-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
l/libqalculate-4.4.0-x86_64-1.txz: Upgraded.
l/netpbm-11.00.01-x86_64-1.txz: Upgraded.
x/xorg-server-21.1.4-x86_64-2.txz: Rebuilt.
xkb: proof GetCountedString against request length attacks.
xkb: fix some possible memleaks in XkbGetKbdByName.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
(* Security fix *)
x/xorg-server-xephyr-21.1.4-x86_64-2.txz: Rebuilt.
x/xorg-server-xnest-21.1.4-x86_64-2.txz: Rebuilt.
x/xorg-server-xvfb-21.1.4-x86_64-2.txz: Rebuilt.
x/xorg-server-xwayland-22.1.3-x86_64-2.txz: Rebuilt.
xkb: proof GetCountedString against request length attacks.
xkb: fix some possible memleaks in XkbGetKbdByName.
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3550
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3551
(* Security fix *)
xap/blueman-2.3.4-x86_64-1.txz: Upgraded.- Loading branch information
Showing
12 changed files
with
317 additions
and
101 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 1 | ||
| 2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001 | ||
| From: Peter Hutterer <[email protected]> | ||
| Date: Tue, 5 Jul 2022 12:06:20 +1000 | ||
| Subject: xkb: proof GetCountedString against request length attacks | ||
|
|
||
| GetCountedString did a check for the whole string to be within the | ||
| request buffer but not for the initial 2 bytes that contain the length | ||
| field. A swapped client could send a malformed request to trigger a | ||
| swaps() on those bytes, writing into random memory. | ||
|
|
||
| Signed-off-by: Peter Hutterer <[email protected]> | ||
| --- | ||
| xkb/xkb.c | 5 +++++ | ||
| 1 file changed, 5 insertions(+) | ||
|
|
||
| diff --git a/xkb/xkb.c b/xkb/xkb.c | ||
| index f42f59ef3..1841cff26 100644 | ||
| --- a/xkb/xkb.c | ||
| +++ b/xkb/xkb.c | ||
| @@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) | ||
| CARD16 len; | ||
|
|
||
| wire = *wire_inout; | ||
| + | ||
| + if (client->req_len < | ||
| + bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) | ||
| + return BadValue; | ||
| + | ||
| len = *(CARD16 *) wire; | ||
| if (client->swapped) { | ||
| swaps(&len); | ||
| -- | ||
| cgit v1.2.1 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001 | ||
| From: Peter Hutterer <[email protected]> | ||
| Date: Wed, 13 Jul 2022 11:23:09 +1000 | ||
| Subject: xkb: fix some possible memleaks in XkbGetKbdByName | ||
|
|
||
| GetComponentByName returns an allocated string, so let's free that if we | ||
| fail somewhere. | ||
|
|
||
| Signed-off-by: Peter Hutterer <[email protected]> | ||
| --- | ||
| xkb/xkb.c | 26 ++++++++++++++++++++------ | ||
| 1 file changed, 20 insertions(+), 6 deletions(-) | ||
|
|
||
| diff --git a/xkb/xkb.c b/xkb/xkb.c | ||
| index 4692895db..b79a269e3 100644 | ||
| --- a/xkb/xkb.c | ||
| +++ b/xkb/xkb.c | ||
| @@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client) | ||
| xkb = dev->key->xkbInfo->desc; | ||
| status = Success; | ||
| str = (unsigned char *) &stuff[1]; | ||
| - if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ | ||
| - return BadMatch; | ||
| + { | ||
| + char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */ | ||
| + if (keymap) { | ||
| + free(keymap); | ||
| + return BadMatch; | ||
| + } | ||
| + } | ||
| names.keycodes = GetComponentSpec(&str, TRUE, &status); | ||
| names.types = GetComponentSpec(&str, TRUE, &status); | ||
| names.compat = GetComponentSpec(&str, TRUE, &status); | ||
| names.symbols = GetComponentSpec(&str, TRUE, &status); | ||
| names.geometry = GetComponentSpec(&str, TRUE, &status); | ||
| - if (status != Success) | ||
| + if (status == Success) { | ||
| + len = str - ((unsigned char *) stuff); | ||
| + if ((XkbPaddedSize(len) / 4) != stuff->length) | ||
| + status = BadLength; | ||
| + } | ||
| + | ||
| + if (status != Success) { | ||
| + free(names.keycodes); | ||
| + free(names.types); | ||
| + free(names.compat); | ||
| + free(names.symbols); | ||
| + free(names.geometry); | ||
| return status; | ||
| - len = str - ((unsigned char *) stuff); | ||
| - if ((XkbPaddedSize(len) / 4) != stuff->length) | ||
| - return BadLength; | ||
| + } | ||
|
|
||
| CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); | ||
| CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask); | ||
| -- | ||
| cgit v1.2.1 | ||
|
|
37 changes: 0 additions & 37 deletions
37
source/x/x11/patch/xorg-server/failed/0001-Always-install-vbe-and-int10-sdk-headers.patch
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001 | ||
| From: Peter Hutterer <[email protected]> | ||
| Date: Tue, 5 Jul 2022 12:06:20 +1000 | ||
| Subject: xkb: proof GetCountedString against request length attacks | ||
|
|
||
| GetCountedString did a check for the whole string to be within the | ||
| request buffer but not for the initial 2 bytes that contain the length | ||
| field. A swapped client could send a malformed request to trigger a | ||
| swaps() on those bytes, writing into random memory. | ||
|
|
||
| Signed-off-by: Peter Hutterer <[email protected]> | ||
| --- | ||
| xkb/xkb.c | 5 +++++ | ||
| 1 file changed, 5 insertions(+) | ||
|
|
||
| diff --git a/xkb/xkb.c b/xkb/xkb.c | ||
| index f42f59ef3..1841cff26 100644 | ||
| --- a/xkb/xkb.c | ||
| +++ b/xkb/xkb.c | ||
| @@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) | ||
| CARD16 len; | ||
|
|
||
| wire = *wire_inout; | ||
| + | ||
| + if (client->req_len < | ||
| + bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) | ||
| + return BadValue; | ||
| + | ||
| len = *(CARD16 *) wire; | ||
| if (client->swapped) { | ||
| swaps(&len); | ||
| -- | ||
| cgit v1.2.1 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001 | ||
| From: Peter Hutterer <[email protected]> | ||
| Date: Wed, 13 Jul 2022 11:23:09 +1000 | ||
| Subject: xkb: fix some possible memleaks in XkbGetKbdByName | ||
|
|
||
| GetComponentByName returns an allocated string, so let's free that if we | ||
| fail somewhere. | ||
|
|
||
| Signed-off-by: Peter Hutterer <[email protected]> | ||
| --- | ||
| xkb/xkb.c | 26 ++++++++++++++++++++------ | ||
| 1 file changed, 20 insertions(+), 6 deletions(-) | ||
|
|
||
| diff --git a/xkb/xkb.c b/xkb/xkb.c | ||
| index 4692895db..b79a269e3 100644 | ||
| --- a/xkb/xkb.c | ||
| +++ b/xkb/xkb.c | ||
| @@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client) | ||
| xkb = dev->key->xkbInfo->desc; | ||
| status = Success; | ||
| str = (unsigned char *) &stuff[1]; | ||
| - if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ | ||
| - return BadMatch; | ||
| + { | ||
| + char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */ | ||
| + if (keymap) { | ||
| + free(keymap); | ||
| + return BadMatch; | ||
| + } | ||
| + } | ||
| names.keycodes = GetComponentSpec(&str, TRUE, &status); | ||
| names.types = GetComponentSpec(&str, TRUE, &status); | ||
| names.compat = GetComponentSpec(&str, TRUE, &status); | ||
| names.symbols = GetComponentSpec(&str, TRUE, &status); | ||
| names.geometry = GetComponentSpec(&str, TRUE, &status); | ||
| - if (status != Success) | ||
| + if (status == Success) { | ||
| + len = str - ((unsigned char *) stuff); | ||
| + if ((XkbPaddedSize(len) / 4) != stuff->length) | ||
| + status = BadLength; | ||
| + } | ||
| + | ||
| + if (status != Success) { | ||
| + free(names.keycodes); | ||
| + free(names.types); | ||
| + free(names.compat); | ||
| + free(names.symbols); | ||
| + free(names.geometry); | ||
| return status; | ||
| - len = str - ((unsigned char *) stuff); | ||
| - if ((XkbPaddedSize(len) / 4) != stuff->length) | ||
| - return BadLength; | ||
| + } | ||
|
|
||
| CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); | ||
| CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask); | ||
| -- | ||
| cgit v1.2.1 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters