[Git][xorg-team/lib/libx11][upstream-unstable] 8 commits: Fix size calculation in `_XimAttributeToValue`.

[Timo Aaltonen <tjaalton@debian.org>]

Title: GitLab

Timo Aaltonen pushed to branch upstream-unstable at X Strike Force / lib / libx11

Commits:

• 93fce3f4
  by Yichao Yu at 2020-08-02T13:43:58-04:00

  Fix size calculation in `_XimAttributeToValue`.
  
  The check here guards the read below.
  For `XimType_XIMStyles`, these are `num` of `CARD32` and for `XimType_XIMHotKeyTriggers`
  these are `num` of `XIMTRIGGERKEY` ref[1] which is defined as 3 x `CARD32`.
  (There are data after the `XIMTRIGGERKEY` according to the spec but they are not read by this
  function and doesn't need to be checked.)
  
  The old code here used the native datatype size instead of the wire protocol size causing
  the check to always fail.
  
  Also fix the size calculation for the header (size). It is 2 x CARD16 for both types
  despite the unused `CARD16` for `XimType_XIMStyles`.
  
  [1] https://www.x.org/releases/X11R7.6/doc/libX11/specs/XIM/xim.html#Input_Method_Styles
  
  This fixes a regression caused by 388b303c62aa35a245f1704211a023440ad2c488 in 1.6.10.
  
  Fix #116
  

• 0d8f038d
  by Alan Coopersmith at 2020-08-06T08:07:57-07:00

  libX11 1.6.11
  
  Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
  

• 29a8251a
  by Felix Yan at 2020-08-06T17:23:53+00:00

  Correct a typo in GetStCmap.c

• 780d2223
  by Christopher Chavez at 2020-08-10T17:08:39+00:00

  Fix typo GCCLipYOrigin -> GCClipYOrigin in XCreateGC() manpage

• 6dd618e5
  by Maya Rashish at 2020-08-15T00:48:56+03:00

  Avoid the use of "register" keyword in XkbTranslateKeySym.
  
  This causes issues when compiling code for C++17.
  While here, make function prototype match the header with regards
  to removal of another register keyword.
  

• d15c24c8
  by Niclas Zeising at 2020-08-17T02:21:40+00:00

  Fix input clients connecting to server
  
  Fix a bug where some input clients can't connect to the input server.
  This fixes #117.
  
  FreeBSD bugzilla reference:
  https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=248549
  
  Signed-off-by: Niclas Zeising <zeising@daemonic.se>
  

• acdaaadc
  by Matthieu Herrb at 2020-08-19T12:46:57+02:00

  Fix an integer overflow in init_om()
  
  CVE-2020-14363
  
  This can lead to a double free later, as reported by Jayden Rivers.
  
  Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
  

• 50542066
  by Matthieu Herrb at 2020-08-24T15:42:25+02:00

  libX11 1.6.12
  
  Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
  

7 changed files:

• configure.ac
• include/X11/XKBlib.h
• man/XCreateGC.man
• modules/im/ximcp/imRmAttr.c
• modules/om/generic/omGeneric.c
• src/GetStCmap.c
• src/xkb/XKBBind.c

Changes:

configure.ac

---

1	1
2	2	# Initialize Autoconf
3	3	AC_PREREQ([2.60])
4		-AC_INIT([libX11], [1.6.10],
	4	+AC_INIT([libX11], [1.6.12],
5	5	[https://gitlab.freedesktop.org/xorg/lib/libx11/issues], [libX11])
6	6	AC_CONFIG_SRCDIR([Makefile.am])
7	7	AC_CONFIG_HEADERS([src/config.h include/X11/XlibConf.h])

include/X11/XKBlib.h

---

...	...	@@ -396,7 +396,7 @@ extern Bool XkbTranslateKeyCode(
396	396
397	397	extern int XkbTranslateKeySym(
398	398	Display * /* dpy */,
399		- register KeySym * /* sym_return */,
	399	+ KeySym * /* sym_return */,
400	400	unsigned int /* modifiers */,
401	401	char * /* buffer */,
402	402	int /* nbytes */,

man/XCreateGC.man

---

...	...	@@ -178,7 +178,7 @@ If the valuemask contains a valid set of GC mask bits
178	178	.BR GCSubwindowMode ,
179	179	.BR GCGraphicsExposures ,
180	180	.BR GCClipXOrigin ,
181		-.BR GCCLipYOrigin ,
	181	+.BR GCClipYOrigin ,
182	182	.BR GCDashOffset ,
183	183	or
184	184	.BR GCArcMode )

modules/im/ximcp/imRmAttr.c

---

...	...	@@ -265,7 +265,7 @@ _XimAttributeToValue(
265	265
266	266	if (num > (USHRT_MAX / sizeof(XIMStyle)))
267	267	return False;
268		- if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len)
	268	+ if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len)
269	269	return False;
270	270	alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num;
271	271	if (alloc_len < sizeof(XIMStyles))
...	...	@@ -379,7 +379,7 @@ _XimAttributeToValue(
379	379
380	380	if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger)))
381	381	return False;
382		- if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len)
	382	+ if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len)
383	383	return False;
384	384	alloc_len = sizeof(XIMHotKeyTriggers)
385	385	+ sizeof(XIMHotKeyTrigger) * num;
...	...	@@ -1407,7 +1407,7 @@ _XimCountNumberOfAttr(
1407	1407	*names_len = 0;
1408	1408	while (total > min_len) {
1409	1409	len = attr[2];
1410		- if (len >= (total - min_len)) {
	1410	+ if (len > (total - min_len)) {
1411	1411	return 0;
1412	1412	}
1413	1413	*names_len += (len + 1);

modules/om/generic/omGeneric.c

---

...	...	@@ -1908,7 +1908,8 @@ init_om(
1908	1908	char **required_list;
1909	1909	XOrientation *orientation;
1910	1910	char **value, buf[BUFSIZ], *bufptr;
1911		- int count = 0, num = 0, length = 0;
	1911	+ int count = 0, num = 0;
	1912	+ unsigned int length = 0;
1912	1913
1913	1914	_XlcGetResource(lcd, "XLC_FONTSET", "on_demand_loading", &value, &count);
1914	1915	if (count > 0 && _XlcCompareISOLatin1(*value, "True") == 0)

src/GetStCmap.c

---

1		-
2	1	/***********************************************************
3	2
4	3	Copyright 1987, 1998 The Open Group
...	...	@@ -111,7 +110,7 @@ Status XGetStandardColormap (
111	110	cmap->blue_mult = use->blue_mult;
112	111	cmap->base_pixel = use->base_pixel;
113	112
114		- Xfree (stdcmaps); /* don't need alloced memory */
	113	+ Xfree (stdcmaps); /* don't need allocated memory */
115	114	}
116	115	return stat;
117	116	}

src/xkb/XKBBind.c

---

...	...	@@ -587,8 +587,8 @@ _XkbReloadDpy(Display *dpy)
587	587	}
588	588
589	589	int
590		-XkbTranslateKeySym(register Display *dpy,
591		- register KeySym *sym_rtrn,
	590	+XkbTranslateKeySym(Display *dpy,
	591	+ KeySym *sym_rtrn,
592	592	unsigned int mods,
593	593	char *buffer,
594	594	int nbytes,

—
View it on GitLab.
You're receiving this email because of your account on salsa.debian.org. If you'd like to receive fewer emails, you can adjust your notification settings.