summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2020-14344.patch321
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb4
2 files changed, 324 insertions, 1 deletions
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2020-14344.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2020-14344.patch
new file mode 100644
index 0000000000..9d07202b06
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2020-14344.patch
@@ -0,0 +1,321 @@
1From f64388ed036b6668686ad5448bc7d4f73b35e1c7 Mon Sep 17 00:00:00 2001
2From: Matthieu Herrb <matthieu@herrb.eu>
3Date: Fri, 24 Jul 2020 21:09:10 +0200
4Subject: [PATCH] Fix CVE-2020-14344
5
6This is a squashed of below commit:
7
8commit 1 :-
9https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1703b9f3435079d3c6021e1ee2ec34fd4978103d
10Change the data_len parameter of _XimAttributeToValue() to CARD16
11
12It's coming from a length in the protocol (unsigned) and passed
13to functions that expect unsigned int parameters (_XCopyToArg()
14and memcpy()).
15
16Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
17Reviewed-by: Todd Carson <toc@daybefore.net>
18
19commit 2 :-
20https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1a566c9e00e5f35c1f9e7f3d741a02e5170852b2
21Zero out buffers in functions
22
23It looks like uninitialized stack or heap memory can leak
24out via padding bytes.
25
26Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
27Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
28
29commit 3 :-
30https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/2fcfcc49f3b1be854bb9085993a01d17c62acf60
31Fix more unchecked lengths
32
33Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
34Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
35
36commit 4 :-
37https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/388b303c62aa35a245f1704211a023440ad2c488
38fix integer overflows in _XimAttributeToValue()
39
40Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
41Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
42
43commit 5 :-
44https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/93fce3f4e79cbc737d6468a4f68ba3de1b83953b
45Fix size calculation in `_XimAttributeToValue`.
46
47The check here guards the read below.
48For `XimType_XIMStyles`, these are `num` of `CARD32` and for `XimType_XIMHotKeyTriggers`
49these are `num` of `XIMTRIGGERKEY` ref[1] which is defined as 3 x `CARD32`.
50(There are data after the `XIMTRIGGERKEY` according to the spec but they are not read by this
51function and doesn't need to be checked.)
52
53The old code here used the native datatype size instead of the wire protocol size causing
54the check to always fail.
55
56Also fix the size calculation for the header (size). It is 2 x CARD16 for both types
57despite the unused `CARD16` for `XimType_XIMStyles`.
58
59[1] https://www.x.org/releases/X11R7.6/doc/libX11/specs/XIM/xim.html#Input_Method_Styles
60
61This fixes a regression caused by 388b303c62aa35a245f1704211a023440ad2c488 in 1.6.10.
62
63Fix #116
64
65Upstream-Status: Backport
66[ https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1703b9f3435079d3c6021e1ee2ec34fd4978103d
67https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1a566c9e00e5f35c1f9e7f3d741a02e5170852b2
68https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/2fcfcc49f3b1be854bb9085993a01d17c62acf60
69https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/388b303c62aa35a245f1704211a023440ad2c488
70https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/93fce3f4e79cbc737d6468a4f68ba3de1b83953b ]
71CVE: CVE-2020-14344
72Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
73---
74 modules/im/ximcp/imDefIc.c | 6 ++++--
75 modules/im/ximcp/imDefIm.c | 25 +++++++++++++++++--------
76 modules/im/ximcp/imRmAttr.c | 31 +++++++++++++++++++++++--------
77 3 files changed, 44 insertions(+), 18 deletions(-)
78
79diff --git a/modules/im/ximcp/imDefIc.c b/modules/im/ximcp/imDefIc.c
80index 7564dbad..d552aa9e 100644
81--- a/modules/im/ximcp/imDefIc.c
82+++ b/modules/im/ximcp/imDefIc.c
83@@ -350,7 +350,7 @@ _XimProtoGetICValues(
84 + sizeof(INT16)
85 + XIM_PAD(2 + buf_size);
86
87- if (!(buf = Xmalloc(buf_size)))
88+ if (!(buf = Xcalloc(buf_size, 1)))
89 return arg->name;
90 buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE];
91
92@@ -708,6 +708,7 @@ _XimProtoSetICValues(
93 #endif /* XIM_CONNECTABLE */
94
95 _XimGetCurrentICValues(ic, &ic_values);
96+ memset(tmp_buf, 0, sizeof(tmp_buf32));
97 buf = tmp_buf;
98 buf_size = XIM_HEADER_SIZE
99 + sizeof(CARD16) + sizeof(CARD16) + sizeof(INT16) + sizeof(CARD16);
100@@ -730,7 +731,7 @@ _XimProtoSetICValues(
101
102 buf_size += ret_len;
103 if (buf == tmp_buf) {
104- if (!(tmp = Xmalloc(buf_size + data_len))) {
105+ if (!(tmp = Xcalloc(buf_size + data_len, 1))) {
106 return tmp_name;
107 }
108 memcpy(tmp, buf, buf_size);
109@@ -740,6 +741,7 @@ _XimProtoSetICValues(
110 Xfree(buf);
111 return tmp_name;
112 }
113+ memset(&tmp[buf_size], 0, data_len);
114 buf = tmp;
115 }
116 }
117diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
118index cf922e48..d0329b54 100644
119--- a/modules/im/ximcp/imDefIm.c
120+++ b/modules/im/ximcp/imDefIm.c
121@@ -62,6 +62,7 @@ PERFORMANCE OF THIS SOFTWARE.
122 #include "XimTrInt.h"
123 #include "Ximint.h"
124
125+#include <limits.h>
126
127 int
128 _XimCheckDataSize(
129@@ -807,12 +808,16 @@ _XimOpen(
130 int buf_size;
131 int ret_code;
132 char *locale_name;
133+ size_t locale_len;
134
135 locale_name = im->private.proto.locale_name;
136- len = strlen(locale_name);
137- buf_b[0] = (BYTE)len; /* length of locale name */
138- (void)strcpy((char *)&buf_b[1], locale_name); /* locale name */
139- len += sizeof(BYTE); /* sizeof length */
140+ locale_len = strlen(locale_name);
141+ if (locale_len > UCHAR_MAX)
142+ return False;
143+ memset(buf32, 0, sizeof(buf32));
144+ buf_b[0] = (BYTE)locale_len; /* length of locale name */
145+ memcpy(&buf_b[1], locale_name, locale_len); /* locale name */
146+ len = (INT16)(locale_len + sizeof(BYTE)); /* sizeof length */
147 XIM_SET_PAD(buf_b, len); /* pad */
148
149 _XimSetHeader((XPointer)buf, XIM_OPEN, 0, &len);
150@@ -1287,6 +1292,7 @@ _XimProtoSetIMValues(
151 #endif /* XIM_CONNECTABLE */
152
153 _XimGetCurrentIMValues(im, &im_values);
154+ memset(tmp_buf, 0, sizeof(tmp_buf32));
155 buf = tmp_buf;
156 buf_size = XIM_HEADER_SIZE + sizeof(CARD16) + sizeof(INT16);
157 data_len = BUFSIZE - buf_size;
158@@ -1307,7 +1313,7 @@ _XimProtoSetIMValues(
159
160 buf_size += ret_len;
161 if (buf == tmp_buf) {
162- if (!(tmp = Xmalloc(buf_size + data_len))) {
163+ if (!(tmp = Xcalloc(buf_size + data_len, 1))) {
164 return arg->name;
165 }
166 memcpy(tmp, buf, buf_size);
167@@ -1317,6 +1323,7 @@ _XimProtoSetIMValues(
168 Xfree(buf);
169 return arg->name;
170 }
171+ memset(&tmp[buf_size], 0, data_len);
172 buf = tmp;
173 }
174 }
175@@ -1458,7 +1465,7 @@ _XimProtoGetIMValues(
176 + sizeof(INT16)
177 + XIM_PAD(buf_size);
178
179- if (!(buf = Xmalloc(buf_size)))
180+ if (!(buf = Xcalloc(buf_size, 1)))
181 return arg->name;
182 buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE];
183
184@@ -1720,7 +1727,7 @@ _XimEncodingNegotiation(
185 + sizeof(CARD16)
186 + detail_len;
187
188- if (!(buf = Xmalloc(XIM_HEADER_SIZE + len)))
189+ if (!(buf = Xcalloc(XIM_HEADER_SIZE + len, 1)))
190 goto free_detail_ptr;
191
192 buf_s = (CARD16 *)&buf[XIM_HEADER_SIZE];
193@@ -1816,6 +1823,7 @@ _XimSendSavedIMValues(
194 int ret_code;
195
196 _XimGetCurrentIMValues(im, &im_values);
197+ memset(tmp_buf, 0, sizeof(tmp_buf32));
198 buf = tmp_buf;
199 buf_size = XIM_HEADER_SIZE + sizeof(CARD16) + sizeof(INT16);
200 data_len = BUFSIZE - buf_size;
201@@ -1838,7 +1846,7 @@ _XimSendSavedIMValues(
202
203 buf_size += ret_len;
204 if (buf == tmp_buf) {
205- if (!(tmp = Xmalloc(buf_size + data_len))) {
206+ if (!(tmp = Xcalloc(buf_size + data_len, 1))) {
207 return False;
208 }
209 memcpy(tmp, buf, buf_size);
210@@ -1848,6 +1856,7 @@ _XimSendSavedIMValues(
211 Xfree(buf);
212 return False;
213 }
214+ memset(&tmp[buf_size], 0, data_len);
215 buf = tmp;
216 }
217 }
218diff --git a/modules/im/ximcp/imRmAttr.c b/modules/im/ximcp/imRmAttr.c
219index 9d4e4625..118f191d 100644
220--- a/modules/im/ximcp/imRmAttr.c
221+++ b/modules/im/ximcp/imRmAttr.c
222@@ -29,6 +29,8 @@ PERFORMANCE OF THIS SOFTWARE.
223 #ifdef HAVE_CONFIG_H
224 #include <config.h>
225 #endif
226+#include <limits.h>
227+
228 #include "Xlibint.h"
229 #include "Xlcint.h"
230 #include "Ximint.h"
231@@ -214,7 +216,7 @@ _XimAttributeToValue(
232 Xic ic,
233 XIMResourceList res,
234 CARD16 *data,
235- INT16 data_len,
236+ CARD16 data_len,
237 XPointer value,
238 BITMASK32 mode)
239 {
240@@ -250,18 +252,24 @@ _XimAttributeToValue(
241
242 case XimType_XIMStyles:
243 {
244- INT16 num = data[0];
245+ CARD16 num = data[0];
246 register CARD32 *style_list = (CARD32 *)&data[2];
247 XIMStyle *style;
248 XIMStyles *rep;
249 register int i;
250 char *p;
251- int alloc_len;
252+ unsigned int alloc_len;
253
254 if (!(value))
255 return False;
256
257+ if (num > (USHRT_MAX / sizeof(XIMStyle)))
258+ return False;
259+ if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len)
260+ return False;
261 alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num;
262+ if (alloc_len < sizeof(XIMStyles))
263+ return False;
264 if (!(p = Xmalloc(alloc_len)))
265 return False;
266
267@@ -313,7 +321,7 @@ _XimAttributeToValue(
268
269 case XimType_XFontSet:
270 {
271- INT16 len = data[0];
272+ CARD16 len = data[0];
273 char *base_name;
274 XFontSet rep = (XFontSet)NULL;
275 char **missing_list = NULL;
276@@ -324,11 +332,12 @@ _XimAttributeToValue(
277 return False;
278 if (!ic)
279 return False;
280-
281+ if (len > data_len)
282+ return False;
283 if (!(base_name = Xmalloc(len + 1)))
284 return False;
285
286- (void)strncpy(base_name, (char *)&data[1], (int)len);
287+ (void)strncpy(base_name, (char *)&data[1], (size_t)len);
288 base_name[len] = '\0';
289
290 if (mode & XIM_PREEDIT_ATTR) {
291@@ -357,19 +366,25 @@ _XimAttributeToValue(
292
293 case XimType_XIMHotKeyTriggers:
294 {
295- INT32 num = *((CARD32 *)data);
296+ CARD32 num = *((CARD32 *)data);
297 register CARD32 *key_list = (CARD32 *)&data[2];
298 XIMHotKeyTrigger *key;
299 XIMHotKeyTriggers *rep;
300 register int i;
301 char *p;
302- int alloc_len;
303+ unsigned int alloc_len;
304
305 if (!(value))
306 return False;
307
308+ if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger)))
309+ return False;
310+ if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len)
311+ return False;
312 alloc_len = sizeof(XIMHotKeyTriggers)
313 + sizeof(XIMHotKeyTrigger) * num;
314+ if (alloc_len < sizeof(XIMHotKeyTriggers))
315+ return False;
316 if (!(p = Xmalloc(alloc_len)))
317 return False;
318
319--
3202.17.1
321
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
index ff60a4240c..84e0e4457e 100644
--- a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
+++ b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
@@ -12,7 +12,9 @@ PE = "1"
12 12
13SRC_URI += "file://Fix-hanging-issue-in-_XReply.patch \ 13SRC_URI += "file://Fix-hanging-issue-in-_XReply.patch \
14 file://disable_tests.patch \ 14 file://disable_tests.patch \
15 file://libx11-whitespace.patch" 15 file://libx11-whitespace.patch \
16 file://CVE-2020-14344.patch \
17"
16 18
17SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2" 19SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2"
18SRC_URI[sha256sum] = "9cc7e8d000d6193fa5af580d50d689380b8287052270f5bb26a5fb6b58b2bed1" 20SRC_URI[sha256sum] = "9cc7e8d000d6193fa5af580d50d689380b8287052270f5bb26a5fb6b58b2bed1"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-01-22 06:45:16 +0000