diff options
| author | Leo Famulari <leo@famulari.name> | 2016-10-05 13:33:11 -0400 |
|---|---|---|
| committer | Leo Famulari <leo@famulari.name> | 2016-10-05 17:37:23 -0400 |
| commit | 813062a5f714ddbdb3860b7d51c10f4ddc3bfb61 (patch) | |
| tree | 1b328190e88654a95d52413ee7e74a230459a396 /gnu/packages/patches | |
| parent | e73631a906429bbaccfaafdb24070260bc914d8d (diff) | |
gnu: libxvmc: Fix CVE-2016-7953.
* gnu/packages/patches/libxvmc-CVE-2016-7953.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/xorg.scm (libxvmc)[replacement]: New field.
(libxvmc/fixed): New variable.
Diffstat (limited to 'gnu/packages/patches')
| -rw-r--r-- | gnu/packages/patches/libxvmc-CVE-2016-7953.patch | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/gnu/packages/patches/libxvmc-CVE-2016-7953.patch b/gnu/packages/patches/libxvmc-CVE-2016-7953.patch new file mode 100644 index 0000000000..737abdeb9f --- /dev/null +++ b/gnu/packages/patches/libxvmc-CVE-2016-7953.patch @@ -0,0 +1,42 @@ +Fix CVE-2016-7953: + +https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7953 + +Patch copied from upstream source repository: + +https://cgit.freedesktop.org/xorg/lib/libXvMC/commit/?id=2cd95e7da8367cccdcdd5c9b160012d1dec5cbdb + +From 2cd95e7da8367cccdcdd5c9b160012d1dec5cbdb Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann <tobias@stoeckmann.org> +Date: Sun, 25 Sep 2016 22:34:27 +0200 +Subject: [PATCH] Avoid buffer underflow on empty strings. + +If an empty string is received from an x-server, do not underrun the +buffer by accessing "rep.nameLen - 1" unconditionally, which could end +up being -1. + +Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org> +Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> +--- + src/XvMC.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/XvMC.c b/src/XvMC.c +index 7336760..3ee4212 100644 +--- a/src/XvMC.c ++++ b/src/XvMC.c +@@ -576,9 +576,9 @@ Status XvMCGetDRInfo(Display *dpy, XvPortID port, + if (*name && *busID && tmpBuf) { + _XRead(dpy, tmpBuf, realSize); + strncpy(*name,tmpBuf,rep.nameLen); +- (*name)[rep.nameLen - 1] = '\0'; ++ (*name)[rep.nameLen == 0 ? 0 : rep.nameLen - 1] = '\0'; + strncpy(*busID,tmpBuf+rep.nameLen,rep.busIDLen); +- (*busID)[rep.busIDLen - 1] = '\0'; ++ (*busID)[rep.busIDLen == 0 ? 0 : rep.busIDLen - 1] = '\0'; + XFree(tmpBuf); + } else { + XFree(*name); +-- +2.10.1 + |