pool/libX11
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

- Update to version 1.7.1

Browse Source 
* security update for CVE-2021-31535 (bsc#1182506)
- supersedes U_CVE-2021-31535.patch

OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/libX11?expand=0&rev=65
This commit is contained in:
Stefan Dirsch 2021-05-18 16:15:46 +00:00 committed by Git OBS Bridge
parent 69ef74c8c2
commit fb18b7b339
6 changed files with 14 additions and 313 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

304
U_CVE-2021-31535.patch
View File

@ -1,304 +0,0 @@
The X protocol uses CARD16 values to represent the length so
this would overflow.
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
---
src/Font.c | 4 +++-
src/FontInfo.c | 3 +++
src/FontNames.c | 3 +++
src/GetColor.c | 4 ++++
src/LoadFont.c | 4 ++++
src/LookupCol.c | 6 ++++--
src/ParseCol.c | 3 +++
src/QuExt.c | 5 +++++
src/SetFPath.c | 6 ++++++
src/SetHints.c | 7 +++++++
src/StNColor.c | 3 +++
src/StName.c | 7 ++++++-
12 files changed, 51 insertions(+), 4 deletions(-)
Index: libX11-1.7.0/src/Font.c
===================================================================
--- libX11-1.7.0.orig/src/Font.c
+++ libX11-1.7.0/src/Font.c
@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
#endif
+ if (strlen(name) > USHRT_MAX)
+ return NULL;
if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
return font_result;
LockDisplay(dpy);
@@ -663,7 +665,7 @@ int _XF86LoadQueryLocaleFont(
if (!name)
return 0;
l = (int) strlen(name);
- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
+ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
return 0;
charset = NULL;
/* next three lines stolen from _XkbGetCharset() */
Index: libX11-1.7.0/src/FontInfo.c
===================================================================
--- libX11-1.7.0.orig/src/FontInfo.c
+++ libX11-1.7.0/src/FontInfo.c
@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
register xListFontsReq *req;
int j;
+ if (strlen(pattern) >= USHRT_MAX)
+ return NULL;
+
LockDisplay(dpy);
GetReq(ListFontsWithInfo, req);
req->maxNames = maxNames;
Index: libX11-1.7.0/src/FontNames.c
===================================================================
--- libX11-1.7.0.orig/src/FontNames.c
+++ libX11-1.7.0/src/FontNames.c
@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
register xListFontsReq *req;
unsigned long rlen = 0;
+ if (strlen(pattern) >= USHRT_MAX)
+ return NULL;
+
LockDisplay(dpy);
GetReq(ListFonts, req);
req->maxNames = maxNames;
Index: libX11-1.7.0/src/GetColor.c
===================================================================
--- libX11-1.7.0.orig/src/GetColor.c
+++ libX11-1.7.0/src/GetColor.c
@@ -27,6 +27,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
XcmsColor cmsColor_exact;
Status ret;
+ if (strlen(colorname) >= USHRT_MAX)
+ return (0);
+
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
Index: libX11-1.7.0/src/LoadFont.c
===================================================================
--- libX11-1.7.0.orig/src/LoadFont.c
+++ libX11-1.7.0/src/LoadFont.c
@@ -27,6 +27,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include "Xlibint.h"
Font
@@ -38,6 +39,9 @@ XLoadFont (
Font fid;
register xOpenFontReq *req;
+ if (strlen(name) >= USHRT_MAX)
+ return (0);
+
if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
return fid;
Index: libX11-1.7.0/src/LookupCol.c
===================================================================
--- libX11-1.7.0.orig/src/LookupCol.c
+++ libX11-1.7.0/src/LookupCol.c
@@ -27,6 +27,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,6 +47,9 @@ XLookupColor (
XcmsCCC ccc;
XcmsColor cmsColor_exact;
+ n = (int) strlen (spec);
+ if (n > USHRT_MAX)
+ return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
@@ -77,8 +81,6 @@ XLookupColor (
* Xcms and i18n methods failed, so lets pass it to the server
* for parsing.
*/
-
- n = (int) strlen (spec);
LockDisplay(dpy);
GetReq (LookupColor, req);
req->cmap = cmap;
Index: libX11-1.7.0/src/ParseCol.c
===================================================================
--- libX11-1.7.0.orig/src/ParseCol.c
+++ libX11-1.7.0/src/ParseCol.c
@@ -27,6 +27,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -47,6 +48,8 @@ XParseColor (
if (!spec) return(0);
n = (int) strlen (spec);
+ if (n >= USHRT_MAX)
+ return(0);
if (*spec == '#') {
/*
* RGB
Index: libX11-1.7.0/src/QuExt.c
===================================================================
--- libX11-1.7.0.orig/src/QuExt.c
+++ libX11-1.7.0/src/QuExt.c
@@ -27,6 +27,8 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
+#include <stdbool.h>
#include "Xlibint.h"
Bool
@@ -54,6 +56,9 @@ XQueryExtension(
return False;
}
+ if (strlen(name) >= USHRT_MAX)
+ return false;
+
LockDisplay(dpy);
GetReq(QueryExtension, req);
req->nbytes = name ? (CARD16) strlen(name) : 0;
Index: libX11-1.7.0/src/SetFPath.c
===================================================================
--- libX11-1.7.0.orig/src/SetFPath.c
+++ libX11-1.7.0/src/SetFPath.c
@@ -26,6 +26,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
+#include <limits.h>
#endif
#include "Xlibint.h"
@@ -49,6 +50,11 @@ XSetFontPath (
req->nFonts = ndirs;
for (i = 0; i < ndirs; i++) {
n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
+ if (n >= USHRT_MAX) {
+ UnlockDisplay(dpy);
+ SyncHandle();
+ return 0;
+ }
}
nbytes = (n + 3) & ~3;
req->length += nbytes >> 2;
Index: libX11-1.7.0/src/SetHints.c
===================================================================
--- libX11-1.7.0.orig/src/SetHints.c
+++ libX11-1.7.0/src/SetHints.c
@@ -49,6 +49,7 @@ SOFTWARE.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xutil.h>
#include "Xatomtype.h"
@@ -214,6 +215,8 @@ XSetCommand (
register char *buf, *bp;
for (i = 0, nbytes = 0; i < argc; i++) {
nbytes += safestrlen(argv[i]) + 1;
+ if (nbytes >= USHRT_MAX)
+ return 1;
}
if ((bp = buf = Xmalloc(nbytes))) {
/* copy arguments into single buffer */
@@ -256,6 +259,8 @@ XSetStandardProperties (
if (name != NULL) XStoreName (dpy, w, name);
+ if (safestrlen(icon_string) >= USHRT_MAX)
+ return 1;
if (icon_string != NULL) {
XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace,
@@ -298,6 +303,8 @@ XSetClassHint(
len_nm = safestrlen(classhint->res_name);
len_cl = safestrlen(classhint->res_class);
+ if (len_nm + len_cl >= USHRT_MAX)
+ return 1;
if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
if (len_nm) {
strcpy(s, classhint->res_name);
Index: libX11-1.7.0/src/StNColor.c
===================================================================
--- libX11-1.7.0.orig/src/StNColor.c
+++ libX11-1.7.0/src/StNColor.c
@@ -27,6 +27,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
XcmsColor cmsColor_exact;
XColor scr_def;
+ if (strlen(name) >= USHRT_MAX)
+ return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms approach to Parse Color
Index: libX11-1.7.0/src/StName.c
===================================================================
--- libX11-1.7.0.orig/src/StName.c
+++ libX11-1.7.0/src/StName.c
@@ -27,6 +27,7 @@ in this Software without prior written a
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xatom.h>
@@ -36,7 +37,9 @@ XStoreName (
Window w,
_Xconst char *name)
{
- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
+ if (strlen(name) >= USHRT_MAX)
+ return 0;
+ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
8, PropModeReplace, (_Xconst unsigned char *)name,
name ? (int) strlen(name) : 0);
}
@@ -47,6 +50,8 @@ XSetIconName (
Window w,
_Xconst char *icon_name)
{
+ if (strlen(icon_name) >= USHRT_MAX)
+ return 0;
return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace, (_Xconst unsigned char *)icon_name,
icon_name ? (int) strlen(icon_name) : 0);

3
libX11-1.7.0.tar.bz2
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:36c8f93b6595437c8cfbc9f08618bcb3041cbd303e140a0013f88e4c2977cb54
size 2409144

3
libX11-1.7.1.tar.bz2 Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:e64e43deaa562cbfb0d5ada64670ec09c6fac7935262dcd77bbc6d984a535d47
size 2426509

7
libX11.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Tue May 18 15:57:02 UTC 2021 - Stefan Dirsch <sndirsch@suse.com>
- Update to version 1.7.1
* security update for CVE-2021-31535 (bsc#1182506)
- supersedes U_CVE-2021-31535.patch
-------------------------------------------------------------------
Mon May 17 09:45:43 UTC 2021 - Stefan Dirsch <sndirsch@suse.com>

4
libX11.spec
View File

@ -17,7 +17,7 @@
Name: libX11
Version: 1.7.0
Version: 1.7.1
Release: 0
Summary: Core X11 protocol client library
License: MIT
@ -33,7 +33,6 @@ Patch0: p_khmer-compose.diff
Patch1: p_xlib_skip_ext_env.diff
# PATCH-FIX-UPSTREAM en-locales.diff fdo#48596 bnc#388711 -- Add missing data for more en locales
Patch2: en-locales.diff
Patch1182506: U_CVE-2021-31535.patch
BuildRequires: fdupes
BuildRequires: libtool
@ -138,7 +137,6 @@ test -f nls/ja.S90/XLC_LOCALE.pre && exit 1
%patch0
%patch1
%patch2
%patch1182506 -p1
%build
%configure \

6
p_xlib_skip_ext_env.diff
View File

@ -2,9 +2,9 @@ Index: src/QuExt.c
===================================================================
--- src/QuExt.c.orig
+++ src/QuExt.c
@@ -40,6 +40,20 @@ XQueryExtension(
xQueryExtensionReply rep;
register xQueryExtensionReq *req;
@@ -45,6 +45,20 @@ XQueryExtension(
if (strlen(name) >= USHRT_MAX)
return false;
+ if (name && strlen (name) < 256)
+ {