From owner-svn-ports-head@FreeBSD.ORG Thu Feb 12 19:58:42 2015 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BCE5018C; Thu, 12 Feb 2015 19:58:42 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id A6BA0234; Thu, 12 Feb 2015 19:58:42 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t1CJwgNl069691; Thu, 12 Feb 2015 19:58:42 GMT (envelope-from kwm@FreeBSD.org) Received: (from kwm@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t1CJwgeF069689; Thu, 12 Feb 2015 19:58:42 GMT (envelope-from kwm@FreeBSD.org) Message-Id: <201502121958.t1CJwgeF069689@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: kwm set sender to kwm@FreeBSD.org using -f From: Koop Mast Date: Thu, 12 Feb 2015 19:58:42 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r378889 - in head/x11-servers/xorg-server: . files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Feb 2015 19:58:42 -0000 Author: kwm Date: Thu Feb 12 19:58:41 2015 New Revision: 378889 URL: https://svnweb.freebsd.org/changeset/ports/378889 QAT: https://qat.redports.org/buildarchive/r378889/ Log: Fix CVE-2015-0255. Information leak in the XkbSetGeometry request of X servers. Submitted by: http://lists.freedesktop.org/archives/xorg/2015-February/057158.html Obtained from: upstream MFH: 2015Q1 Added: head/x11-servers/xorg-server/files/patch-CVE-2015-0255 (contents, props changed) Modified: head/x11-servers/xorg-server/Makefile Modified: head/x11-servers/xorg-server/Makefile ============================================================================== --- head/x11-servers/xorg-server/Makefile Thu Feb 12 19:56:45 2015 (r378888) +++ head/x11-servers/xorg-server/Makefile Thu Feb 12 19:58:41 2015 (r378889) @@ -3,7 +3,7 @@ PORTNAME?= xorg-server PORTVERSION= 1.14.7 -PORTREVISION?= 1 +PORTREVISION?= 2 PORTEPOCH?= 1 CATEGORIES= x11-servers MASTER_SITES= XORG Added: head/x11-servers/xorg-server/files/patch-CVE-2015-0255 ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/x11-servers/xorg-server/files/patch-CVE-2015-0255 Thu Feb 12 19:58:41 2015 (r378889) @@ -0,0 +1,175 @@ +This patch has two commits. One is needed to address the CVE the other +is allow the patch to apply. + +http://lists.freedesktop.org/archives/xorg/2015-February/057158.html + +http://cgit.freedesktop.org/xorg/xserver/patch/?id=20079c36cf7d377938ca5478447d8b9045cb7d43 +http://cgit.freedesktop.org/xorg/xserver/patch/?id=81c90dc8f0aae3b65730409b1b615b5fa7280ebd + +--- xkb/xkb.c.orig 2015-02-12 20:30:54.131767000 +0100 ++++ xkb/xkb.c 2015-02-12 20:31:01.849633000 +0100 +@@ -4958,26 +4958,29 @@ ProcXkbGetGeometry(ClientPtr client) + + /***====================================================================***/ + +-static char * +-_GetCountedString(char **wire_inout, Bool swap) ++static Status ++_GetCountedString(char **wire_inout, ClientPtr client, char **str) + { +- char *wire, *str; +- CARD16 len, *plen; ++ char *wire, *next; ++ CARD16 len; + + wire = *wire_inout; +- plen = (CARD16 *) wire; +- if (swap) { +- swaps(plen); +- } +- len = *plen; +- str = malloc(len + 1); +- if (str) { +- memcpy(str, &wire[2], len); +- str[len] = '\0'; ++ len = *(CARD16 *) wire; ++ if (client->swapped) { ++ swaps(&len); + } +- wire += XkbPaddedSize(len + 2); +- *wire_inout = wire; +- return str; ++ next = wire + XkbPaddedSize(len + 2); ++ /* Check we're still within the size of the request */ ++ if (client->req_len < ++ bytes_to_int32(next - (char *) client->requestBuffer)) ++ return BadValue; ++ *str = malloc(len + 1); ++ if (!*str) ++ return BadAlloc; ++ memcpy(*str, &wire[2], len); ++ *(*str + len) = '\0'; ++ *wire_inout = next; ++ return Success; + } + + static Status +@@ -4986,25 +4989,29 @@ _CheckSetDoodad(char **wire_inout, + { + char *wire; + xkbDoodadWireDesc *dWire; ++ xkbAnyDoodadWireDesc any; ++ xkbTextDoodadWireDesc text; + XkbDoodadPtr doodad; ++ Status status; + + dWire = (xkbDoodadWireDesc *) (*wire_inout); ++ any = dWire->any; + wire = (char *) &dWire[1]; + if (client->swapped) { +- swapl(&dWire->any.name); +- swaps(&dWire->any.top); +- swaps(&dWire->any.left); +- swaps(&dWire->any.angle); ++ swapl(&any.name); ++ swaps(&any.top); ++ swaps(&any.left); ++ swaps(&any.angle); + } + CHK_ATOM_ONLY(dWire->any.name); +- doodad = XkbAddGeomDoodad(geom, section, dWire->any.name); ++ doodad = XkbAddGeomDoodad(geom, section, any.name); + if (!doodad) + return BadAlloc; + doodad->any.type = dWire->any.type; + doodad->any.priority = dWire->any.priority; +- doodad->any.top = dWire->any.top; +- doodad->any.left = dWire->any.left; +- doodad->any.angle = dWire->any.angle; ++ doodad->any.top = any.top; ++ doodad->any.left = any.left; ++ doodad->any.angle = any.angle; + switch (doodad->any.type) { + case XkbOutlineDoodad: + case XkbSolidDoodad: +@@ -5027,15 +5034,22 @@ _CheckSetDoodad(char **wire_inout, + dWire->text.colorNdx); + return BadMatch; + } ++ text = dWire->text; + if (client->swapped) { +- swaps(&dWire->text.width); +- swaps(&dWire->text.height); ++ swaps(&text.width); ++ swaps(&text.height); + } +- doodad->text.width = dWire->text.width; +- doodad->text.height = dWire->text.height; ++ doodad->text.width = text.width; ++ doodad->text.height = text.height; + doodad->text.color_ndx = dWire->text.colorNdx; +- doodad->text.text = _GetCountedString(&wire, client->swapped); +- doodad->text.font = _GetCountedString(&wire, client->swapped); ++ status = _GetCountedString(&wire, client, &doodad->text.text); ++ if (status != Success) ++ return status; ++ status = _GetCountedString(&wire, client, &doodad->text.font); ++ if (status != Success) { ++ free (doodad->text.text); ++ return status; ++ } + break; + case XkbIndicatorDoodad: + if (dWire->indicator.onColorNdx >= geom->num_colors) { +@@ -5070,7 +5084,9 @@ _CheckSetDoodad(char **wire_inout, + } + doodad->logo.color_ndx = dWire->logo.colorNdx; + doodad->logo.shape_ndx = dWire->logo.shapeNdx; +- doodad->logo.logo_name = _GetCountedString(&wire, client->swapped); ++ status = _GetCountedString(&wire, client, &doodad->logo.logo_name); ++ if (status != Success) ++ return status; + break; + default: + client->errorValue = _XkbErrCode2(0x4F, dWire->any.type); +@@ -5302,18 +5318,20 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe + char *wire; + + wire = (char *) &req[1]; +- geom->label_font = _GetCountedString(&wire, client->swapped); ++ status = _GetCountedString(&wire, client, &geom->label_font); ++ if (status != Success) ++ return status; + + for (i = 0; i < req->nProperties; i++) { + char *name, *val; + +- name = _GetCountedString(&wire, client->swapped); +- if (!name) +- return BadAlloc; +- val = _GetCountedString(&wire, client->swapped); +- if (!val) { ++ status = _GetCountedString(&wire, client, &name); ++ if (status != Success) ++ return status; ++ status = _GetCountedString(&wire, client, &val); ++ if (status != Success) { + free(name); +- return BadAlloc; ++ return status; + } + if (XkbAddGeomProperty(geom, name, val) == NULL) { + free(name); +@@ -5347,9 +5365,9 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSe + for (i = 0; i < req->nColors; i++) { + char *name; + +- name = _GetCountedString(&wire, client->swapped); +- if (!name) +- return BadAlloc; ++ status = _GetCountedString(&wire, client, &name); ++ if (status != Success) ++ return status; + if (!XkbAddGeomColor(geom, name, geom->num_colors)) { + free(name); + return BadAlloc;