diff --git a/u_Avoid-use-after-free-in-dix-dixfonts.c-doImageText.patch b/u_Avoid-use-after-free-in-dix-dixfonts.c-doImageText.patch deleted file mode 100644 index 3110d70..0000000 --- a/u_Avoid-use-after-free-in-dix-dixfonts.c-doImageText.patch +++ /dev/null @@ -1,75 +0,0 @@ -From a4d9bf1259ad28f54b6d59a480b2009cc89ca623 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Mon, 16 Sep 2013 21:47:16 -0700 -Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText() - -Save a pointer to the passed in closure structure before copying it -and overwriting the *c pointer to point to our copy instead of the -original. If we hit an error, once we free(c), reset c to point to -the original structure before jumping to the cleanup code that -references *c. - -Since one of the errors being checked for is whether the server was -able to malloc(c->nChars * itemSize), the client can potentially pass -a number of characters chosen to cause the malloc to fail and the -error path to be taken, resulting in the read from freed memory. - -Since the memory is accessed almost immediately afterwards, and the -X server is mostly single threaded, the odds of the free memory having -invalid contents are low with most malloc implementations when not using -memory debugging features, but some allocators will definitely overwrite -the memory there, leading to a likely crash. - -Reported-by: Pedro Ribeiro -Signed-off-by: Alan Coopersmith -Reviewed-by: Julien Cristau ---- - dix/dixfonts.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/dix/dixfonts.c b/dix/dixfonts.c -index feb765d..2e34d37 100644 ---- a/dix/dixfonts.c -+++ b/dix/dixfonts.c -@@ -1425,6 +1425,7 @@ doImageText(ClientPtr client, ITclosurePtr c) - GC *pGC; - unsigned char *data; - ITclosurePtr new_closure; -+ ITclosurePtr old_closure; - - /* We're putting the client to sleep. We need to - save some state. Similar problem to that handled -@@ -1436,12 +1437,14 @@ doImageText(ClientPtr client, ITclosurePtr c) - err = BadAlloc; - goto bail; - } -+ old_closure = c; - *new_closure = *c; - c = new_closure; - - data = malloc(c->nChars * itemSize); - if (!data) { - free(c); -+ c = old_closure; - err = BadAlloc; - goto bail; - } -@@ -1452,6 +1455,7 @@ doImageText(ClientPtr client, ITclosurePtr c) - if (!pGC) { - free(c->data); - free(c); -+ c = old_closure; - err = BadAlloc; - goto bail; - } -@@ -1464,6 +1468,7 @@ doImageText(ClientPtr client, ITclosurePtr c) - FreeScratchGC(pGC); - free(c->data); - free(c); -+ c = old_closure; - err = BadAlloc; - goto bail; - } --- -1.7.9.2 - diff --git a/xorg-server-1.14.3.901.tar.bz2 b/xorg-server-1.14.3.901.tar.bz2 new file mode 100644 index 0000000..76efd9f --- /dev/null +++ b/xorg-server-1.14.3.901.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:3d8481f60d6ef67bb9b72c1ee375f5a64e69ba32c613c01367b3c2b5c154ab0a +size 5510351 diff --git a/xorg-server-1.14.3.tar.bz2 b/xorg-server-1.14.3.tar.bz2 deleted file mode 100644 index 7226474..0000000 --- a/xorg-server-1.14.3.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:02125ae13a443dcbb55f964d5c37f1da2f58ad54c2102356037bec23c1b84f5e -size 5502845 diff --git a/xorg-x11-server.changes b/xorg-x11-server.changes index 32b21d2..83d089a 100644 --- a/xorg-x11-server.changes +++ b/xorg-x11-server.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Mon Oct 28 08:00:16 UTC 2013 - sndirsch@suse.com + +- Update to prerelease 1.14.4-rc1 (1.14.3.901) + * bugfixes + * fixes for security issue CVE-2013-4396 +- obsoletes u_Avoid-use-after-free-in-dix-dixfonts.c-doImageText.patch + ------------------------------------------------------------------- Fri Oct 25 12:31:46 UTC 2013 - msrb@suse.com diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 53a4ac4..ff42ad3 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -18,7 +18,7 @@ Name: xorg-x11-server -%define dirsuffix 1.14.3 +%define dirsuffix 1.14.3.901 Summary: X License: GPL-2.0+ and MIT @@ -156,7 +156,6 @@ Patch229: u_disable-acpi-code.patch Patch230: u_xserver_xvfb-randr.patch Patch240: U_revert_dri2_realloc_dri2_drawable_if-pixmap_serial_changes.patch -Patch241: u_Avoid-use-after-free-in-dix-dixfonts.c-doImageText.patch Patch242: U_randr_dont_directly_set_changed_bits_in_randr_screen.patch Patch243: U_randr_report_changes_when_we_disconnect_a_GPU_slave.patch @@ -249,7 +248,6 @@ cp %{SOURCE96} . %patch230 -p1 %patch240 -p1 -%patch241 -p1 %patch242 -p1 %patch243 -p1