libxfixes: Changes to 'upstream-unstable'

[Andreas Boll <aboll-guest@moszumanska.debian.org>]

 configure.ac |    2 +-
 src/Region.c |   15 ++++++++++++---
 2 files changed, 13 insertions(+), 4 deletions(-)

New commits:
commit 84df9cb81cc31bbed27ba241a23ae04f61da57db
Author: Matthieu Herrb <matthieu.herrb@laas.fr>
Date:   Tue Oct 4 21:11:55 2016 +0200

    libXfixes 5.0.3
    
    Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>

diff --git a/configure.ac b/configure.ac
index a9052cf..0ec7b86 100644
--- a/configure.ac
+++ b/configure.ac
@@ -32,7 +32,7 @@ AC_PREREQ([2.60])
 # that 'revision' number appears in Xfixes.h and has to be manually
 # synchronized.
 #
-AC_INIT(libXfixes, [5.0.2],
+AC_INIT(libXfixes, [5.0.3],
 	[https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXfixes])
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_HEADERS([config.h])

commit 61c1039ee23a2d1de712843bed3480654d7ef42e
Author: Tobias Stoeckmann <tobias@stoeckmann.org>
Date:   Sun Sep 25 22:38:44 2016 +0200

    Integer overflow on illegal server response
    
    The 32 bit field "rep.length" is not checked for validity, which allows
    an integer overflow on 32 bit systems.
    
    A malicious server could send INT_MAX as length, which gets multiplied
    by the size of XRectangle. In that case the client won't read the whole
    data from server, getting out of sync.
    
    Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
    Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>

diff --git a/src/Region.c b/src/Region.c
index cb0cf6e..59bcc1a 100644
--- a/src/Region.c
+++ b/src/Region.c
@@ -23,6 +23,7 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
+#include <limits.h>
 #include "Xfixesint.h"
 
 XserverRegion
@@ -333,9 +334,17 @@ XFixesFetchRegionAndBounds (Display	    *dpy,
     bounds->y = rep.y;
     bounds->width = rep.width;
     bounds->height = rep.height;
-    nbytes = (long) rep.length << 2;
-    nrects = rep.length >> 1;
-    rects = Xmalloc (nrects * sizeof (XRectangle));
+
+    if (rep.length < (INT_MAX >> 2)) {
+	nbytes = (long) rep.length << 2;
+	nrects = rep.length >> 1;
+	rects = Xmalloc (nrects * sizeof (XRectangle));
+    } else {
+	nbytes = 0;
+	nrects = 0;
+	rects = NULL;
+    }
+
     if (!rects)
     {
 	_XEatDataWords(dpy, rep.length);