rpm/libXcursor
SHA256
1
0
Fork 0
forked from pool/libXcursor
Code Pull Requests Activity

- U_Avoid-heap-overflows-due-to-integer-overflow-signedn.patch

Browse Source 
* It is possible to trigger heap overflows due to an integer
    overflow while parsing images and a signedness issue while
    parsing comments. [CVE-2017-16612] (bsc#1065386)

OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/libXcursor?expand=0&rev=15
This commit is contained in:
Stefan Dirsch 2017-11-28 19:14:42 +00:00 committed by Git OBS Bridge
parent 9d2077cbe3
commit 1ac4d12f03
3 changed files with 85 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
U_Avoid-heap-overflows-due-to-integer-overflow-signedn.patch Normal file
View File

@ -0,0 +1,73 @@
From 77a4331570c660ebee77f19eb385911299948422 Mon Sep 17 00:00:00 2001
From: Stefan Dirsch <sndirsch@suse.de>
Date: Tue, 21 Nov 2017 16:50:56 +0100
Subject: [PATCH] Avoid heap overflows due to integer overflow + signedness
issue [CVE-2017-16612]
It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.
The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes
4 bytes. Properly chosen values allow an overflow which in turn will
lead to less allocated memory than needed for subsequent reads.
The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.
Signed-off-by: Tobias Stoeckmann
---
src/file.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/src/file.c b/src/file.c
index 43163c2..da16277 100644
--- a/src/file.c
+++ b/src/file.c
@@ -29,6 +29,11 @@ XcursorImageCreate (int width, int height)
{
XcursorImage *image;
+ if (width < 0 || height < 0)
+ return NULL;
+ if (width > XCURSOR_IMAGE_MAX_SIZE || height > XCURSOR_IMAGE_MAX_SIZE)
+ return NULL;
+
image = malloc (sizeof (XcursorImage) +
width * height * sizeof (XcursorPixel));
if (!image)
@@ -101,7 +106,7 @@ XcursorCommentCreate (XcursorUInt comment_type, int length)
{
XcursorComment *comment;
- if (length > XCURSOR_COMMENT_MAX_LEN)
+ if (length < 0 || length > XCURSOR_COMMENT_MAX_LEN)
return NULL;
comment = malloc (sizeof (XcursorComment) + length + 1);
@@ -448,7 +453,8 @@ _XcursorReadImage (XcursorFile *file,
if (!_XcursorReadUInt (file, &head.delay))
return NULL;
/* sanity check data */
- if (head.width >= 0x10000 || head.height > 0x10000)
+ if (head.width > XCURSOR_IMAGE_MAX_SIZE ||
+ head.height > XCURSOR_IMAGE_MAX_SIZE)
return NULL;
if (head.width == 0 || head.height == 0)
return NULL;
@@ -457,6 +463,8 @@ _XcursorReadImage (XcursorFile *file,
/* Create the image and initialize it */
image = XcursorImageCreate (head.width, head.height);
+ if (image == NULL)
+ return NULL;
if (chunkHeader.version < image->version)
image->version = chunkHeader.version;
image->size = chunkHeader.subtype;
--
2.13.6

8
libXcursor.changes
View File

@ -1,3 +1,11 @@
-------------------------------------------------------------------
Tue Nov 28 19:08:11 UTC 2017 - sndirsch@suse.com
- U_Avoid-heap-overflows-due-to-integer-overflow-signedn.patch
* It is possible to trigger heap overflows due to an integer
overflow while parsing images and a signedness issue while
parsing comments. [CVE-2017-16612] (bsc#1065386)
-------------------------------------------------------------------
Mon Apr 28 00:57:07 UTC 2014 - sndirsch@suse.com

5
libXcursor.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package libXcursor
#
# Copyright (c) 2014 SUSE LINUX Products GmbH, Nuernberg, Germany.
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -28,6 +28,8 @@ Url: http://xorg.freedesktop.org/
#Git-Clone: git://anongit.freedesktop.org/xorg/lib/libXcursor
#Git-Web: http://cgit.freedesktop.org/xorg/lib/libXcursor/
Source: http://xorg.freedesktop.org/releases/individual/lib/%{name}-%{version}.tar.bz2
Source1: baselibs.conf
Patch0: U_Avoid-heap-overflows-due-to-integer-overflow-signedn.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build
#git#BuildRequires: autoconf >= 2.60, automake, libtool
BuildRequires: fdupes
@ -71,6 +73,7 @@ in %lname.
%prep
%setup -q
%patch0 -p1
%build
%configure --disable-static