Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=mcirstabumps.git;a=commitdiff;h=a9e62658e5b20dce23cbfdbffd297fc0df5cc838
commit a9e62658e5b20dce23cbfdbffd297fc0df5cc838 Author: DeX77 <[email protected]> Date: Fri Jul 3 10:48:23 2015 +0200 libvncserver-0.9.10-1-x86_64 * version bump (needed for remmina) diff --git a/source/xlib/libvncserver/CVE-2014-6051.patch b/source/xlib/libvncserver/CVE-2014-6051.patch deleted file mode 100644 index ee6598c..0000000 --- a/source/xlib/libvncserver/CVE-2014-6051.patch +++ /dev/null @@ -1,42 +0,0 @@ -commit 045a044e8ae79db9244593fbce154cdf6e843273 -Author: newsoft <[email protected]> -Date: Fri Aug 15 16:31:13 2014 +0200 - - Fix integer overflow in MallocFrameBuffer() - - Promote integers to uint64_t to avoid integer overflow issue during - frame buffer allocation for very large screen sizes - -diff --git a/libvncclient/vncviewer.c b/libvncclient/vncviewer.c -index 3b16a6f..24bc6f8 100644 ---- a/libvncclient/vncviewer.c -+++ b/libvncclient/vncviewer.c -@@ -82,9 +82,27 @@ static char* ReadPassword(rfbClient* client) { - #endif - } - static rfbBool MallocFrameBuffer(rfbClient* client) { -+uint64_t allocSize; -+ - if(client->frameBuffer) - free(client->frameBuffer); -- client->frameBuffer=malloc(client->width*client->height*client->format.bitsPerPixel/8); -+ -+ /* SECURITY: promote 'width' into uint64_t so that the multiplication does not overflow -+ 'width' and 'height' are 16-bit integers per RFB protocol design -+ SIZE_MAX is the maximum value that can fit into size_t -+ */ -+ allocSize = (uint64_t)client->width * client->height * client->format.bitsPerPixel/8; -+ -+ if (allocSize >= SIZE_MAX) { -+ rfbClientErr("CRITICAL: cannot allocate frameBuffer, requested size is too large\n"); -+ return FALSE; -+ } -+ -+ client->frameBuffer=malloc( (size_t)allocSize ); -+ -+ if (client->frameBuffer == NULL) -+ rfbClientErr("CRITICAL: frameBuffer allocation failed, requested size too large or not enough memory?\n"); -+ - return client->frameBuffer?TRUE:FALSE; - } - diff --git a/source/xlib/libvncserver/CVE-2014-6052-1.patch b/source/xlib/libvncserver/CVE-2014-6052-1.patch deleted file mode 100644 index 8201696..0000000 --- a/source/xlib/libvncserver/CVE-2014-6052-1.patch +++ /dev/null @@ -1,47 +0,0 @@ -diff -Naur LibVNCServer-0.9.9/libvncclient/rfbproto.c LibVNCServer-0.9.9.new/libvncclient/rfbproto.c ---- LibVNCServer-0.9.9/libvncclient/rfbproto.c 2012-05-04 16:19:00.000000000 +0200 -+++ LibVNCServer-0.9.9.new/libvncclient/rfbproto.c 2014-09-27 09:40:13.675884700 +0200 -@@ -1807,7 +1807,8 @@ - client->updateRect.x = client->updateRect.y = 0; - client->updateRect.w = client->width; - client->updateRect.h = client->height; -- client->MallocFrameBuffer(client); -+ if (!client->MallocFrameBuffer(client)) -+ return FALSE; - SendFramebufferUpdateRequest(client, 0, 0, rect.r.w, rect.r.h, FALSE); - rfbClientLog("Got new framebuffer size: %dx%d\n", rect.r.w, rect.r.h); - continue; -@@ -2260,7 +2261,8 @@ - client->updateRect.x = client->updateRect.y = 0; - client->updateRect.w = client->width; - client->updateRect.h = client->height; -- client->MallocFrameBuffer(client); -+ if (!client->MallocFrameBuffer(client)) -+ return FALSE; - SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE); - rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height); - break; -@@ -2276,7 +2278,9 @@ - client->updateRect.x = client->updateRect.y = 0; - client->updateRect.w = client->width; - client->updateRect.h = client->height; -- client->MallocFrameBuffer(client); -+ if (!client->MallocFrameBuffer(client)) -+ return FALSE; -+ - SendFramebufferUpdateRequest(client, 0, 0, client->width, client->height, FALSE); - rfbClientLog("Got new framebuffer size: %dx%d\n", client->width, client->height); - break; -diff -Naur LibVNCServer-0.9.9/libvncclient/vncviewer.c LibVNCServer-0.9.9.new/libvncclient/vncviewer.c ---- LibVNCServer-0.9.9/libvncclient/vncviewer.c 2012-05-04 16:19:00.000000000 +0200 -+++ LibVNCServer-0.9.9.new/libvncclient/vncviewer.c 2014-09-27 09:38:01.323314600 +0200 -@@ -225,7 +225,8 @@ - - client->width=client->si.framebufferWidth; - client->height=client->si.framebufferHeight; -- client->MallocFrameBuffer(client); -+ if (!client->MallocFrameBuffer(client)) -+ return FALSE; - - if (!SetFormatAndEncodings(client)) - return FALSE; diff --git a/source/xlib/libvncserver/CVE-2014-6053.patch b/source/xlib/libvncserver/CVE-2014-6053.patch deleted file mode 100644 index 4f59a7b..0000000 --- a/source/xlib/libvncserver/CVE-2014-6053.patch +++ /dev/null @@ -1,22 +0,0 @@ -commit 6037a9074d52b1963c97cb28ea1096c7c14cbf28 -Author: Nicolas Ruff <[email protected]> -Date: Mon Aug 18 15:16:16 2014 +0200 - - Check malloc() return value on client->server ClientCutText message. Client can send up to 2**32-1 bytes of text, and such a large allocation is likely to fail in case of high memory pressure. This would in a server crash (write at address 0). - -diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c -index 5f3b31d..7e43fe3 100644 ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2461,6 +2461,11 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - msg.cct.length = Swap32IfLE(msg.cct.length); - - str = (char *)malloc(msg.cct.length); -+ if (str == NULL) { -+ rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); -+ rfbCloseClient(cl); -+ return; -+ } - - if ((n = rfbReadExact(cl, str, msg.cct.length)) <= 0) { - if (n != 0) diff --git a/source/xlib/libvncserver/CVE-2014-6054.patch b/source/xlib/libvncserver/CVE-2014-6054.patch deleted file mode 100644 index b8225ac..0000000 --- a/source/xlib/libvncserver/CVE-2014-6054.patch +++ /dev/null @@ -1,38 +0,0 @@ -commit 05a9bd41a8ec0a9d580a8f420f41718bdd235446 -Author: Nicolas Ruff <[email protected]> -Date: Mon Aug 18 15:22:48 2014 +0200 - - Do not accept a scaling factor of zero on PalmVNCSetScaleFactor and SetScale client->server messages. This would cause a division by zero and crash the server. - -diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c -index 7e43fe3..df7d74c 100644 ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2491,6 +2491,13 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - rfbCloseClient(cl); - return; - } -+ -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); -+ rfbCloseClient(cl); -+ return; -+ } -+ - rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); - rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); - rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); -@@ -2507,6 +2514,13 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - rfbCloseClient(cl); - return; - } -+ -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); -+ rfbCloseClient(cl); -+ return; -+ } -+ - rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); - rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); - rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); diff --git a/source/xlib/libvncserver/CVE-2014-6055-2.patch b/source/xlib/libvncserver/CVE-2014-6055-2.patch deleted file mode 100644 index 4a376f3..0000000 --- a/source/xlib/libvncserver/CVE-2014-6055-2.patch +++ /dev/null @@ -1,39 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 20:43:38 +0000 -Subject: libnvcserver: Do not accept a scaling factor of zero. -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=126a746dd7bee35840083e9bec7a52935a010346 ---- -libnvcserver: Do not accept a scaling factor of zero. - -This would cause a division by zero and crash the server. - -Upstream commit: 05a9bd41a8ec0a9d580a8f420f41718bdd235446 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -2428,6 +2428,11 @@ - rfbCloseClient(cl); - return; - } -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); -+ rfbCloseClient(cl); -+ return; -+ } - rfbStatRecordMessageRcvd(cl, msg.type, sz_rfbSetScaleMsg, sz_rfbSetScaleMsg); - rfbLog("rfbSetScale(%d)\n", msg.ssc.scale); - rfbScalingSetup(cl,cl->screen->width/msg.ssc.scale, cl->screen->height/msg.ssc.scale); -@@ -2441,6 +2446,11 @@ - sz_rfbSetScaleMsg - 1)) <= 0) { - if (n != 0) - rfbLogPerror("rfbProcessClientNormalMessage: read"); -+ rfbCloseClient(cl); -+ return; -+ } -+ if (msg.ssc.scale == 0) { -+ rfbLogPerror("rfbProcessClientNormalMessage: will not accept a scale factor of zero"); - rfbCloseClient(cl); - return; - } diff --git a/source/xlib/libvncserver/CVE-2014-6055-3.patch b/source/xlib/libvncserver/CVE-2014-6055-3.patch deleted file mode 100644 index 9e9137d..0000000 --- a/source/xlib/libvncserver/CVE-2014-6055-3.patch +++ /dev/null @@ -1,134 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 20:40:17 +0000 -Subject: libvncserver: Fix multiple stack-based buffer overflows in file transfer feature -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=2e211579455fd832fb21322482c005b6a85aa1bf ---- -libvncserver: Fix multiple stack-based buffer overflows in file transfer feature - -Upstream commit: 06ccdf016154fde8eccb5355613ba04c59127b2e - -CVE-2014-6055 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -1175,12 +1175,20 @@ - #define RFB_FILE_ATTRIBUTE_TEMPORARY 0x100 - #define RFB_FILE_ATTRIBUTE_COMPRESSED 0x800 - --rfbBool rfbFilenameTranslate2UNIX(rfbClientPtr cl, char *path, char *unixPath) -+rfbBool rfbFilenameTranslate2UNIX(rfbClientPtr cl, char *path, char *unixPath, size_t unixPathMaxLen) - { - int x; - char *home=NULL; - - FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, FALSE); -+ -+ /* -+ * Do not use strncpy() - truncating the file name would probably have undesirable side effects -+ * Instead check if destination buffer is big enough -+ */ -+ -+ if (strlen(path) >= unixPathMaxLen) -+ return FALSE; - - /* C: */ - if (path[0]=='C' && path[1]==':') -@@ -1190,6 +1198,10 @@ - home = getenv("HOME"); - if (home!=NULL) - { -+ /* Re-check buffer size */ -+ if ((strlen(path) + strlen(home) + 1) >= unixPathMaxLen) -+ return FALSE; -+ - strcpy(unixPath, home); - strcat(unixPath,"/"); - strcat(unixPath, path); -@@ -1227,7 +1239,9 @@ - FILEXFER_ALLOWED_OR_CLOSE_AND_RETURN("", cl, FALSE); - - /* Client thinks we are Winblows */ -- rfbFilenameTranslate2UNIX(cl, buffer, path); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, path, sizeof(path))) -+ return FALSE; -+ - - if (DB) rfbLog("rfbProcessFileTransfer() rfbDirContentRequest: rfbRDirContent: \"%s\"->\"%s\"\n",buffer, path); - -@@ -1504,7 +1518,12 @@ - /* add some space to the end of the buffer as we will be adding a timespec to it */ - if ((buffer = rfbProcessFileTransferReadBuffer(cl, length))==NULL) return FALSE; - /* The client requests a File */ -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ - cl->fileTransfer.fd=open(filename1, O_RDONLY, 0744); - - /* -@@ -1620,7 +1639,12 @@ - } - sizeHtmp = Swap32IfLE(sizeHtmp); - -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ - - /* If the file exists... We can send a rfbFileChecksums back to the client before we send an rfbFileAcceptHeader */ - /* TODO: Delta Transfer */ -@@ -1746,7 +1770,12 @@ - if ((buffer = rfbProcessFileTransferReadBuffer(cl, length))==NULL) return FALSE; - switch (contentParam) { - case rfbCDirCreate: /* Client requests the creation of a directory */ -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ - retval = mkdir(filename1, 0755); - if (DB) rfbLog("rfbProcessFileTransfer() rfbCommand: rfbCDirCreate(\"%s\"->\"%s\") %s\n", buffer, filename1, (retval==-1?"Failed":"Success")); - /* -@@ -1755,7 +1784,11 @@ - if (buffer!=NULL) free(buffer); - return retval; - case rfbCFileDelete: /* Client requests the deletion of a file */ -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } - if (stat(filename1,&statbuf)==0) - { - if (S_ISDIR(statbuf.st_mode)) -@@ -1773,8 +1806,17 @@ - { - /* Split into 2 filenames ('*' is a seperator) */ - *p = '\0'; -- rfbFilenameTranslate2UNIX(cl, buffer, filename1); -- rfbFilenameTranslate2UNIX(cl, p+1, filename2); -+ if (!rfbFilenameTranslate2UNIX(cl, buffer, filename1, sizeof(filename1))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } -+ -+ if (!rfbFilenameTranslate2UNIX(cl, p+1, filename2, sizeof(filename2))) -+ { -+ if (buffer!=NULL) free(buffer); -+ return FALSE; -+ } - retval = rename(filename1,filename2); - if (DB) rfbLog("rfbProcessFileTransfer() rfbCommand: rfbCFileRename(\"%s\"->\"%s\" -->> \"%s\"->\"%s\") %s\n", buffer, filename1, p+1, filename2, (retval==-1?"Failed":"Success")); - /* diff --git a/source/xlib/libvncserver/CVE-2014-6055-4.patch b/source/xlib/libvncserver/CVE-2014-6055-4.patch deleted file mode 100644 index dc22d82..0000000 --- a/source/xlib/libvncserver/CVE-2014-6055-4.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: Martin T. H. Sandsmark <[email protected]> -Date: Tue, 23 Sep 2014 15:54:11 +0000 -Subject: libvncserver: Fix stack-based buffer overflow in rfbFileTransferOffer message, FileTime processing -X-Git-Url: http://quickgit.kde.org/?p=krfb.git&a=commitdiff&h=857c2b411ed806ef806116407612a2d2a40fab9c ---- -libvncserver: Fix stack-based buffer overflow in rfbFileTransferOffer message, FileTime processing - -Upstream commit: f528072216dec01cee7ca35d94e171a3b909e677 - -CVE-2014-6055 ---- - - ---- a/libvncserver/rfbserver.c -+++ b/libvncserver/rfbserver.c -@@ -1602,7 +1602,8 @@ - p = strrchr(buffer, ','); - if (p!=NULL) { - *p = '\0'; -- strcpy(szFileTime, p+1); -+ strncpy(szFileTime, p+1, sizeof(szFileTime)); -+ szFileTime[sizeof(szFileTime)-1] = '\x00'; /* ensure NULL terminating byte is present, even if copy overflowed */ - } else - szFileTime[0]=0; - diff --git a/source/xlib/libvncserver/FrugalBuild b/source/xlib/libvncserver/FrugalBuild index dbba523..d0469e9 100644 --- a/source/xlib/libvncserver/FrugalBuild +++ b/source/xlib/libvncserver/FrugalBuild @@ -5,41 +5,29 @@ options+=('asneeded') pkgname=libvncserver -_F_sourceforge_name="LibVNCServer" -pkgver=0.9.9 -pkgrel=4 +pkgver=0.9.10 +pkgrel=1 pkgdesc="Library to create custom VNC servers" depends=('zlib' 'libjpeg>=8a' 'sdl' 'libx11' 'libxext' 'libxinerama' 'libxrandr' 'libxtrap' 'libxtst' 'libxfixes' 'libxdamage' 'inputproto' 'libgcrypt>=1.6.1' 'openssl') groups=('xlib') archs=('i686' 'x86_64') -Finclude sourceforge -sha1sums=('2004c6ae493baeff3da40b61e0a0f73c83182dad') -_F_cd_path="LibVNCServer-$pkgver" - +_F_archive_name="LibVNCServer" +_F_archive_grepv="X11VNC" +_F_github_author="LibVNC" +_F_github_tag=y +_F_github_ver="LibVNCServer-$pkgver" +Finclude github +up2date="$up2date | sed 's/LibVNCServer_//g'" +source=("${source[@]}" \ + https://github.com/LibVNC/libvncserver/commit/7b6243157f042a7bde353abc6fb22aadad6d9e2d.patch) +sha1sums=('b60b712dfffec395c743e569914a73efa523a406' \ + '73f2cf2832f4c6514ddc2518d1e50751b3f6afc7') # FSA fix *** -source=(${source[@]} CVE-2014-6055-1.patch CVE-2014-6055-2.patch CVE-2014-6055-3.patch - CVE-2014-6055-4.patch - CVE-2014-6051.patch CVE-2014-6052-1.patch CVE-2014-6053.patch - CVE-2014-6054.patch) -sha1sums=(${sha1sums[@]} '6556f54772be512f25082d814cdbd2a516aea183' \ - '5bee319759cebc95f8daad67e35277bcf83f5eb9' \ - '9ada7b3f4caaeba3b989e1725932826e1e3b0a13' \ - '359ee8d6ba8f187e586ee881558e8ef78bfc470b' \ - '3fc24b2f878d48f8aef91c3ecae1a7c1f9dec343' \ - 'cd204d923028be0ac3c4f0f93501143aa55b4fd2' \ - '664e92d306b8597a8b5a78bfa35c28065c19af54' \ - '78c6c8969b8c800b515d3c90339f293b6d3eab21') -# *********** +source=(${source[@]} CVE-2014-6055-1.patch) +sha1sums=(${sha1sums[@]} '6556f54772be512f25082d814cdbd2a516aea183') +# *********** -build() -{ - Fbuild - - # We don't want x11vnc here... - Frm /usr/man - Frm /usr/bin/x11vnc -} # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
