summaryrefslogtreecommitdiffstats
path: root/meta
diff options
context:
space:
mode:
Diffstat (limited to 'meta')
-rw-r--r--meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch80
-rw-r--r--meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb1
2 files changed, 81 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch b/meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch
new file mode 100644
index 0000000000..b64f1d9a87
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch
@@ -0,0 +1,80 @@
1From 2351c83a77a478b49cba6beb2ad386835e264744 Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Fri, 6 Mar 2015 22:54:58 -0800
4Subject: [PATCH] bdfReadCharacters: ensure metrics fit into xCharInfo struct
5 [CVE-2015-1804]
6
7We use 32-bit ints to read from the bdf file, but then try to stick
8into a 16-bit int in the xCharInfo struct, so make sure they won't
9overflow that range.
10
11Found by afl-1.24b.
12
13v2: Verify that additions won't overflow 32-bit int range either.
14v3: As Julien correctly observes, the previous check for bh & bw not
15 being < 0 reduces the number of cases we need to check for overflow.
16
17Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
18Reviewed-by: Julien Cristau <jcristau@debian.org>
19
20Upstream-Status: backport
21
22Signed-off-by: Li Zhou <li.zhou@windriver.com>
23---
24 src/bitmap/bdfread.c | 26 ++++++++++++++++++++++++--
25 1 file changed, 24 insertions(+), 2 deletions(-)
26
27diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c
28index 1b29b81..a0ace8f 100644
29--- a/src/bitmap/bdfread.c
30+++ b/src/bitmap/bdfread.c
31@@ -62,8 +62,16 @@ from The Open Group.
32
33 #if HAVE_STDINT_H
34 #include <stdint.h>
35-#elif !defined(INT32_MAX)
36-#define INT32_MAX 0x7fffffff
37+#else
38+# ifndef INT32_MAX
39+# define INT32_MAX 0x7fffffff
40+# endif
41+# ifndef INT16_MAX
42+# define INT16_MAX 0x7fff
43+# endif
44+# ifndef INT16_MIN
45+# define INT16_MIN (0 - 0x8000)
46+# endif
47 #endif
48
49 #define INDICES 256
50@@ -417,6 +425,12 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
51 bdfError("DWIDTH y value must be zero\n");
52 goto BAILOUT;
53 }
54+ /* xCharInfo metrics are stored as INT16 */
55+ if ((wx < 0) || (wx > INT16_MAX)) {
56+ bdfError("character '%s' has out of range width, %d\n",
57+ charName, wx);
58+ goto BAILOUT;
59+ }
60 line = bdfGetLine(file, lineBuf, BDFLINELEN);
61 if ((!line) || (sscanf((char *) line, "BBX %d %d %d %d", &bw, &bh, &bl, &bb) != 4)) {
62 bdfError("bad 'BBX'\n");
63@@ -427,6 +441,14 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
64 charName, bw, bh);
65 goto BAILOUT;
66 }
67+ /* xCharInfo metrics are read as int, but stored as INT16 */
68+ if ((bl > INT16_MAX) || (bl < INT16_MIN) ||
69+ (bb > INT16_MAX) || (bb < INT16_MIN) ||
70+ (bw > (INT16_MAX - bl)) || (bh > (INT16_MAX - bb))) {
71+ bdfError("character '%s' has out of range metrics, %d %d %d %d\n",
72+ charName, bl, (bl+bw), (bh+bb), -bb);
73+ goto BAILOUT;
74+ }
75 line = bdfGetLine(file, lineBuf, BDFLINELEN);
76 if ((line) && (bdfIsPrefix(line, "ATTRIBUTES"))) {
77 for (p = line + strlen("ATTRIBUTES ");
78--
791.7.9.5
80
diff --git a/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb b/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb
index 64ec6a3422..dfd2dc67a2 100644
--- a/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb
+++ b/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb
@@ -20,6 +20,7 @@ BBCLASSEXTEND = "native"
20 20
21SRC_URI += "file://0001-bdfReadProperties-property-count-needs-range-check-C.patch \ 21SRC_URI += "file://0001-bdfReadProperties-property-count-needs-range-check-C.patch \
22 file://0001-bdfReadCharacters-bailout-if-a-char-s-bitmap-cannot-.patch \ 22 file://0001-bdfReadCharacters-bailout-if-a-char-s-bitmap-cannot-.patch \
23 file://0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch \
23 " 24 "
24 25
25SRC_URI[md5sum] = "664629bfa7cdf8b984155019fd395dcb" 26SRC_URI[md5sum] = "664629bfa7cdf8b984155019fd395dcb"