[Git][xorg-team/lib/libx11][upstream-unstable] 4 commits: include <limits.h> always, not if HAVE_CONFIG

Timo Aaltonen pushed to branch upstream-unstable at X Strike Force / lib / libx11

Commits:

a8216e86

by Matthieu Herrb at 2021-05-22T17:36:37+02:00

include <limits.h> always, not if HAVE_CONFIG_H is set.

via Matthew Green from the NetBSD project

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>

ab2f5953

by Matthieu Herrb at 2021-05-30T16:33:48+02:00

Check for NULL strings before getting their lengths

Problem reported by Karsten Trulsen

Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>

51b73ac0

by Tobias Stoeckmann at 2021-05-31T18:39:15+02:00

Protect against overly long strings

Checking against upper limit of USHRT_MAX must happen before truncating
size_t to int. On 64 bit systems with strings larger than 2 GB this
could otherwise lead to negative ints or ints smaller than USHRT_MAX.

In XParseColor this could lead to out of boundary access with strings
starting with a # (color sequence). A modulo 12 operation is performed
to validate the string length, but with an overflown length, the for
loop would eventually read behind terminating '\0' character.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

f906fe8e

by Alan Coopersmith at 2021-06-05T09:36:54-07:00

libX11 1.7.2

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

Changes:

README.md

@@ -31,6 +31,11 @@ For patch submission instructions, see:
    https://www.x.org/wiki/Development/Documentation/SubmittingPatches
 +## Release 1.7.2
++
 +This is a bug fix release, correcting a regression introduced by and
 +improving the checks from the fix for CVE-2021-31535.
++
  ## Release 1.7.1
  This is a bug fix release, including a security fix for

configure.ac

  # Initialize Autoconf
  AC_PREREQ([2.60])
 -AC_INIT([libX11], [1.7.1],
 +AC_INIT([libX11], [1.7.2],
          [https://gitlab.freedesktop.org/xorg/lib/libx11/issues], [libX11])
  AC_CONFIG_SRCDIR([Makefile.am])
  AC_CONFIG_HEADERS([src/config.h include/X11/XlibConf.h])

src/Font.c

@@ -102,7 +102,7 @@ XFontStruct *XLoadQueryFont(
      XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
  #endif
 -    if (strlen(name) >= USHRT_MAX)
 +    if (name != NULL && strlen(name) >= USHRT_MAX)
          return NULL;
      if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
        return font_result;
@@ -656,7 +656,7 @@ int _XF86LoadQueryLocaleFont(
     XFontStruct **xfp,
     Font *fidp)
+ {
 -    int l;
 +    size_t l;
      const char *charset, *p;
      char buf[256];
      XFontStruct *fs;
@@ -664,7 +664,7 @@ int _XF86LoadQueryLocaleFont(
      if (!name)
  	return 0;
 -    l = (int) strlen(name);
 +    l = strlen(name);
      if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
  	return 0;
      charset = NULL;
@@ -677,11 +677,11 @@ int _XF86LoadQueryLocaleFont(
  	charset = "ISO8859-1";
  	p = charset + 7;
+     }
 -    if (l - 2 - (p - charset) < 0)
 +    if (l - 2 < p - charset)
  	return 0;
      if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset))
  	return 0;
 -    if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1)
 +    if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1)
  	return 0;
      strcpy(buf, name);
      strcpy(buf + l - 1, p + 1);

src/FontInfo.c

@@ -58,7 +58,7 @@ XFontStruct **info)	/* RETURN */
      register xListFontsReq *req;
      int j;
 -    if (strlen(pattern) >= USHRT_MAX)
 +    if (pattern != NULL && strlen(pattern) >= USHRT_MAX)
          return NULL;
      LockDisplay(dpy);

src/FontNames.c

@@ -51,7 +51,7 @@ int *actualCount)	/* RETURN */
      register xListFontsReq *req;
      unsigned long rlen = 0;
 -    if (strlen(pattern) >= USHRT_MAX)
 +    if (pattern != NULL && strlen(pattern) >= USHRT_MAX)
          return NULL;
      LockDisplay(dpy);

src/GetColor.c

@@ -49,7 +49,7 @@ XColor *exact_def) /* RETURN */
      XcmsColor cmsColor_exact;
      Status ret;
 -    if (strlen(colorname) >= USHRT_MAX)
 +    if (colorname != NULL && strlen(colorname) >= USHRT_MAX)
          return (0);
  #ifdef XCMS

src/LoadFont.c

@@ -39,7 +39,7 @@ XLoadFont (
      Font fid;
      register xOpenFontReq *req;
 -    if (strlen(name) >= USHRT_MAX)
 +    if (name != NULL && strlen(name) >= USHRT_MAX)
          return (0);
      if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))

src/LookupCol.c

@@ -41,13 +41,15 @@ XLookupColor (
  	XColor *def,
  	XColor *scr)
+ {
 -	register int n;
 +	register size_t n;
  	xLookupColorReply reply;
  	register xLookupColorReq *req;
  	XcmsCCC ccc;
  	XcmsColor cmsColor_exact;
 -	n = (int) strlen (spec);
 +	if (spec == NULL)
 +		return 0;
 +	n = strlen (spec);
  	if (n >= USHRT_MAX)
              return 0;
  #ifdef XCMS

src/ParseCol.c

@@ -40,14 +40,14 @@ XParseColor (
  	_Xconst char *spec,
  	XColor *def)
+ {
 -	register int n, i;
 +	register size_t n, i;
  	int r, g, b;
  	char c;
  	XcmsCCC ccc;
  	XcmsColor cmsColor;
          if (!spec) return(0);
 -	n = (int) strlen (spec);
 +	n = strlen (spec);
  	if (n >= USHRT_MAX)
              return(0);
  	if (*spec == '#') {
@@ -64,7 +64,7 @@ XParseColor (
  		r = g;
  		g = b;
  		b = 0;
 -		for (i = n; --i >= 0; ) {
 +		for (i = 0; i < n; i++) {
  		    c = *spec++;
  		    b <<= 4;
  		    if (c >= '0' && c <= '9')
@@ -122,7 +122,7 @@ XParseColor (
  	    LockDisplay(dpy);
  	    GetReq (LookupColor, req);
  	    req->cmap = cmap;
 -	    req->nbytes = (CARD16) (n = (int) strlen(spec));
 +	    req->nbytes = (CARD16) (n = strlen(spec));
  	    req->length += (n + 3) >> 2;
  	    Data (dpy, spec, (long)n);
  	    if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) {

src/QuExt.c

@@ -42,7 +42,7 @@ XQueryExtension(
      xQueryExtensionReply rep;
      register xQueryExtensionReq *req;
 -    if (strlen(name) >= USHRT_MAX)
 +    if (name != NULL && strlen(name) >= USHRT_MAX)
          return false;
      LockDisplay(dpy);

src/SetFPath.c

@@ -26,8 +26,8 @@ in this Software without prior written authorization from The Open Group.
  #ifdef HAVE_CONFIG_H
  #include <config.h>
 -#include <limits.h>
  #endif
 +#include <limits.h>
  #include "Xlibint.h"
  #define safestrlen(s) ((s) ? strlen(s) : 0)
@@ -38,7 +38,7 @@ XSetFontPath (
      char **directories,
      int ndirs)
+ {
 -	register int n = 0;
 +	register size_t n = 0;
  	register int i;
  	register int nbytes;
  	char *p;
@@ -49,7 +49,7 @@ XSetFontPath (
  	GetReq (SetFontPath, req);
  	req->nFonts = ndirs;
  	for (i = 0; i < ndirs; i++) {
 -		n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
 +		n = n + (safestrlen (directories[i]) + 1);
  		if (n >= USHRT_MAX) {
  			UnlockDisplay(dpy);
  			SyncHandle();
@@ -65,9 +65,9 @@ XSetFontPath (
  		char	*tmp = p;
  		for (i = 0; i < ndirs; i++) {
 -			register int length = (int) safestrlen (directories[i]);
 +			size_t length = safestrlen (directories[i]);
  			*p = length;
 -			memcpy (p + 1, directories[i], (size_t)length);
 +			memcpy (p + 1, directories[i], length);
  			p += length + 1;
+ 		}
  		Data (dpy, tmp, nbytes);

src/StNColor.c

@@ -47,7 +47,7 @@ int flags)  /* DoRed, DoGreen, DoBlue */
      XcmsColor cmsColor_exact;
      XColor scr_def;
 -    if (strlen(name) >= USHRT_MAX)
 +    if (name != NULL && strlen(name) >= USHRT_MAX)
          return 0;
  #ifdef XCMS
      /*

src/StName.c

@@ -37,7 +37,7 @@ XStoreName (
      Window w,
      _Xconst char *name)
+ {
 -    if (strlen(name) >= USHRT_MAX)
 +    if (name != NULL && strlen(name) >= USHRT_MAX)
          return 0;
      return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /*  */
 , PropModeReplace, (_Xconst unsigned char *)name,
@@ -50,7 +50,7 @@ XSetIconName (
      Window w,
      _Xconst char *icon_name)
+ {
 -    if (strlen(icon_name) >= USHRT_MAX)
 +    if (icon_name != NULL && strlen(icon_name) >= USHRT_MAX)
          return 0;
      return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
                             PropModeReplace, (_Xconst unsigned char *)icon_name,

[Git][xorg-team/lib/libx11][upstream-unstable] 4 commits: include <limits.h> always, not if HAVE_CONFIG_H is set.

Timo Aaltonen pushed to branch upstream-unstable at X Strike Force / lib / libx11

Commits:

13 changed files:

Changes: