diff --git a/SOURCES/CVE-2021-31535.patch b/SOURCES/CVE-2021-31535.patch new file mode 100644 index 0000000..aa60662 --- /dev/null +++ b/SOURCES/CVE-2021-31535.patch @@ -0,0 +1,411 @@ +From 2714e4478c1262c94de6295cce605c14572968d3 Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb +Date: Fri, 19 Feb 2021 15:30:39 +0100 +Subject: [PATCH libX11] Reject string longer than USHRT_MAX before sending + them on the wire + +The X protocol uses CARD16 values to represent the length so +this would overflow. + +CVE-2021-31535 + +Signed-off-by: Matthieu Herrb + +[mustard: backported 10 1.6.8 by merging the warning fixes from +upstream commimt 84427130 first - ajax] +--- + src/Font.c | 10 ++++++---- + src/FontInfo.c | 5 ++++- + src/FontNames.c | 5 ++++- + src/GetColor.c | 6 +++++- + src/LoadFont.c | 6 +++++- + src/LookupCol.c | 6 ++++-- + src/ParseCol.c | 7 +++++-- + src/QuExt.c | 7 ++++++- + src/SetFPath.c | 12 +++++++++--- + src/SetHints.c | 9 ++++++++- + src/StNColor.c | 5 ++++- + src/StName.c | 11 ++++++++--- + 12 files changed, 68 insertions(+), 21 deletions(-) + +diff --git a/src/Font.c b/src/Font.c +index 09d2ae91..1cd89cca 100644 +--- a/src/Font.c ++++ b/src/Font.c +@@ -102,12 +102,14 @@ XFontStruct *XLoadQueryFont( + XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy); + #endif + ++ if (strlen(name) >= USHRT_MAX) ++ return NULL; + if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0)) + return font_result; + LockDisplay(dpy); + GetReq(OpenFont, req); + seq = dpy->request; /* Can't use extended sequence number here */ +- nbytes = req->nbytes = name ? strlen(name) : 0; ++ nbytes = req->nbytes = (CARD16) (name ? strlen(name) : 0); + req->fid = fid = XAllocID(dpy); + req->length += (nbytes+3)>>2; + Data (dpy, name, nbytes); +@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont( + + if (!name) + return 0; +- l = strlen(name); +- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-') ++ l = (int) strlen(name); ++ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX) + return 0; + charset = NULL; + /* next three lines stolen from _XkbGetCharset() */ +@@ -679,7 +681,7 @@ int _XF86LoadQueryLocaleFont( + return 0; + if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset)) + return 0; +- if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1) ++ if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1) + return 0; + strcpy(buf, name); + strcpy(buf + l - 1, p + 1); +diff --git a/src/FontInfo.c b/src/FontInfo.c +index f870e431..6644b3fa 100644 +--- a/src/FontInfo.c ++++ b/src/FontInfo.c +@@ -58,10 +58,13 @@ XFontStruct **info) /* RETURN */ + register xListFontsReq *req; + int j; + ++ if (strlen(pattern) >= USHRT_MAX) ++ return NULL; ++ + LockDisplay(dpy); + GetReq(ListFontsWithInfo, req); + req->maxNames = maxNames; +- nbytes = req->nbytes = pattern ? strlen (pattern) : 0; ++ nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0; + req->length += (nbytes + 3) >> 2; + _XSend (dpy, pattern, nbytes); + /* use _XSend instead of Data, since subsequent _XReply will flush buffer */ +diff --git a/src/FontNames.c b/src/FontNames.c +index b78792d6..458d80c9 100644 +--- a/src/FontNames.c ++++ b/src/FontNames.c +@@ -51,10 +51,13 @@ int *actualCount) /* RETURN */ + register xListFontsReq *req; + unsigned long rlen = 0; + ++ if (strlen(pattern) >= USHRT_MAX) ++ return NULL; ++ + LockDisplay(dpy); + GetReq(ListFonts, req); + req->maxNames = maxNames; +- nbytes = req->nbytes = pattern ? strlen (pattern) : 0; ++ nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0; + req->length += (nbytes + 3) >> 2; + _XSend (dpy, pattern, nbytes); + /* use _XSend instead of Data, since following _XReply will flush buffer */ +diff --git a/src/GetColor.c b/src/GetColor.c +index cd0eb9f6..c8178067 100644 +--- a/src/GetColor.c ++++ b/src/GetColor.c +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include + #include "Xlibint.h" + #include "Xcmsint.h" +@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */ + XcmsColor cmsColor_exact; + Status ret; + ++ if (strlen(colorname) >= USHRT_MAX) ++ return (0); ++ + #ifdef XCMS + /* + * Let's Attempt to use Xcms and i18n approach to Parse Color +@@ -83,7 +87,7 @@ XColor *exact_def) /* RETURN */ + GetReq(AllocNamedColor, req); + + req->cmap = cmap; +- nbytes = req->nbytes = strlen(colorname); ++ nbytes = req->nbytes = (CARD16) strlen(colorname); + req->length += (nbytes + 3) >> 2; /* round up to mult of 4 */ + + _XSend(dpy, colorname, nbytes); +diff --git a/src/LoadFont.c b/src/LoadFont.c +index f547976b..3996436f 100644 +--- a/src/LoadFont.c ++++ b/src/LoadFont.c +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include "Xlibint.h" + + Font +@@ -38,12 +39,15 @@ XLoadFont ( + Font fid; + register xOpenFontReq *req; + ++ if (strlen(name) >= USHRT_MAX) ++ return (0); ++ + if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid)) + return fid; + + LockDisplay(dpy); + GetReq(OpenFont, req); +- nbytes = req->nbytes = name ? strlen(name) : 0; ++ nbytes = req->nbytes = name ? (CARD16) strlen(name) : 0; + req->fid = fid = XAllocID(dpy); + req->length += (nbytes+3)>>2; + Data (dpy, name, nbytes); +diff --git a/src/LookupCol.c b/src/LookupCol.c +index f7f969f5..cd9b1368 100644 +--- a/src/LookupCol.c ++++ b/src/LookupCol.c +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include + #include "Xlibint.h" + #include "Xcmsint.h" +@@ -46,6 +47,9 @@ XLookupColor ( + XcmsCCC ccc; + XcmsColor cmsColor_exact; + ++ n = (int) strlen (spec); ++ if (n >= USHRT_MAX) ++ return 0; + #ifdef XCMS + /* + * Let's Attempt to use Xcms and i18n approach to Parse Color +@@ -77,8 +81,6 @@ XLookupColor ( + * Xcms and i18n methods failed, so lets pass it to the server + * for parsing. + */ +- +- n = strlen (spec); + LockDisplay(dpy); + GetReq (LookupColor, req); + req->cmap = cmap; +diff --git a/src/ParseCol.c b/src/ParseCol.c +index e997b1b8..7a84a17b 100644 +--- a/src/ParseCol.c ++++ b/src/ParseCol.c +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include + #include "Xlibint.h" + #include "Xcmsint.h" +@@ -46,7 +47,9 @@ XParseColor ( + XcmsColor cmsColor; + + if (!spec) return(0); +- n = strlen (spec); ++ n = (int) strlen (spec); ++ if (n >= USHRT_MAX) ++ return(0); + if (*spec == '#') { + /* + * RGB +@@ -119,7 +122,7 @@ XParseColor ( + LockDisplay(dpy); + GetReq (LookupColor, req); + req->cmap = cmap; +- req->nbytes = n = strlen(spec); ++ req->nbytes = (CARD16) (n = (int) strlen(spec)); + req->length += (n + 3) >> 2; + Data (dpy, spec, (long)n); + if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) { +diff --git a/src/QuExt.c b/src/QuExt.c +index 4e230e77..4cb99fcf 100644 +--- a/src/QuExt.c ++++ b/src/QuExt.c +@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include ++#include + #include "Xlibint.h" + + Bool +@@ -40,9 +42,12 @@ XQueryExtension( + xQueryExtensionReply rep; + register xQueryExtensionReq *req; + ++ if (strlen(name) >= USHRT_MAX) ++ return false; ++ + LockDisplay(dpy); + GetReq(QueryExtension, req); +- req->nbytes = name ? strlen(name) : 0; ++ req->nbytes = name ? (CARD16) strlen(name) : 0; + req->length += (req->nbytes+(unsigned)3)>>2; + _XSend(dpy, name, (long)req->nbytes); + (void) _XReply (dpy, (xReply *)&rep, 0, xTrue); +diff --git a/src/SetFPath.c b/src/SetFPath.c +index 60aaef01..13fce49e 100644 +--- a/src/SetFPath.c ++++ b/src/SetFPath.c +@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group. + + #ifdef HAVE_CONFIG_H + #include ++#include + #endif + #include "Xlibint.h" + +@@ -48,7 +49,12 @@ XSetFontPath ( + GetReq (SetFontPath, req); + req->nFonts = ndirs; + for (i = 0; i < ndirs; i++) { +- n += safestrlen (directories[i]) + 1; ++ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1)); ++ if (n >= USHRT_MAX) { ++ UnlockDisplay(dpy); ++ SyncHandle(); ++ return 0; ++ } + } + nbytes = (n + 3) & ~3; + req->length += nbytes >> 2; +@@ -59,9 +65,9 @@ XSetFontPath ( + char *tmp = p; + + for (i = 0; i < ndirs; i++) { +- register int length = safestrlen (directories[i]); ++ register int length = (int) safestrlen (directories[i]); + *p = length; +- memcpy (p + 1, directories[i], length); ++ memcpy (p + 1, directories[i], (size_t)length); + p += length + 1; + } + Data (dpy, tmp, nbytes); +diff --git a/src/SetHints.c b/src/SetHints.c +index bc46498a..61cb0684 100644 +--- a/src/SetHints.c ++++ b/src/SetHints.c +@@ -49,6 +49,7 @@ SOFTWARE. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include + #include + #include "Xatomtype.h" +@@ -214,6 +215,8 @@ XSetCommand ( + register char *buf, *bp; + for (i = 0, nbytes = 0; i < argc; i++) { + nbytes += safestrlen(argv[i]) + 1; ++ if (nbytes >= USHRT_MAX) ++ return 1; + } + if ((bp = buf = Xmalloc(nbytes))) { + /* copy arguments into single buffer */ +@@ -256,11 +259,13 @@ XSetStandardProperties ( + + if (name != NULL) XStoreName (dpy, w, name); + ++ if (safestrlen(icon_string) >= USHRT_MAX) ++ return 1; + if (icon_string != NULL) { + XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8, + PropModeReplace, + (_Xconst unsigned char *)icon_string, +- safestrlen(icon_string)); ++ (int)safestrlen(icon_string)); + } + + if (icon_pixmap != None) { +@@ -298,6 +303,8 @@ XSetClassHint( + + len_nm = safestrlen(classhint->res_name); + len_cl = safestrlen(classhint->res_class); ++ if (len_nm + len_cl >= USHRT_MAX) ++ return 1; + if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) { + if (len_nm) { + strcpy(s, classhint->res_name); +diff --git a/src/StNColor.c b/src/StNColor.c +index 8b821c3e..16dc9cbc 100644 +--- a/src/StNColor.c ++++ b/src/StNColor.c +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include + #include "Xlibint.h" + #include "Xcmsint.h" +@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */ + XcmsColor cmsColor_exact; + XColor scr_def; + ++ if (strlen(name) >= USHRT_MAX) ++ return 0; + #ifdef XCMS + /* + * Let's Attempt to use Xcms approach to Parse Color +@@ -76,7 +79,7 @@ int flags) /* DoRed, DoGreen, DoBlue */ + req->cmap = cmap; + req->flags = flags; + req->pixel = pixel; +- req->nbytes = nbytes = strlen(name); ++ req->nbytes = (CARD16) (nbytes = (unsigned) strlen(name)); + req->length += (nbytes + 3) >> 2; /* round up to multiple of 4 */ + Data(dpy, name, (long)nbytes); + UnlockDisplay(dpy); +diff --git a/src/StName.c b/src/StName.c +index b4048bff..04bb3aa6 100644 +--- a/src/StName.c ++++ b/src/StName.c +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group. + #ifdef HAVE_CONFIG_H + #include + #endif ++#include + #include + #include + +@@ -36,9 +37,11 @@ XStoreName ( + Window w, + _Xconst char *name) + { +- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, ++ if (strlen(name) >= USHRT_MAX) ++ return 0; ++ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */ + 8, PropModeReplace, (_Xconst unsigned char *)name, +- name ? strlen(name) : 0); ++ name ? (int) strlen(name) : 0); + } + + int +@@ -47,7 +50,9 @@ XSetIconName ( + Window w, + _Xconst char *icon_name) + { ++ if (strlen(icon_name) >= USHRT_MAX) ++ return 0; + return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8, + PropModeReplace, (_Xconst unsigned char *)icon_name, +- icon_name ? strlen(icon_name) : 0); ++ icon_name ? (int) strlen(icon_name) : 0); + } +-- +2.30.1 + diff --git a/SPECS/libX11.spec b/SPECS/libX11.spec index 6e27686..ced136f 100644 --- a/SPECS/libX11.spec +++ b/SPECS/libX11.spec @@ -5,7 +5,7 @@ Summary: Core X11 protocol client library Name: libX11 Version: 1.6.8 -Release: 4%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist} +Release: 5%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist} License: MIT Group: System Environment/Libraries URL: http://www.x.org @@ -24,6 +24,7 @@ Patch4: 0001-Fix-poll_for_response-race-condition.patch # CVE-2020-14363 Patch5: 0001-Fix-an-integer-overflow-in-init_om.patch +Patch6: CVE-2021-31535.patch BuildRequires: xorg-x11-util-macros >= 1.11 BuildRequires: pkgconfig(xproto) >= 7.0.15 @@ -68,6 +69,7 @@ libX11/libxcb interoperability library %patch3 -p1 -b .copycolormapandfree %patch4 -p1 -b .race %patch5 -p1 -b .fix-an-integer-overflow-in-init_om +%patch6 -p1 -b .cve-2021-31535 %build autoreconf -v --install --force @@ -132,6 +134,9 @@ make %{?_smp_mflags} check %{_mandir}/man5/*.5* %changelog +* Thu Aug 12 2021 Adam Jackson - 1.6.8-5 +- Fix CVE-2021-31535 (#1962439) + * Tue Nov 3 2020 Michel Dänzer - 1.6.8-4 - Fix CVE-2020-14363 (#1873923)