Module Name: xsrc Committed By: martin Date: Wed May 19 17:06:32 UTC 2021
Modified Files: xsrc/external/mit/libX11/dist/src [netbsd-9]: Font.c FontInfo.c FontNames.c GetColor.c LoadFont.c LookupCol.c ParseCol.c QuExt.c SetFPath.c SetHints.c StNColor.c StName.c xsrc/external/mit/libX11/dist/src/xlibi18n [netbsd-9]: imKStoUCS.c Log Message: Apply patch, requested by mrg in ticket #1275: xsrc/external/mit/libX11/dist/src/Font.c (apply patch) xsrc/external/mit/libX11/dist/src/FontInfo.c (apply patch) xsrc/external/mit/libX11/dist/src/FontNames.c (apply patch) xsrc/external/mit/libX11/dist/src/GetColor.c (apply patch) xsrc/external/mit/libX11/dist/src/LoadFont.c (apply patch) xsrc/external/mit/libX11/dist/src/LookupCol.c (apply patch) xsrc/external/mit/libX11/dist/src/ParseCol.c (apply patch) xsrc/external/mit/libX11/dist/src/QuExt.c (apply patch) xsrc/external/mit/libX11/dist/src/SetFPath.c (apply patch) xsrc/external/mit/libX11/dist/src/SetHints.c (apply patch) xsrc/external/mit/libX11/dist/src/StNColor.c (apply patch) xsrc/external/mit/libX11/dist/src/StName.c (apply patch) xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c (apply patch) Apply upstream fixes for CVE-2021-31535 (and one other bug). Reject string longer than USHRT_MAX before sending them on the wire. Fix out-of-bound access in KeySymToUcs4(). To generate a diff of this commit: cvs rdiff -u -r1.6.2.1 -r1.6.2.2 xsrc/external/mit/libX11/dist/src/Font.c cvs rdiff -u -r1.1.1.8.2.1 -r1.1.1.8.2.2 \ xsrc/external/mit/libX11/dist/src/FontInfo.c cvs rdiff -u -r1.8.2.1 -r1.8.2.2 \ xsrc/external/mit/libX11/dist/src/FontNames.c cvs rdiff -u -r1.1.1.3.18.1 -r1.1.1.3.18.2 \ xsrc/external/mit/libX11/dist/src/GetColor.c \ xsrc/external/mit/libX11/dist/src/LoadFont.c \ xsrc/external/mit/libX11/dist/src/LookupCol.c \ xsrc/external/mit/libX11/dist/src/ParseCol.c cvs rdiff -u -r1.1.1.4.18.1 -r1.1.1.4.18.2 \ xsrc/external/mit/libX11/dist/src/QuExt.c cvs rdiff -u -r1.1.1.4.10.1 -r1.1.1.4.10.2 \ xsrc/external/mit/libX11/dist/src/SetFPath.c cvs rdiff -u -r1.1.1.7.2.1 -r1.1.1.7.2.2 \ xsrc/external/mit/libX11/dist/src/SetHints.c cvs rdiff -u -r1.1.1.2.18.1 -r1.1.1.2.18.2 \ xsrc/external/mit/libX11/dist/src/StNColor.c cvs rdiff -u -r1.1.1.4.12.1 -r1.1.1.4.12.2 \ xsrc/external/mit/libX11/dist/src/StName.c cvs rdiff -u -r1.1.1.4.12.1 -r1.1.1.4.12.2 \ xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: xsrc/external/mit/libX11/dist/src/Font.c diff -u xsrc/external/mit/libX11/dist/src/Font.c:1.6.2.1 xsrc/external/mit/libX11/dist/src/Font.c:1.6.2.2 --- xsrc/external/mit/libX11/dist/src/Font.c:1.6.2.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/Font.c Wed May 19 17:06:32 2021 @@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont( XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy); #endif + if (strlen(name) >= USHRT_MAX) + return NULL; if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0)) return font_result; LockDisplay(dpy); @@ -663,7 +665,7 @@ int _XF86LoadQueryLocaleFont( if (!name) return 0; l = (int) strlen(name); - if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-') + if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX) return 0; charset = NULL; /* next three lines stolen from _XkbGetCharset() */ Index: xsrc/external/mit/libX11/dist/src/FontInfo.c diff -u xsrc/external/mit/libX11/dist/src/FontInfo.c:1.1.1.8.2.1 xsrc/external/mit/libX11/dist/src/FontInfo.c:1.1.1.8.2.2 --- xsrc/external/mit/libX11/dist/src/FontInfo.c:1.1.1.8.2.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/FontInfo.c Wed May 19 17:06:32 2021 @@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */ register xListFontsReq *req; int j; + if (strlen(pattern) >= USHRT_MAX) + return NULL; + LockDisplay(dpy); GetReq(ListFontsWithInfo, req); req->maxNames = maxNames; Index: xsrc/external/mit/libX11/dist/src/FontNames.c diff -u xsrc/external/mit/libX11/dist/src/FontNames.c:1.8.2.1 xsrc/external/mit/libX11/dist/src/FontNames.c:1.8.2.2 --- xsrc/external/mit/libX11/dist/src/FontNames.c:1.8.2.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/FontNames.c Wed May 19 17:06:32 2021 @@ -51,6 +51,9 @@ int *actualCount) /* RETURN */ register xListFontsReq *req; unsigned long rlen = 0; + if (strlen(pattern) >= USHRT_MAX) + return NULL; + LockDisplay(dpy); GetReq(ListFonts, req); req->maxNames = maxNames; Index: xsrc/external/mit/libX11/dist/src/GetColor.c diff -u xsrc/external/mit/libX11/dist/src/GetColor.c:1.1.1.3.18.1 xsrc/external/mit/libX11/dist/src/GetColor.c:1.1.1.3.18.2 --- xsrc/external/mit/libX11/dist/src/GetColor.c:1.1.1.3.18.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/GetColor.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include <stdio.h> #include "Xlibint.h" #include "Xcmsint.h" @@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */ XcmsColor cmsColor_exact; Status ret; + if (strlen(colorname) >= USHRT_MAX) + return (0); + #ifdef XCMS /* * Let's Attempt to use Xcms and i18n approach to Parse Color Index: xsrc/external/mit/libX11/dist/src/LoadFont.c diff -u xsrc/external/mit/libX11/dist/src/LoadFont.c:1.1.1.3.18.1 xsrc/external/mit/libX11/dist/src/LoadFont.c:1.1.1.3.18.2 --- xsrc/external/mit/libX11/dist/src/LoadFont.c:1.1.1.3.18.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/LoadFont.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include "Xlibint.h" Font @@ -38,6 +39,9 @@ XLoadFont ( Font fid; register xOpenFontReq *req; + if (strlen(name) >= USHRT_MAX) + return (0); + if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid)) return fid; Index: xsrc/external/mit/libX11/dist/src/LookupCol.c diff -u xsrc/external/mit/libX11/dist/src/LookupCol.c:1.1.1.3.18.1 xsrc/external/mit/libX11/dist/src/LookupCol.c:1.1.1.3.18.2 --- xsrc/external/mit/libX11/dist/src/LookupCol.c:1.1.1.3.18.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/LookupCol.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include <stdio.h> #include "Xlibint.h" #include "Xcmsint.h" @@ -46,6 +47,9 @@ XLookupColor ( XcmsCCC ccc; XcmsColor cmsColor_exact; + n = (int) strlen (spec); + if (n >= USHRT_MAX) + return 0; #ifdef XCMS /* * Let's Attempt to use Xcms and i18n approach to Parse Color @@ -77,8 +81,6 @@ XLookupColor ( * Xcms and i18n methods failed, so lets pass it to the server * for parsing. */ - - n = (int) strlen (spec); LockDisplay(dpy); GetReq (LookupColor, req); req->cmap = cmap; Index: xsrc/external/mit/libX11/dist/src/ParseCol.c diff -u xsrc/external/mit/libX11/dist/src/ParseCol.c:1.1.1.3.18.1 xsrc/external/mit/libX11/dist/src/ParseCol.c:1.1.1.3.18.2 --- xsrc/external/mit/libX11/dist/src/ParseCol.c:1.1.1.3.18.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/ParseCol.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include <stdio.h> #include "Xlibint.h" #include "Xcmsint.h" @@ -47,6 +48,8 @@ XParseColor ( if (!spec) return(0); n = (int) strlen (spec); + if (n >= USHRT_MAX) + return(0); if (*spec == '#') { /* * RGB Index: xsrc/external/mit/libX11/dist/src/QuExt.c diff -u xsrc/external/mit/libX11/dist/src/QuExt.c:1.1.1.4.18.1 xsrc/external/mit/libX11/dist/src/QuExt.c:1.1.1.4.18.2 --- xsrc/external/mit/libX11/dist/src/QuExt.c:1.1.1.4.18.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/QuExt.c Wed May 19 17:06:32 2021 @@ -27,6 +27,8 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> +#include <stdbool.h> #include "Xlibint.h" Bool @@ -40,6 +42,9 @@ XQueryExtension( xQueryExtensionReply rep; register xQueryExtensionReq *req; + if (strlen(name) >= USHRT_MAX) + return false; + LockDisplay(dpy); GetReq(QueryExtension, req); req->nbytes = name ? (CARD16) strlen(name) : 0; Index: xsrc/external/mit/libX11/dist/src/SetFPath.c diff -u xsrc/external/mit/libX11/dist/src/SetFPath.c:1.1.1.4.10.1 xsrc/external/mit/libX11/dist/src/SetFPath.c:1.1.1.4.10.2 --- xsrc/external/mit/libX11/dist/src/SetFPath.c:1.1.1.4.10.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/SetFPath.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include "Xlibint.h" #define safestrlen(s) ((s) ? strlen(s) : 0) @@ -49,6 +50,11 @@ XSetFontPath ( req->nFonts = ndirs; for (i = 0; i < ndirs; i++) { n = (int) ((size_t) n + (safestrlen (directories[i]) + 1)); + if (n >= USHRT_MAX) { + UnlockDisplay(dpy); + SyncHandle(); + return 0; + } } nbytes = (n + 3) & ~3; req->length += nbytes >> 2; Index: xsrc/external/mit/libX11/dist/src/SetHints.c diff -u xsrc/external/mit/libX11/dist/src/SetHints.c:1.1.1.7.2.1 xsrc/external/mit/libX11/dist/src/SetHints.c:1.1.1.7.2.2 --- xsrc/external/mit/libX11/dist/src/SetHints.c:1.1.1.7.2.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/SetHints.c Wed May 19 17:06:32 2021 @@ -49,6 +49,7 @@ SOFTWARE. #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include <X11/Xlibint.h> #include <X11/Xutil.h> #include "Xatomtype.h" @@ -214,6 +215,8 @@ XSetCommand ( register char *buf, *bp; for (i = 0, nbytes = 0; i < argc; i++) { nbytes += safestrlen(argv[i]) + 1; + if (nbytes >= USHRT_MAX) + return 1; } if ((bp = buf = Xmalloc(nbytes))) { /* copy arguments into single buffer */ @@ -256,6 +259,8 @@ XSetStandardProperties ( if (name != NULL) XStoreName (dpy, w, name); + if (safestrlen(icon_string) >= USHRT_MAX) + return 1; if (icon_string != NULL) { XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8, PropModeReplace, @@ -298,6 +303,8 @@ XSetClassHint( len_nm = safestrlen(classhint->res_name); len_cl = safestrlen(classhint->res_class); + if (len_nm + len_cl >= USHRT_MAX) + return 1; if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) { if (len_nm) { strcpy(s, classhint->res_name); Index: xsrc/external/mit/libX11/dist/src/StNColor.c diff -u xsrc/external/mit/libX11/dist/src/StNColor.c:1.1.1.2.18.1 xsrc/external/mit/libX11/dist/src/StNColor.c:1.1.1.2.18.2 --- xsrc/external/mit/libX11/dist/src/StNColor.c:1.1.1.2.18.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/StNColor.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include <stdio.h> #include "Xlibint.h" #include "Xcmsint.h" @@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */ XcmsColor cmsColor_exact; XColor scr_def; + if (strlen(name) >= USHRT_MAX) + return 0; #ifdef XCMS /* * Let's Attempt to use Xcms approach to Parse Color Index: xsrc/external/mit/libX11/dist/src/StName.c diff -u xsrc/external/mit/libX11/dist/src/StName.c:1.1.1.4.12.1 xsrc/external/mit/libX11/dist/src/StName.c:1.1.1.4.12.2 --- xsrc/external/mit/libX11/dist/src/StName.c:1.1.1.4.12.1 Wed Aug 5 13:44:42 2020 +++ xsrc/external/mit/libX11/dist/src/StName.c Wed May 19 17:06:32 2021 @@ -27,6 +27,7 @@ in this Software without prior written a #ifdef HAVE_CONFIG_H #include <config.h> #endif +#include <limits.h> #include <X11/Xlibint.h> #include <X11/Xatom.h> @@ -36,7 +37,9 @@ XStoreName ( Window w, _Xconst char *name) { - return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, + if (strlen(name) >= USHRT_MAX) + return 0; + return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */ 8, PropModeReplace, (_Xconst unsigned char *)name, name ? (int) strlen(name) : 0); } @@ -47,6 +50,8 @@ XSetIconName ( Window w, _Xconst char *icon_name) { + if (strlen(icon_name) >= USHRT_MAX) + return 0; return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8, PropModeReplace, (_Xconst unsigned char *)icon_name, icon_name ? (int) strlen(icon_name) : 0); Index: xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c diff -u xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c:1.1.1.4.12.1 xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c:1.1.1.4.12.2 --- xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c:1.1.1.4.12.1 Wed Aug 5 13:44:43 2020 +++ xsrc/external/mit/libX11/dist/src/xlibi18n/imKStoUCS.c Wed May 19 17:06:32 2021 @@ -285,7 +285,7 @@ KeySymToUcs4(KeySym keysym) return keysym_to_unicode_3a2_3fe[keysym - 0x3a2]; else if (keysym > 0x4a0 && keysym < 0x4e0) return keysym_to_unicode_4a1_4df[keysym - 0x4a1]; - else if (keysym > 0x589 && keysym < 0x5ff) + else if (keysym > 0x58f && keysym < 0x5ff) return keysym_to_unicode_590_5fe[keysym - 0x590]; else if (keysym > 0x67f && keysym < 0x700) return keysym_to_unicode_680_6ff[keysym - 0x680];