summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch333
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb1
2 files changed, 334 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
new file mode 100644
index 0000000000..97c4c17a8a
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
@@ -0,0 +1,333 @@
1From 5c539ee6aba5872fcc73aa3d46a4e9a33dc030db Mon Sep 17 00:00:00 2001
2From: Matthieu Herrb <matthieu@herrb.eu>
3Date: Fri, 19 Feb 2021 15:30:39 +0100
4Subject: [PATCH] Reject string longer than USHRT_MAX before sending them on
5 the wire
6
7The X protocol uses CARD16 values to represent the length so
8this would overflow.
9
10CVE-2021-31535
11
12Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
13
14https://lists.x.org/archives/xorg-announce/2021-May/003088.html
15
16XLookupColor() and other X libraries function lack proper validation
17of the length of their string parameters. If those parameters can be
18controlled by an external application (for instance a color name that
19can be emitted via a terminal control sequence) it can lead to the
20emission of extra X protocol requests to the X server.
21
22Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605]
23CVE: CVE-2021-31535
24Signed-off-by: Jasper Orschulko <Jasper.Orschulko@iris-sensing.com>
25---
26 src/Font.c | 6 ++++--
27 src/FontInfo.c | 3 +++
28 src/FontNames.c | 3 +++
29 src/GetColor.c | 4 ++++
30 src/LoadFont.c | 4 ++++
31 src/LookupCol.c | 6 ++++--
32 src/ParseCol.c | 5 ++++-
33 src/QuExt.c | 5 +++++
34 src/SetFPath.c | 8 +++++++-
35 src/SetHints.c | 7 +++++++
36 src/StNColor.c | 3 +++
37 src/StName.c | 7 ++++++-
38 12 files changed, 54 insertions(+), 7 deletions(-)
39
40diff --git a/src/Font.c b/src/Font.c
41index 09d2ae91..3f468e4b 100644
42--- a/src/Font.c
43+++ b/src/Font.c
44@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
45 XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
46 #endif
47
48+ if (strlen(name) >= USHRT_MAX)
49+ return NULL;
50 if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
51 return font_result;
52 LockDisplay(dpy);
53@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
54
55 if (!name)
56 return 0;
57- l = strlen(name);
58- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
59+ l = (int) strlen(name);
60+ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
61 return 0;
62 charset = NULL;
63 /* next three lines stolen from _XkbGetCharset() */
64diff --git a/src/FontInfo.c b/src/FontInfo.c
65index f870e431..51b48e29 100644
66--- a/src/FontInfo.c
67+++ b/src/FontInfo.c
68@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
69 register xListFontsReq *req;
70 int j;
71
72+ if (strlen(pattern) >= USHRT_MAX)
73+ return NULL;
74+
75 LockDisplay(dpy);
76 GetReq(ListFontsWithInfo, req);
77 req->maxNames = maxNames;
78diff --git a/src/FontNames.c b/src/FontNames.c
79index b78792d6..4dac4916 100644
80--- a/src/FontNames.c
81+++ b/src/FontNames.c
82@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
83 register xListFontsReq *req;
84 unsigned long rlen = 0;
85
86+ if (strlen(pattern) >= USHRT_MAX)
87+ return NULL;
88+
89 LockDisplay(dpy);
90 GetReq(ListFonts, req);
91 req->maxNames = maxNames;
92diff --git a/src/GetColor.c b/src/GetColor.c
93index cd0eb9f6..512ac308 100644
94--- a/src/GetColor.c
95+++ b/src/GetColor.c
96@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
97 #ifdef HAVE_CONFIG_H
98 #include <config.h>
99 #endif
100+#include <limits.h>
101 #include <stdio.h>
102 #include "Xlibint.h"
103 #include "Xcmsint.h"
104@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
105 XcmsColor cmsColor_exact;
106 Status ret;
107
108+ if (strlen(colorname) >= USHRT_MAX)
109+ return (0);
110+
111 #ifdef XCMS
112 /*
113 * Let's Attempt to use Xcms and i18n approach to Parse Color
114diff --git a/src/LoadFont.c b/src/LoadFont.c
115index f547976b..85735249 100644
116--- a/src/LoadFont.c
117+++ b/src/LoadFont.c
118@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
119 #ifdef HAVE_CONFIG_H
120 #include <config.h>
121 #endif
122+#include <limits.h>
123 #include "Xlibint.h"
124
125 Font
126@@ -38,6 +39,9 @@ XLoadFont (
127 Font fid;
128 register xOpenFontReq *req;
129
130+ if (strlen(name) >= USHRT_MAX)
131+ return (0);
132+
133 if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
134 return fid;
135
136diff --git a/src/LookupCol.c b/src/LookupCol.c
137index f7f969f5..cd9b1368 100644
138--- a/src/LookupCol.c
139+++ b/src/LookupCol.c
140@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
141 #ifdef HAVE_CONFIG_H
142 #include <config.h>
143 #endif
144+#include <limits.h>
145 #include <stdio.h>
146 #include "Xlibint.h"
147 #include "Xcmsint.h"
148@@ -46,6 +47,9 @@ XLookupColor (
149 XcmsCCC ccc;
150 XcmsColor cmsColor_exact;
151
152+ n = (int) strlen (spec);
153+ if (n >= USHRT_MAX)
154+ return 0;
155 #ifdef XCMS
156 /*
157 * Let's Attempt to use Xcms and i18n approach to Parse Color
158@@ -77,8 +81,6 @@ XLookupColor (
159 * Xcms and i18n methods failed, so lets pass it to the server
160 * for parsing.
161 */
162-
163- n = strlen (spec);
164 LockDisplay(dpy);
165 GetReq (LookupColor, req);
166 req->cmap = cmap;
167diff --git a/src/ParseCol.c b/src/ParseCol.c
168index e997b1b8..180132dd 100644
169--- a/src/ParseCol.c
170+++ b/src/ParseCol.c
171@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
172 #ifdef HAVE_CONFIG_H
173 #include <config.h>
174 #endif
175+#include <limits.h>
176 #include <stdio.h>
177 #include "Xlibint.h"
178 #include "Xcmsint.h"
179@@ -46,7 +47,9 @@ XParseColor (
180 XcmsColor cmsColor;
181
182 if (!spec) return(0);
183- n = strlen (spec);
184+ n = (int) strlen (spec);
185+ if (n >= USHRT_MAX)
186+ return(0);
187 if (*spec == '#') {
188 /*
189 * RGB
190diff --git a/src/QuExt.c b/src/QuExt.c
191index 4e230e77..d38a1572 100644
192--- a/src/QuExt.c
193+++ b/src/QuExt.c
194@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
195 #ifdef HAVE_CONFIG_H
196 #include <config.h>
197 #endif
198+#include <limits.h>
199+#include <stdbool.h>
200 #include "Xlibint.h"
201
202 Bool
203@@ -40,6 +42,9 @@ XQueryExtension(
204 xQueryExtensionReply rep;
205 register xQueryExtensionReq *req;
206
207+ if (strlen(name) >= USHRT_MAX)
208+ return false;
209+
210 LockDisplay(dpy);
211 GetReq(QueryExtension, req);
212 req->nbytes = name ? strlen(name) : 0;
213diff --git a/src/SetFPath.c b/src/SetFPath.c
214index 60aaef01..3d8c50cb 100644
215--- a/src/SetFPath.c
216+++ b/src/SetFPath.c
217@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
218
219 #ifdef HAVE_CONFIG_H
220 #include <config.h>
221+#include <limits.h>
222 #endif
223 #include "Xlibint.h"
224
225@@ -48,7 +49,12 @@ XSetFontPath (
226 GetReq (SetFontPath, req);
227 req->nFonts = ndirs;
228 for (i = 0; i < ndirs; i++) {
229- n += safestrlen (directories[i]) + 1;
230+ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
231+ if (n >= USHRT_MAX) {
232+ UnlockDisplay(dpy);
233+ SyncHandle();
234+ return 0;
235+ }
236 }
237 nbytes = (n + 3) & ~3;
238 req->length += nbytes >> 2;
239diff --git a/src/SetHints.c b/src/SetHints.c
240index bc46498a..f3d727ec 100644
241--- a/src/SetHints.c
242+++ b/src/SetHints.c
243@@ -49,6 +49,7 @@ SOFTWARE.
244 #ifdef HAVE_CONFIG_H
245 #include <config.h>
246 #endif
247+#include <limits.h>
248 #include <X11/Xlibint.h>
249 #include <X11/Xutil.h>
250 #include "Xatomtype.h"
251@@ -214,6 +215,8 @@ XSetCommand (
252 register char *buf, *bp;
253 for (i = 0, nbytes = 0; i < argc; i++) {
254 nbytes += safestrlen(argv[i]) + 1;
255+ if (nbytes >= USHRT_MAX)
256+ return 1;
257 }
258 if ((bp = buf = Xmalloc(nbytes))) {
259 /* copy arguments into single buffer */
260@@ -256,6 +259,8 @@ XSetStandardProperties (
261
262 if (name != NULL) XStoreName (dpy, w, name);
263
264+ if (safestrlen(icon_string) >= USHRT_MAX)
265+ return 1;
266 if (icon_string != NULL) {
267 XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
268 PropModeReplace,
269@@ -298,6 +303,8 @@ XSetClassHint(
270
271 len_nm = safestrlen(classhint->res_name);
272 len_cl = safestrlen(classhint->res_class);
273+ if (len_nm + len_cl >= USHRT_MAX)
274+ return 1;
275 if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
276 if (len_nm) {
277 strcpy(s, classhint->res_name);
278diff --git a/src/StNColor.c b/src/StNColor.c
279index 8b821c3e..ba021958 100644
280--- a/src/StNColor.c
281+++ b/src/StNColor.c
282@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
283 #ifdef HAVE_CONFIG_H
284 #include <config.h>
285 #endif
286+#include <limits.h>
287 #include <stdio.h>
288 #include "Xlibint.h"
289 #include "Xcmsint.h"
290@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
291 XcmsColor cmsColor_exact;
292 XColor scr_def;
293
294+ if (strlen(name) >= USHRT_MAX)
295+ return 0;
296 #ifdef XCMS
297 /*
298 * Let's Attempt to use Xcms approach to Parse Color
299diff --git a/src/StName.c b/src/StName.c
300index b4048bff..5a632d0c 100644
301--- a/src/StName.c
302+++ b/src/StName.c
303@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
304 #ifdef HAVE_CONFIG_H
305 #include <config.h>
306 #endif
307+#include <limits.h>
308 #include <X11/Xlibint.h>
309 #include <X11/Xatom.h>
310
311@@ -36,7 +37,9 @@ XStoreName (
312 Window w,
313 _Xconst char *name)
314 {
315- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
316+ if (strlen(name) >= USHRT_MAX)
317+ return 0;
318+ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
319 8, PropModeReplace, (_Xconst unsigned char *)name,
320 name ? strlen(name) : 0);
321 }
322@@ -47,6 +50,8 @@ XSetIconName (
323 Window w,
324 _Xconst char *icon_name)
325 {
326+ if (strlen(icon_name) >= USHRT_MAX)
327+ return 0;
328 return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
329 PropModeReplace, (_Xconst unsigned char *)icon_name,
330 icon_name ? strlen(icon_name) : 0);
331--
3322.32.0
333
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
index ebd2640743..ff2a6f7265 100644
--- a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
+++ b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
@@ -15,6 +15,7 @@ SRC_URI += "file://Fix-hanging-issue-in-_XReply.patch \
15 file://libx11-whitespace.patch \ 15 file://libx11-whitespace.patch \
16 file://CVE-2020-14344.patch \ 16 file://CVE-2020-14344.patch \
17 file://CVE-2020-14363.patch \ 17 file://CVE-2020-14363.patch \
18 file://CVE-2021-31535.patch \
18" 19"
19 20
20SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2" 21SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-07 16:53:02 +0000