Hello community, here is the log from the commit of package libXt.1726 for openSUSE:12.2:Update checked in at 2013-06-14 16:51:22 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.2:Update/libXt.1726 (Old) and /work/SRC/openSUSE:12.2:Update/.libXt.1726.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libXt.1726" Changes: -------- New Changes file: --- /dev/null 2013-06-12 16:57:03.272031756 +0200 +++ /work/SRC/openSUSE:12.2:Update/.libXt.1726.new/libXt.changes 2013-06-14 16:51:23.000000000 +0200 @@ -0,0 +1,223 @@ +------------------------------------------------------------------- +Mon Jun 3 09:08:51 UTC 2013 - [email protected] + +- U_0001-unvalidated-length-in-_XtResourceConfigurationEH-CVE.patch + * unvalidated length in _XtResourceConfigurationEH [CVE-2013-2002] + (bnc#821670, bnc#815451) +- U_0001-Unchecked-return-values-of-XGetWindowProperty-CVE-20.patch + * Unchecked return values of XGetWindowProperty [CVE-2013-2005] + (bnc#821670, bnc#815451) + +------------------------------------------------------------------- +Thu Apr 12 06:57:56 UTC 2012 - [email protected] + +- Update to version 1.1.3: + + Revert "Treat unexpected returned events from poll as errors": + this caused regressions. +- Changes from version 1.1.2: + + Good number of bug fixes: + - Make XtAppMainLoop work without a Display + - LP64 fix for TypedArgToArg() + - add missing bound checking in FreeSelectionProperty() + - don't pop elements from array while iterating through it + - don't re-enter the WaitLoop if block is set to false + - treat unexpected returned events from poll as errors + + Initial unit tests for checking several recent fixes + + Fixes for compiler warnings + + Documentation for the libXt API moved to the DocBook/XML format + + Build configuration improvements +- Changes from version 1.1.1: + + Fix longstanding crash on 64bit sparc + + Fix memory corruption in XtAsprintf + + Build fixes +- Changes from version 1.1.0: + + Add XtAsprintf to exported API + + Bug fixes: + - various fixes related to NULL access/reference + - protect against underflow when type conversion fails in + GetResources + - fix iconic state being ignored in initial state + + Janitorial cleanups + + Build configuration improvements +- Pass --docdir=%_docdir/%name to configure to correctly install + the libXt API documentation. +- Update libXt.diff to use $(datadir) instead of /usr/share so that + it's upstreamable. + +------------------------------------------------------------------- +Sun Feb 12 01:32:17 UTC 2012 - [email protected] + +- Rename xorg-x11-libXt to libXt and utilize shlib policy + +------------------------------------------------------------------- +Sun Nov 20 06:49:19 UTC 2011 - [email protected] + +- add libtool as buildrequire to avoid implicit dependency + +------------------------------------------------------------------- +Wed Oct 5 15:20:56 UTC 2011 - [email protected] + +- cross-build fixes: use %__cc macro, export CFLAGS correctly + +------------------------------------------------------------------- +Fri Jun 17 12:18:00 UTC 2011 - [email protected] + +- escape %S in --with-xfile-search-path [bnc#697135] + +------------------------------------------------------------------- +Tue May 24 17:24:26 UTC 2011 - [email protected] + +- Add README + +------------------------------------------------------------------- +Thu May 19 16:52:16 UTC 2011 - [email protected] + +- Remove patch app-defaults.diff + Use the configure option --with-xfile-search-path to specify + the search path in the spec file. + +------------------------------------------------------------------- +Tue Dec 21 02:47:49 UTC 2010 - [email protected] + +- bumped version number to 7.6_1.0.9 + +------------------------------------------------------------------- +Wed Dec 1 11:37:41 CET 2010 - [email protected] + +- revert 'export only public API symbols' + it breaks xterm, xclock and others + +------------------------------------------------------------------- +Tue Nov 30 15:23:02 UTC 2010 - [email protected] + +- export only public API symbols +- disable silent rules, defeat the purpose of post build checks + +------------------------------------------------------------------- +Fri Oct 29 08:23:15 UTC 2010 - [email protected] + +- libXt 1.0.9 + * This release includes several bug fixes, as well as the usual + set of recent build configuration improvements & janitorial + cleanups. + +------------------------------------------------------------------- +Sat Sep 4 20:50:47 CEST 2010 - [email protected] + +- libXt 1.0.8 +- bumped version number to 7.5_1.0.8 +- make use of %fdupes macro +- fixed Summary/Group entries in -devel package + +------------------------------------------------------------------- +Sun Apr 4 15:56:53 CEST 2010 - [email protected] + +- libXt 1.0.7 +- adjusted libXt.diff +- bumped version number to 7.5 + +------------------------------------------------------------------- +Mon Dec 14 19:58:02 CET 2009 - [email protected] + +- add baselibs.conf as a source + +------------------------------------------------------------------- +Sat Nov 14 03:11:06 CET 2009 - [email protected] + +- regenerated libXt.diff +- fixed build + +------------------------------------------------------------------- +Sat Jul 4 13:39:41 CEST 2009 - [email protected] + +- libXt 1.0.6 + * bugfix release + +------------------------------------------------------------------- +Fri May 1 19:11:55 CEST 2009 - [email protected] + +- revert static library and .la file removal + for SUSE versions <= 11.1. + +------------------------------------------------------------------- +Tue Apr 21 19:23:07 CEST 2009 - [email protected] + +- remove static libraries and "la" files +- run ldconfig in postun + +------------------------------------------------------------------- +Thu Sep 11 14:22:09 CEST 2008 - [email protected] + +- bumped release number to 7.4 + +------------------------------------------------------------------- +Thu Apr 10 12:54:45 CEST 2008 - [email protected] + +- added baselibs.conf file to build xxbit packages + for multilib support + +------------------------------------------------------------------- +Sat Sep 29 12:24:00 CEST 2007 - [email protected] + +- bumped version to 7.3 + +------------------------------------------------------------------- +Mon Jan 29 12:08:33 CET 2007 - [email protected] + +- update release to 1.0.5 + * Bug 9514: Markup error in makestrs.1x man page + +------------------------------------------------------------------- +Wed Nov 8 17:07:56 CET 2006 - [email protected] + +- update release to 1.0.4 (X.Org 7.2 RC2) + * Add more generated files to ignore. + * Fix .pc file with new autotools by using AC_DEFINE_DIR. + +------------------------------------------------------------------- +Sat Oct 14 06:19:12 CEST 2006 - [email protected] + +- updated to X.Org 7.2RC1 + +------------------------------------------------------------------- +Wed Aug 2 21:26:05 CEST 2006 - [email protected] + +- completed search path for old app-defaults location + +------------------------------------------------------------------- +Wed Aug 2 16:12:33 CEST 2006 - [email protected] + +- fix setup line + +------------------------------------------------------------------- +Mon Jul 31 12:45:39 CEST 2006 - [email protected] + +- use /usr/share/X11 as default path for XtErrorDB, since this is + also the new default path for XErrorDB + ++++ 26 more lines (skipped) ++++ between /dev/null ++++ and /work/SRC/openSUSE:12.2:Update/.libXt.1726.new/libXt.changes New: ---- U_0001-Unchecked-return-values-of-XGetWindowProperty-CVE-20.patch U_0001-unvalidated-length-in-_XtResourceConfigurationEH-CVE.patch baselibs.conf libXt-1.1.3.tar.bz2 libXt.changes libXt.diff libXt.spec ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libXt.spec ++++++ # # spec file for package libXt # # Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # Name: libXt %define lname libXt6 Version: 1.1.3 Release: 0 Summary: X Toolkit Intrinsics library License: MIT Group: Development/Libraries/C and C++ Url: http://xorg.freedesktop.org/ #Git-Clone: git://anongit.freedesktop.org/xorg/lib/libXt #Git-Web: http://cgit.freedesktop.org/xorg/lib/libXt/ Source: http://xorg.freedesktop.org/releases/individual/lib/%{name}-%{version}.tar.bz2 # PATCH-FIX-UPSTREAM libXt.diff fdo#48587 -- Change path of ErrorDB from $(libdir) to $(datadir) Patch1: libXt.diff # CVE-2013-2002 Patch2: U_0001-unvalidated-length-in-_XtResourceConfigurationEH-CVE.patch # CVE-2013-2005 Patch3: U_0001-Unchecked-return-values-of-XGetWindowProperty-CVE-20.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: autoconf >= 2.60 BuildRequires: automake BuildRequires: fdupes BuildRequires: libtool BuildRequires: pkgconfig BuildRequires: pkgconfig(ice) BuildRequires: pkgconfig(kbproto) BuildRequires: pkgconfig(sm) BuildRequires: pkgconfig(x11) BuildRequires: pkgconfig(xorg-macros) >= 1.13 BuildRequires: pkgconfig(xproto) %description The low level Xlib library provides functions for interacting with an X11 server, but does not provide any function for implementing the graphical objects (widgets) used in GUIs, such as buttons, menus, etc. The Xt library provides support for creating and using widget types, but does not provide any specific widget. Specific widgets are implemented by other libraries using Xt, such as Xaw and Motif. %package -n %lname Summary: X Toolkit Intrinsics library Group: System/Libraries # O/P added for 12.2 Provides: xorg-x11-libXt = 7.6_%version-%release Obsoletes: xorg-x11-libXt < 7.6_%version-%release %description -n %lname The low level Xlib library provides functions for interacting with an X11 server, but does not provide any function for implementing the graphical objects (widgets) used in GUIs, such as buttons, menus, etc. The Xt library provides support for creating and using widget types, but does not provide any specific widget. Specific widgets are implemented by other libraries using Xt, such as Xaw and Motif. %package devel Summary: Development files for the X Toolkit Intrinsics library Group: Development/Libraries/C and C++ Requires: %lname = %version # O/P added for 12.2 Provides: xorg-x11-libXt-devel = 7.6_%version-%release Obsoletes: xorg-x11-libXt-devel < 7.6_%version-%release %description devel The low level Xlib library provides functions for interacting with an X11 server, but does not provide any function for implementing the graphical objects (widgets) used in GUIs, such as buttons, menus, etc. The Xt library provides support for creating and using widget types, but does not provide any specific widget. Specific widgets are implemented by other libraries using Xt, such as Xaw and Motif. This package contains the development headers for the library found in %lname. %prep %setup -q %patch -P 1 -p1 %patch2 -p1 %patch3 -p1 %build %configure --docdir=%_docdir/%name --disable-static make %{?_smp_mflags} %install %makeinstall rm -f "%buildroot/%_libdir"/*.la %fdupes %buildroot %post -n %lname -p /sbin/ldconfig %postun -n %lname -p /sbin/ldconfig %files -n %lname %defattr(-,root,root) %_libdir/libXt.so.6* %files devel %defattr(-,root,root) %_includedir/X11/* %_libdir/libXt.so %_libdir/pkgconfig/xt.pc %_mandir/man3/* %_docdir/%name %changelog ++++++ U_0001-Unchecked-return-values-of-XGetWindowProperty-CVE-20.patch ++++++ >From eae57493feec958bcf733ad0d334715107029f8b Mon Sep 17 00:00:00 2001 From: Alan Coopersmith <[email protected]> Date: Sat, 9 Mar 2013 11:29:21 -0800 Subject: [PATCH] Unchecked return values of XGetWindowProperty [CVE-2013-2005] Multiple functions in Selection.c assumed that XGetWindowProperty() would always set the pointer to the property, but before libX11 1.6, it could fail to do so in some cases, leading to libXt freeing or operating on an uninitialized pointer value, so libXt should always initialize the pointers and check for failure itself. Reported-by: Ilja Van Sprundel <[email protected]> Signed-off-by: Alan Coopersmith <[email protected]> --- src/Selection.c | 84 ++++++++++++++++++++++++++++++++------------------------- 1 file changed, 47 insertions(+), 37 deletions(-) Index: libXt-1.1.3/src/Selection.c =================================================================== --- libXt-1.1.3.orig/src/Selection.c +++ libXt-1.1.3/src/Selection.c @@ -839,14 +839,16 @@ static void HandleSelectionEvents( IndirectPair *p; int format; unsigned long bytesafter, length; - unsigned char *value; + unsigned char *value = NULL; ev.property = event->xselectionrequest.property; StartProtectedSection(ev.display, ev.requestor); - (void) XGetWindowProperty(ev.display, ev.requestor, + if (XGetWindowProperty(ev.display, ev.requestor, event->xselectionrequest.property, 0L, 1000000, False,(Atom)AnyPropertyType, &target, &format, &length, - &bytesafter, &value); - count = BYTELENGTH(length, format) / sizeof(IndirectPair); + &bytesafter, &value) == Success) + count = BYTELENGTH(length, format) / sizeof(IndirectPair); + else + count = 0; for (p = (IndirectPair *)value; count; p++, count--) { EndProtectedSection(ctx->dpy); if (!GetConversion(ctx, (XSelectionRequestEvent*)event, @@ -1053,9 +1055,10 @@ static Boolean IsINCRtype( if (prop == None) return False; - (void)XGetWindowProperty(XtDisplay(info->widget), window, prop, 0L, 0L, - False, info->ctx->prop_list->incr_atom, - &type, &format, &length, &bytesafter, &value); + if (XGetWindowProperty(XtDisplay(info->widget), window, prop, 0L, 0L, + False, info->ctx->prop_list->incr_atom, &type, + &format, &length, &bytesafter, &value) != Success) + return False; return (type == info->ctx->prop_list->incr_atom); } @@ -1069,7 +1072,6 @@ static void ReqCleanup( { CallBackInfo info = (CallBackInfo)closure; unsigned long bytesafter, length; - char *value; int format; Atom target; @@ -1093,17 +1095,19 @@ static void ReqCleanup( (ev->xproperty.state == PropertyNewValue) && (ev->xproperty.atom == info->property)) { XPropertyEvent *event = (XPropertyEvent *) ev; - (void) XGetWindowProperty(event->display, XtWindow(widget), - event->atom, 0L, 1000000, True, AnyPropertyType, - &target, &format, &length, &bytesafter, - (unsigned char **) &value); - XFree(value); - if (length == 0) { - XtRemoveEventHandler(widget, (EventMask) PropertyChangeMask, FALSE, - ReqCleanup, (XtPointer) info ); - FreeSelectionProperty(XtDisplay(widget), info->property); - XtFree(info->value); /* requestor never got this, so free now */ - FreeInfo(info); + char *value = NULL; + if (XGetWindowProperty(event->display, XtWindow(widget), + event->atom, 0L, 1000000, True, AnyPropertyType, + &target, &format, &length, &bytesafter, + (unsigned char **) &value) == Success) { + XFree(value); + if (length == 0) { + XtRemoveEventHandler(widget, (EventMask) PropertyChangeMask, + FALSE, ReqCleanup, (XtPointer) info ); + FreeSelectionProperty(XtDisplay(widget), info->property); + XtFree(info->value); /* requestor never got this, so free now */ + FreeInfo(info); + } } } } @@ -1121,20 +1125,23 @@ static void ReqTimedOut( unsigned long bytesafter; unsigned long proplength; Atom type; - IndirectPair *pairs; XtPointer *c; int i; if (*info->target == info->ctx->prop_list->indirect_atom) { - (void) XGetWindowProperty(XtDisplay(info->widget), - XtWindow(info->widget), info->property, 0L, - 10000000, True, AnyPropertyType, &type, &format, - &proplength, &bytesafter, (unsigned char **) &pairs); - XFree((char*)pairs); - for (proplength = proplength / IndirectPairWordSize, i = 0, c = info->req_closure; - proplength; proplength--, c++, i++) - (*info->callbacks[i])(info->widget, *c, - &info->ctx->selection, &resulttype, value, &length, &format); + IndirectPair *pairs = NULL; + if (XGetWindowProperty(XtDisplay(info->widget), XtWindow(info->widget), + info->property, 0L, 10000000, True, + AnyPropertyType, &type, &format, &proplength, + &bytesafter, (unsigned char **) &pairs) + == Success) { + XFree(pairs); + for (proplength = proplength / IndirectPairWordSize, i = 0, + c = info->req_closure; + proplength; proplength--, c++, i++) + (*info->callbacks[i])(info->widget, *c, &info->ctx->selection, + &resulttype, value, &length, &format); + } } else { (*info->callbacks[0])(info->widget, *info->req_closure, &info->ctx->selection, &resulttype, value, &length, &format); @@ -1280,12 +1287,13 @@ Boolean HandleNormal( unsigned long length; int format; Atom type; - unsigned char *value; + unsigned char *value = NULL; int number = info->current; - (void) XGetWindowProperty(dpy, XtWindow(widget), property, 0L, - 10000000, False, AnyPropertyType, - &type, &format, &length, &bytesafter, &value); + if (XGetWindowProperty(dpy, XtWindow(widget), property, 0L, 10000000, + False, AnyPropertyType, &type, &format, &length, + &bytesafter, &value) != Success) + return FALSE; if (type == info->ctx->prop_list->incr_atom) { unsigned long size = IncrPropSize(widget, value, format, length); @@ -1370,7 +1378,6 @@ static void HandleSelectionReplies( Display *dpy = event->display; CallBackInfo info = (CallBackInfo) closure; Select ctx = info->ctx; - IndirectPair *pairs, *p; unsigned long bytesafter; unsigned long length; int format; @@ -1385,9 +1392,12 @@ static void HandleSelectionReplies( XtRemoveEventHandler(widget, (EventMask)0, TRUE, HandleSelectionReplies, (XtPointer) info ); if (event->target == ctx->prop_list->indirect_atom) { - (void) XGetWindowProperty(dpy, XtWindow(widget), info->property, 0L, - 10000000, True, AnyPropertyType, &type, &format, - &length, &bytesafter, (unsigned char **) &pairs); + IndirectPair *pairs = NULL, *p; + if (XGetWindowProperty(dpy, XtWindow(widget), info->property, 0L, + 10000000, True, AnyPropertyType, &type, &format, + &length, &bytesafter, (unsigned char **) &pairs) + != Success) + length = 0; for (length = length / IndirectPairWordSize, p = pairs, c = info->req_closure; length; length--, p++, c++, info->current++) { ++++++ U_0001-unvalidated-length-in-_XtResourceConfigurationEH-CVE.patch ++++++ >From 9264a21b688891dbdcee630ff72cf39aa75fc4e1 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith <[email protected]> Date: Sat, 9 Mar 2013 11:44:14 -0800 Subject: [PATCH] unvalidated length in _XtResourceConfigurationEH [CVE-2013-2002] The RCM_DATA property is expected to be in the format: resource_length, resource, value If the property contains a resource_length thats results in a pointer outside the property string, memory corruption can occur. Reported-by: Ilja Van Sprundel <[email protected]> Signed-off-by: Alan Coopersmith <[email protected]> --- src/ResConfig.c | 41 ++++++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 15 deletions(-) Index: libXt-1.1.3/src/ResConfig.c =================================================================== --- libXt-1.1.3.orig/src/ResConfig.c +++ libXt-1.1.3/src/ResConfig.c @@ -971,26 +971,37 @@ _XtResourceConfigurationEH ( * resource and value fields. */ if (data) { + char *data_end = data + nitems; + char *data_value; + resource_len = Strtoul ((void *)data, &data_ptr, 10); - data_ptr++; - data_ptr[resource_len] = '\0'; + if (data_ptr != (char *) data) { + data_ptr++; + data_value = data_ptr + resource_len; + } else /* strtoul failed to convert a number */ + data_ptr = data_value = NULL; + + if (data_value > data_ptr && data_value < data_end) { + *data_value++ = '\0'; - resource = XtNewString (data_ptr); - value = XtNewString (&data_ptr[resource_len + 1]); + resource = XtNewString (data_ptr); + value = XtNewString (data_value); #ifdef DEBUG - fprintf (stderr, "resource_len=%d\n",resource_len); - fprintf (stderr, "resource = %s\t value = %s\n", - resource, value); + fprintf (stderr, "resource_len=%d\n" + resource_len); + fprintf (stderr, "resource = %s\t value = %s\n", + resource, value); #endif - /* - * descend the application widget tree and - * apply the value to the appropriate widgets - */ - _search_widget_tree (w, resource, value); + /* + * descend the application widget tree and + * apply the value to the appropriate widgets + */ + _search_widget_tree (w, resource, value); - XtFree (resource); - XtFree (value); + XtFree (resource); + XtFree (value); + } } } ++++++ baselibs.conf ++++++ libXt6 provides "xorg-x11-libXt-<targettype> = 7.6_<version>" obsoletes "xorg-x11-libXt-<targettype> < 7.6_<version>" libXt-devel requires -libXt-<targettype> requires "libXt6-<targettype> = <version>" provides "xorg-x11-libXt-devel-<targettype> = 7.6_<version>" obsoletes "xorg-x11-libXt-devel-<targettype> < 7.6_<version>" ++++++ libXt.diff ++++++ Index: libXt-1.1.3/src/Makefile.am =================================================================== --- libXt-1.1.3.orig/src/Makefile.am +++ libXt-1.1.3/src/Makefile.am @@ -4,7 +4,7 @@ BUILT_SOURCES = $(BUILT_FILES) CLEANFILES = $(BUILT_SOURCES) SRCH_DEFINES = -DXFILESEARCHPATHDEFAULT=\"$(XFILESEARCHPATHDEFAULT)\" -ERRORDB_DEFINES = -DERRORDB=\"$(libdir)/X11/XtErrorDB\" +ERRORDB_DEFINES = -DERRORDB=\"$(datadir)/X11/XtErrorDB\" AM_CFLAGS = $(CWARNFLAGS) $(XT_CFLAGS) $(SRCH_DEFINES) $(ERRORDB_DEFINES) \ $(XTMALLOC_ZERO_CFLAGS) Index: libXt-1.1.3/xt.pc.in =================================================================== --- libXt-1.1.3.orig/xt.pc.in +++ libXt-1.1.3/xt.pc.in @@ -1,5 +1,6 @@ prefix=@prefix@ exec_prefix=@exec_prefix@ +datarootdir=@datarootdir@ libdir=@libdir@ includedir=@includedir@ appdefaultdir=@appdefaultdir@ -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
