Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=kdebump2.git;a=commitdiff;h=d0eceb1d9d485d23ed14e94c47819b90e9a314a2
commit d0eceb1d9d485d23ed14e94c47819b90e9a314a2 Author: Melko <[email protected]> Date: Sun Nov 2 11:35:04 2014 +0100 krfb-4.14.2-1-x86_64 * drop CVEs since already included in this version diff --git a/source/kde/krfb/CVE-2014-6053.patch b/source/kde/krfb/CVE-2014-6053.patch deleted file mode 100644 index 4f59a7b..0000000 --- a/source/kde/krfb/CVE-2014-6053.patch +++ /dev/null @@ -1,22 +0,0 @@ -commit 6037a9074d52b1963c97cb28ea1096c7c14cbf28 -Author: Nicolas Ruff <[email protected]> -Date: Mon Aug 18 15:16:16 2014 +0200 - - Check malloc() return value on client->server ClientCutText message. Client can send up to 2**32-1 bytes of text, and such a large allocation is likely to fail in case of high memory pressure. This would in a server crash (write at address 0). - -diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c -index 5f3b31d..7e43fe3 100644 ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2461,6 +2461,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - msg.cct.length = Swap32IfLE(msg.cct.length); - - str = (char *)malloc(msg.cct.length); -+ if (str == NULL) { -+ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); -+ rfbCloseClient(cl); -+ return; -+ } - - if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) { - if (n != 0) diff --git a/source/kde/krfb/CVE-2014-6054.patch b/source/kde/krfb/CVE-2014-6054.patch deleted file mode 100644 index b8225ac..0000000 --- a/source/kde/krfb/CVE-2014-6054.patch +++ /dev/null @@ -1,38 +0,0 @@ -commit 05a9bd41a8ec0a9d580a8f420f41718bdd235446 -Author: Nicolas Ruff <[email protected]> -Date: Mon Aug 18 15:22:48 2014 +0200 - - Do not accept a scaling factor of zero on PalmVNCSetScaleFactor and SetScale client->server messages. This would cause a division by zero and crash the server. - -diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c -index 7e43fe3..df7d74c 100644 ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2491,6 +2491,13 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - rfbCloseClient(cl); - return; - } -+ -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); -+ rfbCloseClient(cl); -+ return; -+ } -+ - rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); - rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); - rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); -@@ -2507,6 +2514,13 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - rfbCloseClient(cl); - return; - } -+ -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); -+ rfbCloseClient(cl); -+ return; -+ } -+ - rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); - rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); - rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); diff --git a/source/kde/krfb/CVE-2014-6055-1.patch b/source/kde/krfb/CVE-2014-6055-1.patch deleted file mode 100644 index 19a30fd..0000000 --- a/source/kde/krfb/CVE-2014-6055-1.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 20:46:27 +0000 -Subject: libvncserver: Check malloc() return value on client->server ClientCutText message. -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=d931eafccf3140d740ac61e876dce72a23ade7f4 ---- -libvncserver: Check malloc() return value on client->server ClientCutText message. - -Client can send up to 2**32-1 bytes of text, and such a large allocation -is likely to fail in case of high memory pressure. This would in a -server crash (write at address 0). - -Upstream commit: 6037a9074d52b1963c97cb28ea1096c7c14cbf28 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2404,6 +2404,12 @@ - - str = (char *)malloc(msg.cct.length); - -+ if (str == NULL) { -+ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); -+ rfbCloseClient(cl); -+ return; -+ } -+ - if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) { - if (n != 0) - rfbLogPerror("rfbProcessClientNormalMessage: read"); diff --git a/source/kde/krfb/CVE-2014-6055-2.patch b/source/kde/krfb/CVE-2014-6055-2.patch deleted file mode 100644 index 4a376f3..0000000 --- a/source/kde/krfb/CVE-2014-6055-2.patch +++ /dev/null @@ -1,39 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 20:43:38 +0000 -Subject: libnvcserver: Do not accept a scaling factor of zero. -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=126a746dd7bee35840083e9bec7a52935a010346 ---- -libnvcserver: Do not accept a scaling factor of zero. - -This would cause a division by zero and crash the server. - -Upstream commit: 05a9bd41a8ec0a9d580a8f420f41718bdd235446 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2428,6 +2428,11 @@ - rfbCloseClient(cl); - return; - } -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); -+ rfbCloseClient(cl); -+ return; -+ } - rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); - rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); - rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); -@@ -2441,6 +2446,11 @@ - sz_rfbSetScaleMsg - 1)) <= 0) { - if (n != 0) - rfbLogPerror("rfbProcessClientNormalMessage: read"); -+ rfbCloseClient(cl); -+ return; -+ } -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); - rfbCloseClient(cl); - return; - } diff --git a/source/kde/krfb/CVE-2014-6055-3.patch b/source/kde/krfb/CVE-2014-6055-3.patch deleted file mode 100644 index 9e9137d..0000000 --- a/source/kde/krfb/CVE-2014-6055-3.patch +++ /dev/null @@ -1,134 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 20:40:17 +0000 -Subject: libvncserver: Fix multiple stack-based buffer overflows in file transfer feature -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=2e211579455fd832fb21322482c005b6a85aa1bf ---- -libvncserver: Fix multiple stack-based buffer overflows in file transfer feature - -Upstream commit: 06ccdf016154fde8eccb5355613ba04c59127b2e - -CVE-2014-6055 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -1175,12 +1175,20 @@ - #define RFB_FILE_ATTRIBUTE_TEMPORARY 0x100 - #define RFB_FILE_ATTRIBUTE_COMPRESSED 0x800 - --rfbBool rfbFilenameTranslate2UNIX(rfbClientPtr cl, char *path, char *unixPath) -+rfbBool rfbFilenameTranslate2UNIX(rfbClientPtr cl, char *path, char *unixPath, size_t unixPathMaxLen) - { - int x; - char *home=NULL; - - FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, FALSE); -+ -+ /* -+ * Do not use strncpy() - truncating the file name would probably have undesirable side effects -+ * Instead check if destination buffer is big enough -+ */ -+ -+ if (strlen(path) >= unixPathMaxLen) -+ return FALSE; - - /* C: */ - if (path[0]=='C' && path[1]==':') -@@ -1190,6 +1198,10 @@ - home = getenv("HOME"); - if (home!=NULL) - { -+ /* Re-check buffer size */ -+ if ((strlen(path) + strlen(home) + 1) >= unixPathMaxLen) -+ return FALSE; -+ - strcpy(unixPath, home); - strcat(unixPath,"/"); - strcat(unixPath, path); -@@ -1227,7 +1239,9 @@ - FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, FALSE); - - /* Client thinks we are Winblows */ -- rfbFilenameTranslate2UNIX(cl, buffer, path); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, path, sizeof(path))) -+ return FALSE; -+ - - if (DB) rfbLog("rfbProcessFileTransfer() rfbDirContentRequest: rfbRDirContent: \"%s\"->\"%s\"\n",buffer, path); - -@@ -1504,7 +1518,12 @@ - /* add some space to the end of the buffer as we will be adding a timespec to it */ - if ((buffer = rfbProcessFileTransferReadBuffer(cl, length))==NULL) return FALSE; - /* The client requests a File */ -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ - cl->fileTransfer.fd=open(filename1, O_RDONLY, 0744); - - /* -@@ -1620,7 +1639,12 @@ - } - sizeHtmp = Swap32IfLE(sizeHtmp); - -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ - - /* If the file exists... We can send a rfbFileChecksums back to the client before we send an rfbFileAcceptHeader */ - /* TODO: Delta Transfer */ -@@ -1746,7 +1770,12 @@ - if ((buffer = rfbProcessFileTransferReadBuffer(cl, length))==NULL) return FALSE; - switch (contentParam) { - case rfbCDirCreate: /* Client requests the creation of a directory */ -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ - retval = mkdir(filename1, 0755); - if (DB) rfbLog("rfbProcessFileTransfer() rfbCommand: rfbCDirCreate(\"%s\"->\"%s\") %s\n", buffer, filename1, (retval==-1?"Failed":"Success")); - /* -@@ -1755,7 +1784,11 @@ - if (buffer!=NULL) free(buffer); - return retval; - case rfbCFileDelete: /* Client requests the deletion of a file */ -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } - if (stat(filename1,&statbuf)==0) - { - if (S_ISDIR(statbuf.st_mode)) -@@ -1773,8 +1806,17 @@ - { - /* Split into 2 filenames ('*' is a seperator) */ - *p = '\0'; -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -- rfbFilenameTranslate2UNIX(cl, p+1, filename2); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ -+ if (!rfbFilenameTranslate2UNIX(cl, p+1, filename2, sizeof(filename2))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } - retval = rename(filename1,filename2); - if (DB) rfbLog("rfbProcessFileTransfer() rfbCommand: rfbCFileRename(\"%s\"->\"%s\" -->> \"%s\"->\"%s\") %s\n", buffer, filename1, p+1, filename2, (retval==-1?"Failed":"Success")); - /* diff --git a/source/kde/krfb/CVE-2014-6055-4.patch b/source/kde/krfb/CVE-2014-6055-4.patch deleted file mode 100644 index dc22d82..0000000 --- a/source/kde/krfb/CVE-2014-6055-4.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 15:54:11 +0000 -Subject: libvncserver: Fix stack-based buffer overflow in rfbFileTransferOffer message, FileTime processing -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=857c2b411ed806ef806116407612a2d2a40fab9c ---- -libvncserver: Fix stack-based buffer overflow in rfbFileTransferOffer message, FileTime processing - -Upstream commit: f528072216dec01cee7ca35d94e171a3b909e677 - -CVE-2014-6055 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -1602,7 +1602,8 @@ - p = strrchr(buffer, ','); - if (p!=NULL) { - *p = '\0'; -- strcpy(szFileTime, p+1); -+ strncpy(szFileTime, p+1, sizeof(szFileTime)); -+ szFileTime[sizeof(szFileTime)-1] = '\x00'; /* ensure NULL terminating byte is present, even if copy overflowed */ - } else - szFileTime[0]=0; - diff --git a/source/kde/krfb/FrugalBuild b/source/kde/krfb/FrugalBuild index 1793c8b..51f7e78 100644 --- a/source/kde/krfb/FrugalBuild +++ b/source/kde/krfb/FrugalBuild @@ -12,17 +12,4 @@ Finclude kde depends=("${depends[@]}" "libdnssd>=$_F_kde_ver" "telepathy-qt4") makedepends=("${makedepends[@]}" "kdelibs>=$_F_kde_ver" "kdelibs-compiletime>=$_F_kde_ver") - -# FSA fix *** -source=(${source[@]} CVE-2014-6055-1.patch CVE-2014-6055-2.patch CVE-2014-6055-3.patch - CVE-2014-6055-4.patch - CVE-2014-6053.patch CVE-2014-6054.patch) -sha1sums=(${sha1sums[@]} '6556f54772be512f25082d814cdbd2a516aea183' \ - '5bee319759cebc95f8daad67e35277bcf83f5eb9' \ - '9ada7b3f4caaeba3b989e1725932826e1e3b0a13' \ - '359ee8d6ba8f187e586ee881558e8ef78bfc470b' \ - '664e92d306b8597a8b5a78bfa35c28065c19af54' \ - '78c6c8969b8c800b515d3c90339f293b6d3eab21') -# *********** - # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
