Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by George Sherwood (14755682c3ed01176e4e9bdc4d5bfcc0780ea260)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: George Sherwood <scm AT mail.sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by George Sherwood (14755682c3ed01176e4e9bdc4d5bfcc0780ea260)
  • Date: Tue, 2 Jan 2007 08:09:11 -0600

GIT changes to master grimoire by George Sherwood <chat AT sourcemage.org>:

x11-libs/xorg/DETAILS | 2
x11-libs/xorg/HISTORY | 5 +
x11-libs/xorg/PRE_BUILD | 3 -
x11-libs/xorg/x11r6.9.0-cidfonts.diff | 96
++++++++++++++++++++++++++++++++++
4 files changed, 104 insertions(+), 2 deletions(-)

New commits:
commit 14755682c3ed01176e4e9bdc4d5bfcc0780ea260
Author: George Sherwood <chat AT sourcemage.org>
Commit: George Sherwood <chat AT sourcemage.org>

xorg: Updated for CVE-2006-3739/3740. Bug 13115.

diff --git a/x11-libs/xorg/DETAILS b/x11-libs/xorg/DETAILS
index da18de2..f1e8cec 100755
--- a/x11-libs/xorg/DETAILS
+++ b/x11-libs/xorg/DETAILS
@@ -15,7 +15,7 @@ SOURCE_DIRECTORY=$BUILD_DIRECTORY/xc
SOURCE_URL[1]=ftp://ftp.x.org/pub/${XVERSION}/src-single/$SOURCE
#
SOURCE_HASH=sha512:8fe05f9e4ca1eb44fd344ce226c023a5904c0d94af9e769f8d24ea64f4695ed6904b2238acc16bea00637852de7cbd3241cb59f1af66e1d147dc4897308419bb
SOURCE_GPG=gurus.gpg:$SOURCE.sig:WORKS_FOR_ME
- SECURITY_PATCH=2
+ SECURITY_PATCH=3
PATCHLEVEL=1
fi
WEB_SITE=http://xorg.freedesktop.org/
diff --git a/x11-libs/xorg/HISTORY b/x11-libs/xorg/HISTORY
index 5c3284d..fc15448 100644
--- a/x11-libs/xorg/HISTORY
+++ b/x11-libs/xorg/HISTORY
@@ -1,3 +1,8 @@
+2007-01-02 George Sherwood <george AT beernabeer.com>
+ * DETAILS: SECURITY_PATCH++. Bug 13115.
+ * PRE_BUILD: Added patch.
+ * x11r6.9.0-cidfonts.diff: Added for CVE-2006-3739/3740
+
2006-11-17 George Sherwood <george AT beernabeer.com>
* DETAILS: Update PATCHLEVEL=1
* PRE_BUILD: Added patch for freetype-2.2.1
diff --git a/x11-libs/xorg/PRE_BUILD b/x11-libs/xorg/PRE_BUILD
index a73f0cf..41a30a6 100755
--- a/x11-libs/xorg/PRE_BUILD
+++ b/x11-libs/xorg/PRE_BUILD
@@ -5,7 +5,8 @@ cd $SOURCE_DIRECTORY &&
if [[ $X_LATEST != y ]]; then
patch -p0 < $SCRIPT_DIRECTORY/x11r6.9.0-freetype-2.2.1.patch &&
patch -p0 < $SCRIPT_DIRECTORY/x11r6.9.0-geteuid.diff &&
- patch -p0 < $SCRIPT_DIRECTORY/x11r6.9.0-mitri.diff
+ patch -p0 < $SCRIPT_DIRECTORY/x11r6.9.0-mitri.diff &&
+ patch -p0 < $SCRIPT_DIRECTORY/x11r6.9.0-cidfonts.diff
fi &&

cp $SOURCE_DIRECTORY/config/cf/xorgsite.def \
diff --git a/x11-libs/xorg/x11r6.9.0-cidfonts.diff
b/x11-libs/xorg/x11r6.9.0-cidfonts.diff
new file mode 100644
index 0000000..035328e
--- /dev/null
+++ b/x11-libs/xorg/x11r6.9.0-cidfonts.diff
@@ -0,0 +1,96 @@
+Index: lib/font/Type1/afm.c
+===================================================================
+RCS file: /cvs/xorg/xc/lib/font/Type1/afm.c,v
+retrieving revision 1.5
+diff -u -u -r1.5 afm.c
+--- lib/font/Type1/afm.c 9 Jul 2005 23:30:06 -0000 1.5
++++ lib/font/Type1/afm.c 12 Sep 2006 07:49:46 -0000
+@@ -29,6 +29,7 @@
+ #include <stdio.h>
+ #include <string.h>
+ #include <stdlib.h>
++#include <limits.h>
+ #else
+ #include "Xmd.h" /* For INT32 declaration */
+ #include "Xdefs.h" /* For Bool */
+@@ -118,6 +119,11 @@
+
+ fi->nChars = atoi(p);
+
++ if (fi->nChars < 0 || fi->nChars > INT_MAX / sizeof(Metrics)) {
++ xfree(afmbuf);
++ xfree(fi);
++ return(1);
++ }
+ fi->metrics = (Metrics *)xalloc(fi->nChars *
+ sizeof(Metrics));
+ if (fi->metrics == NULL) {
+Index: lib/font/Type1/scanfont.c
+===================================================================
+RCS file: /cvs/xorg/xc/lib/font/Type1/scanfont.c,v
+retrieving revision 1.5
+diff -u -u -r1.5 scanfont.c
+--- lib/font/Type1/scanfont.c 9 Jul 2005 23:30:06 -0000 1.5
++++ lib/font/Type1/scanfont.c 12 Sep 2006 07:49:46 -0000
+@@ -57,6 +57,7 @@
+
+ #ifndef FONTMODULE
+ #include <string.h>
++#include <limits.h>
+ #else
+ #include "Xdefs.h" /* Bool declaration */
+ #include "Xmd.h" /* INT32 declaration */
+@@ -654,6 +655,7 @@
+ arrayP->data.valueP = tokenStartP;
+
+ /* allocate FDArray */
++ /* No integer overflow since arrayP->len is unsigned short */
+ FDArrayP = (psfont *)vm_alloc(arrayP->len*(sizeof(psfont)));
+ if (!(FDArrayP)) return(SCAN_OUT_OF_MEMORY);
+
+@@ -850,7 +852,8 @@
+ }
+ return(SCAN_OK);
+ }
+-
++ if (N > INT_MAX / sizeof(psobj))
++ return (SCAN_ERROR);
+ arrayP = (psobj *)vm_alloc(N*sizeof(psobj));
+ if (!(arrayP) ) return(SCAN_OUT_OF_MEMORY);
+ FontP->Subrs.len = N;
+@@ -911,7 +914,7 @@
+ }
+ else return(rc); /* if next token was not an Int */
+ }
+- if (N<=0) return(SCAN_ERROR);
++ if (N<=0 || N > INT_MAX / sizeof(psdict)) return(SCAN_ERROR);
+ /* save number of entries in the dictionary */
+
+ dictP = (psdict *)vm_alloc((N+1)*sizeof(psdict));
+@@ -1719,6 +1722,10 @@
+ if (tokenType == TOKEN_INTEGER)
+ rangecnt = tokenValue.integer;
+
++ if (rangecnt < 0 || rangecnt > INT_MAX / sizeof(spacerangecode)) {
++ rc = SCAN_ERROR;
++ break;
++ }
+ /* ==> tokenLength, tokenTooLong, tokenType, and */
+ /* tokenValue are now set */
+
+Index: lib/font/Type1/util.c
+===================================================================
+RCS file: /cvs/xorg/xc/lib/font/Type1/util.c,v
+retrieving revision 1.5
+diff -u -u -r1.5 util.c
+--- lib/font/Type1/util.c 9 Jul 2005 23:30:07 -0000 1.5
++++ lib/font/Type1/util.c 12 Sep 2006 07:49:46 -0000
+@@ -104,7 +104,7 @@
+ bytes = (bytes + 7) & ~7;
+
+ /* Allocate the space, if it is available */
+- if (bytes <= vm_free) {
++ if (bytes > 0 && bytes <= vm_free) {
+ answer = vm_next;
+ vm_free -= bytes;
+ vm_next += bytes;



  • [SM-Commit] GIT changes to master grimoire by George Sherwood (14755682c3ed01176e4e9bdc4d5bfcc0780ea260), George Sherwood, 01/02/2007

Archive powered by MHonArc 2.6.24.

Top of Page