MAX)
|
|
||||||
+#define INT_MAX 0x7fffffff
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
static int sampleGetVisualInfo(
|
|
||||||
VisualID32 *visual,
|
|
||||||
int n_visual,
|
|
||||||
@@ -42,24 +49,36 @@ static int sampleGetVisualInfo(
|
|
||||||
VisualID32 **conflict_rn,
|
|
||||||
int *n_conflict_rn)
|
|
||||||
{
|
|
||||||
- int max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
|
|
||||||
+ unsigned int max_sz_evi;
|
|
||||||
VisualID32 *temp_conflict;
|
|
||||||
xExtendedVisualInfo *evi;
|
|
||||||
- int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
|
|
||||||
+ unsigned int max_visuals = 0, max_sz_conflict, sz_conflict = 0;
|
|
||||||
register int visualI, scrI, sz_evi = 0, conflictI, n_conflict;
|
|
||||||
- *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
|
|
||||||
- if (!*evi_rn)
|
|
||||||
- return BadAlloc;
|
|
||||||
+
|
|
||||||
+ if (n_visual > UINT32_MAX/(sz_xExtendedVisualInfo * screenInfo.numScreens))
|
|
||||||
+ return BadAlloc;
|
|
||||||
+ max_sz_evi = n_visual * sz_xExtendedVisualInfo * screenInfo.numScreens;
|
|
||||||
+
|
|
||||||
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
|
|
||||||
if (screenInfo.screens[scrI]->numVisuals > max_visuals)
|
|
||||||
max_visuals = screenInfo.screens[scrI]->numVisuals;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+ if (n_visual > UINT32_MAX/(sz_VisualID32 * screenInfo.numScreens
|
|
||||||
+ * max_visuals))
|
|
||||||
+ return BadAlloc;
|
|
||||||
max_sz_conflict = n_visual * sz_VisualID32 * screenInfo.numScreens * max_visuals;
|
|
||||||
+
|
|
||||||
+ *evi_rn = evi = (xExtendedVisualInfo *)xalloc(max_sz_evi);
|
|
||||||
+ if (!*evi_rn)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+
|
|
||||||
temp_conflict = (VisualID32 *)xalloc(max_sz_conflict);
|
|
||||||
if (!temp_conflict) {
|
|
||||||
xfree(*evi_rn);
|
|
||||||
return BadAlloc;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
for (scrI = 0; scrI < screenInfo.numScreens; scrI++) {
|
|
||||||
for (visualI = 0; visualI < n_visual; visualI++) {
|
|
||||||
evi[sz_evi].core_visual_id = visual[visualI];
|
|
||||||
diff --git a/Xext/shm.c b/Xext/shm.c
|
|
||||||
index e3d7a23..0f7a7eb 100644
|
|
||||||
--- a/Xext/shm.c
|
|
||||||
+++ b/Xext/shm.c
|
|
||||||
@@ -757,6 +757,8 @@ ProcPanoramiXShmCreatePixmap(
|
|
||||||
int i, j, result, rc;
|
|
||||||
ShmDescPtr shmdesc;
|
|
||||||
REQUEST(xShmCreatePixmapReq);
|
|
||||||
+ unsigned int width, height, depth;
|
|
||||||
+ unsigned long size;
|
|
||||||
PanoramiXRes *newPix;
|
|
||||||
|
|
||||||
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
|
|
||||||
@@ -770,11 +772,18 @@ ProcPanoramiXShmCreatePixmap(
|
|
||||||
return rc;
|
|
||||||
|
|
||||||
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
|
|
||||||
- if (!stuff->width || !stuff->height)
|
|
||||||
+
|
|
||||||
+ width = stuff->width;
|
|
||||||
+ height = stuff->height;
|
|
||||||
+ depth = stuff->depth;
|
|
||||||
+ if (!width || !height || !depth)
|
|
||||||
{
|
|
||||||
client->errorValue = 0;
|
|
||||||
return BadValue;
|
|
||||||
}
|
|
||||||
+ if (width > 32767 || height > 32767)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+
|
|
||||||
if (stuff->depth != 1)
|
|
||||||
{
|
|
||||||
pDepth = pDraw->pScreen->allowedDepths;
|
|
||||||
@@ -784,10 +793,19 @@ ProcPanoramiXShmCreatePixmap(
|
|
||||||
client->errorValue = stuff->depth;
|
|
||||||
return BadValue;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
CreatePmap:
|
|
||||||
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
|
|
||||||
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
|
|
||||||
- client);
|
|
||||||
+ /* now w/h/d are valid; but will they overflow a 32-bit pointer? */
|
|
||||||
+ size = PixmapBytePad(width, depth) * height;
|
|
||||||
+ if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {
|
|
||||||
+ if (size < width * height)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+ /* thankfully, offset is unsigned */
|
|
||||||
+ if (stuff->offset + size < size)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
|
|
||||||
|
|
||||||
if(!(newPix = (PanoramiXRes *) xalloc(sizeof(PanoramiXRes))))
|
|
||||||
return BadAlloc;
|
|
||||||
@@ -1086,6 +1104,8 @@ ProcShmCreatePixmap(client)
|
|
||||||
register int i, rc;
|
|
||||||
ShmDescPtr shmdesc;
|
|
||||||
REQUEST(xShmCreatePixmapReq);
|
|
||||||
+ unsigned int width, height, depth;
|
|
||||||
+ unsigned long size;
|
|
||||||
|
|
||||||
REQUEST_SIZE_MATCH(xShmCreatePixmapReq);
|
|
||||||
client->errorValue = stuff->pid;
|
|
||||||
@@ -1098,11 +1118,18 @@ ProcShmCreatePixmap(client)
|
|
||||||
return rc;
|
|
||||||
|
|
||||||
VERIFY_SHMPTR(stuff->shmseg, stuff->offset, TRUE, shmdesc, client);
|
|
||||||
- if (!stuff->width || !stuff->height)
|
|
||||||
+
|
|
||||||
+ width = stuff->width;
|
|
||||||
+ height = stuff->height;
|
|
||||||
+ depth = stuff->depth;
|
|
||||||
+ if (!width || !height || !depth)
|
|
||||||
{
|
|
||||||
client->errorValue = 0;
|
|
||||||
return BadValue;
|
|
||||||
}
|
|
||||||
+ if (width > 32767 || height > 32767)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+
|
|
||||||
if (stuff->depth != 1)
|
|
||||||
{
|
|
||||||
pDepth = pDraw->pScreen->allowedDepths;
|
|
||||||
@@ -1112,10 +1139,19 @@ ProcShmCreatePixmap(client)
|
|
||||||
client->errorValue = stuff->depth;
|
|
||||||
return BadValue;
|
|
||||||
}
|
|
||||||
+
|
|
||||||
CreatePmap:
|
|
||||||
- VERIFY_SHMSIZE(shmdesc, stuff->offset,
|
|
||||||
- PixmapBytePad(stuff->width, stuff->depth) * stuff->height,
|
|
||||||
- client);
|
|
||||||
+ /* now w/h/d are valid; but will they overflow a 32-bit pointer? */
|
|
||||||
+ size = PixmapBytePad(width, depth) * height;
|
|
||||||
+ if (sizeof(void *) == 4 && BitsPerPixel(depth) > 8) {
|
|
||||||
+ if (size < width * height)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+ /* thankfully, offset is unsigned */
|
|
||||||
+ if (stuff->offset + size < size)
|
|
||||||
+ return BadAlloc;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
|
|
||||||
pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
|
|
||||||
pDraw->pScreen, stuff->width,
|
|
||||||
stuff->height, stuff->depth,
|
|
||||||
--
|
|
||||||
1.5.3.6
|
|
||||||
|
|
||||||
@ -1,22 +0,0 @@
|
|||||||
From bbde5b62a137ba726a747b838d81e92d72c1b42b Mon Sep 17 00:00:00 2001
|
|
||||||
From: Matthieu Herrb <matthieu@bluenote.herrb.com>
|
|
||||||
Date: Thu, 17 Jan 2008 15:26:41 +0100
|
|
||||||
Subject: [PATCH] Fix for CVE-2008-0006 - server side part of fix
|
|
||||||
|
|
||||||
diff -up xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c
|
|
||||||
--- xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx 2004-04-23 15:04:44.000000000 -0400
|
|
||||||
+++ xorg-x11-server/dix/dixfonts.c 2008-01-14 11:15:00.000000000 -0500
|
|
||||||
@@ -339,6 +339,13 @@ doOpenFont(ClientPtr client, OFclosurePt
|
|
||||||
err = BadFontName;
|
|
||||||
goto bail;
|
|
||||||
}
|
|
||||||
+ /* check values for firstCol, lastCol, firstRow, and lastRow */
|
|
||||||
+ if (pfont->info.firstCol > pfont->info.lastCol ||
|
|
||||||
+ pfont->info.firstRow > pfont->info.lastRow ||
|
|
||||||
+ pfont->info.lastCol - pfont->info.firstCol > 255) {
|
|
||||||
+ err = AllocError;
|
|
||||||
+ goto bail;
|
|
||||||
+ }
|
|
||||||
if (!pfont->fpe)
|
|
||||||
pfont->fpe = fpe;
|
|
||||||
pfont->refcnt++;
|
|
||||||
2
sources
2
sources
@ -1 +1 @@
|
|||||||
42ce248a3546e26c5f4a0a1e71d949e8 xorg-server-20080107.tar.bz2
|
562c750bd294847e2829e8e2913cfbe4 xorg-server-20080215.tar.bz2
|
||||||
|
|||||||
@ -15,12 +15,12 @@
|
|||||||
# RHEL5 bugfix sync
|
# RHEL5 bugfix sync
|
||||||
|
|
||||||
%define pkgname xorg-server
|
%define pkgname xorg-server
|
||||||
%define gitdate 20080107
|
%define gitdate 20080215
|
||||||
|
|
||||||
Summary: X.Org X11 X server
|
Summary: X.Org X11 X server
|
||||||
Name: xorg-x11-server
|
Name: xorg-x11-server
|
||||||
Version: 1.4.99.1
|
Version: 1.4.99.1
|
||||||
Release: 0.20.%{?gitdate}%{?dist}
|
Release: 0.21.%{?gitdate}%{?dist}
|
||||||
URL: http://www.x.org
|
URL: http://www.x.org
|
||||||
License: MIT
|
License: MIT
|
||||||
Group: User Interface/X
|
Group: User Interface/X
|
||||||
@ -42,7 +42,6 @@ Patch19: xserver-1.3.0-xnest-exposures.patch
|
|||||||
# OpenGL compositing manager feature/optimization patches.
|
# OpenGL compositing manager feature/optimization patches.
|
||||||
Patch100: xorg-x11-server-1.1.0-no-move-damage.patch
|
Patch100: xorg-x11-server-1.1.0-no-move-damage.patch
|
||||||
Patch101: xserver-1.4.99-dont-backfill-bg-none.patch
|
Patch101: xserver-1.4.99-dont-backfill-bg-none.patch
|
||||||
Patch102: xserver-1.4.99-engage-composite-crack-mode.patch
|
|
||||||
|
|
||||||
# Red Hat specific tweaking, not intended for upstream
|
# Red Hat specific tweaking, not intended for upstream
|
||||||
# XXX move these to the end of the list
|
# XXX move these to the end of the list
|
||||||
@ -57,13 +56,6 @@ Patch2004: xserver-1.3.0-honor-displaysize.patch
|
|||||||
Patch2007: xserver-1.3.0-randr12-config-hack.patch
|
Patch2007: xserver-1.3.0-randr12-config-hack.patch
|
||||||
Patch2013: xserver-1.4.99-document-fontpath-correctly.patch
|
Patch2013: xserver-1.4.99-document-fontpath-correctly.patch
|
||||||
|
|
||||||
# Trivial things, already merged - cves already upstream
|
|
||||||
Patch3000: cve-2007-5760.patch
|
|
||||||
Patch3001: cve-2007-6427.patch
|
|
||||||
Patch3002: cve-2007-6428.patch
|
|
||||||
Patch3003: cve-2007-6429.patch
|
|
||||||
Patch3004: cve-2008-0006-server-fixup.patch
|
|
||||||
|
|
||||||
# Trivial things to maybe merge upstream at next rebase
|
# Trivial things to maybe merge upstream at next rebase
|
||||||
#Patch4003: argh-pixman.patch #fixme
|
#Patch4003: argh-pixman.patch #fixme
|
||||||
Patch4004: xserver-1.4.99-xephyr-dri.patch
|
Patch4004: xserver-1.4.99-xephyr-dri.patch
|
||||||
@ -134,6 +126,7 @@ Requires: libdrm >= 2.4.0
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
BuildRequires: libselinux-devel audit-libs-devel
|
BuildRequires: libselinux-devel audit-libs-devel
|
||||||
|
BuildRequires: hal-devel dbus-devel
|
||||||
|
|
||||||
# Make sure libXfont has the catalogue FPE
|
# Make sure libXfont has the catalogue FPE
|
||||||
Conflicts: libXfont < 1.2.9
|
Conflicts: libXfont < 1.2.9
|
||||||
@ -427,6 +420,7 @@ rm -rf $RPM_BUILD_ROOT
|
|||||||
%{_libdir}/xorg/modules/extensions/libGLcore.so
|
%{_libdir}/xorg/modules/extensions/libGLcore.so
|
||||||
%{_libdir}/xorg/modules/extensions/libglx.so
|
%{_libdir}/xorg/modules/extensions/libglx.so
|
||||||
%{_libdir}/xorg/modules/extensions/libdri.so
|
%{_libdir}/xorg/modules/extensions/libdri.so
|
||||||
|
%{_libdir}/xorg/modules/extensions/libdri2.so
|
||||||
%{_libdir}/xorg/modules/extensions/libdbe.so
|
%{_libdir}/xorg/modules/extensions/libdbe.so
|
||||||
%{_libdir}/xorg/modules/extensions/libextmod.so
|
%{_libdir}/xorg/modules/extensions/libextmod.so
|
||||||
%{_libdir}/xorg/modules/extensions/librecord.so
|
%{_libdir}/xorg/modules/extensions/librecord.so
|
||||||
@ -517,6 +511,9 @@ rm -rf $RPM_BUILD_ROOT
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Feb 15 2008 Adam Jackson <ajax@redhat.com> 1.4.99.1-0.21
|
||||||
|
- Today's git snapshot. Features DRI2 and input hotplugging. Tasty.
|
||||||
|
|
||||||
* Mon Feb 11 2008 Adam Jackson <ajax@redhat.com> 1.4.99.1-0.20
|
* Mon Feb 11 2008 Adam Jackson <ajax@redhat.com> 1.4.99.1-0.20
|
||||||
- Conflict against insufficiently new libpciaccess. (#390751)
|
- Conflict against insufficiently new libpciaccess. (#390751)
|
||||||
|
|
||||||
|
|||||||
@ -1,26 +0,0 @@
|
|||||||
From f5be9cb93c3a85572d741d56acb891bb56faf6a0 Mon Sep 17 00:00:00 2001
|
|
||||||
From: =?utf-8?q?Kristian=20H=C3=B8gsberg?= <krh@redhat.com>
|
|
||||||
Date: Wed, 16 Jan 2008 20:24:11 -0500
|
|
||||||
Subject: [PATCH] Don't break grab and focus state for a window when redirecting it.
|
|
||||||
|
|
||||||
---
|
|
||||||
dix/window.c | 3 ++-
|
|
||||||
1 files changed, 2 insertions(+), 1 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/dix/window.c b/dix/window.c
|
|
||||||
index f65fb84..ccfec2b 100644
|
|
||||||
--- a/dix/window.c
|
|
||||||
+++ b/dix/window.c
|
|
||||||
@@ -3022,7 +3022,8 @@ UnrealizeTree(
|
|
||||||
}
|
|
||||||
#endif
|
|
||||||
(* Unrealize)(pChild);
|
|
||||||
- DeleteWindowFromAnyEvents(pChild, FALSE);
|
|
||||||
+ if (MapUnmapEventsEnabled(pWin))
|
|
||||||
+ DeleteWindowFromAnyEvents(pChild, FALSE);
|
|
||||||
if (pChild->viewable)
|
|
||||||
{
|
|
||||||
#ifdef DO_SAVE_UNDERS
|
|
||||||
--
|
|
||||||
1.5.3.7
|
|
||||||
|
|
||||||
Loading…
Reference in New Issue
Block a user