New branch 'debian-jessie' available with the following commits:
commit dbcea9fceb885ce42bc173a31dc6c176b7820e90
Author: Julien Cristau <[email protected]>
Date: Sat Jan 7 16:30:35 2017 +0100
Upload to jessie
commit 6e43fc2771e0ac0d90525a9f6502da1a0fc7f2a2
Author: Tobias Stoeckmann <[email protected]>
Date: Sun Sep 25 22:38:44 2016 +0200
Integer overflow on illegal server response
The 32 bit field "rep.length" is not checked for validity, which allows
an integer overflow on 32 bit systems.
A malicious server could send INT_MAX as length, which gets multiplied
by the size of XRectangle. In that case the client won't read the whole
data from server, getting out of sync.
Signed-off-by: Tobias Stoeckmann <[email protected]>
Reviewed-by: Matthieu Herrb <[email protected]>
(cherry picked from commit 61c1039ee23a2d1de712843bed3480654d7ef42e)
