diff --git a/.libxcb.metadata b/.libxcb.metadata new file mode 100644 index 0000000..9220aa4 --- /dev/null +++ b/.libxcb.metadata @@ -0,0 +1 @@ +ad2fb95eeec41ba3d39502a4f7460c3b64fdf061 SOURCES/libxcb-1.9.tar.bz2 diff --git a/README.md b/README.md deleted file mode 100644 index 0e7897f..0000000 --- a/README.md +++ /dev/null @@ -1,5 +0,0 @@ -The master branch has no content - -Look at the c7 branch if you are working with CentOS-7, or the c4/c5/c6 branch for CentOS-4, 5 or 6 - -If you find this file in a distro specific branch, it means that no content has been checked in yet diff --git a/SOURCES/0001-integer-overflow-in-read_packet-CVE-2013-2064.patch b/SOURCES/0001-integer-overflow-in-read_packet-CVE-2013-2064.patch new file mode 100644 index 0000000..0c98d6d --- /dev/null +++ b/SOURCES/0001-integer-overflow-in-read_packet-CVE-2013-2064.patch @@ -0,0 +1,48 @@ +From 1b33867fa996034deb50819ae54640be501f8d20 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Wed, 1 May 2013 17:59:31 -0700 +Subject: [PATCH] integer overflow in read_packet() [CVE-2013-2064] + +Ensure that when calculating the size of the incoming response from the +Xserver, we don't overflow the integer used in the calculations when we +multiply the int32_t length by 4 and add it to the default response size. + +Signed-off-by: Alan Coopersmith +--- + src/xcb_in.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/src/xcb_in.c b/src/xcb_in.c +index b810783..8a7af92 100644 +--- a/src/xcb_in.c ++++ b/src/xcb_in.c +@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete + static int read_packet(xcb_connection_t *c) + { + xcb_generic_reply_t genrep; +- int length = 32; +- int eventlength = 0; /* length after first 32 bytes for GenericEvents */ ++ uint64_t length = 32; ++ uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */ ++ uint64_t bufsize; + void *buf; + pending_reply *pend = 0; + struct event_list *event; +@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c) + if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT) + eventlength = genrep.length * 4; + +- buf = malloc(length + eventlength + +- (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t))); ++ bufsize = length + eventlength + ++ (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)); ++ if (bufsize < INT32_MAX) ++ buf = malloc((size_t) bufsize); ++ else ++ buf = NULL; + if(!buf) + { + _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT); +-- +1.8.1.4 + diff --git a/SOURCES/pthread-stubs.pc.in b/SOURCES/pthread-stubs.pc.in new file mode 100644 index 0000000..1b722e9 --- /dev/null +++ b/SOURCES/pthread-stubs.pc.in @@ -0,0 +1,8 @@ +prefix=@prefix@ +exec_prefix=@exec_prefix@ +libdir=@libdir@ + +Name: pthread stubs +Description: Stubs missing from libc for standard pthread functions +Version: 0.1 +Libs: diff --git a/SPECS/libxcb.spec b/SPECS/libxcb.spec new file mode 100644 index 0000000..3036c26 --- /dev/null +++ b/SPECS/libxcb.spec @@ -0,0 +1,252 @@ +Name: libxcb +Version: 1.9 +Release: 3%{?dist} +Summary: A C binding to the X11 protocol + +Group: System Environment/Libraries +License: MIT +URL: http://xcb.freedesktop.org/ +Source0: http://xcb.freedesktop.org/dist/%{name}-%{version}.tar.bz2 +BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) +# This is stolen straight from the pthread-stubs source: +# http://cgit.freedesktop.org/xcb/pthread-stubs/blob/?id=6900598192bacf5fd9a34619b11328f746a5956d +# we don't need the library because glibc has working pthreads, but we need +# the pkgconfig file so libs that link against libxcb know this... +Source1: pthread-stubs.pc.in + +Patch01: 0001-integer-overflow-in-read_packet-CVE-2013-2064.patch + +BuildRequires: autoconf automake libtool pkgconfig +BuildRequires: doxygen +BuildRequires: graphviz +BuildRequires: libXau-devel +BuildRequires: libxslt +BuildRequires: xcb-proto >= 1.7-3 +BuildRequires: xorg-x11-proto-devel +BuildRequires: xorg-x11-util-macros + +%description +The X protocol C-language Binding (XCB) is a replacement for Xlib featuring a +small footprint, latency hiding, direct access to the protocol, improved +threading support, and extensibility. + +%package devel +Summary: Development files for %{name} +Group: Development/Libraries +Requires: %{name} = %{version}-%{release} +Requires: pkgconfig + +%description devel +The %{name}-devel package contains libraries and header files for +developing applications that use %{name}. + +%package doc +Summary: Documentation for %{name} +Group: Documentation +BuildArch: noarch + +%description doc +The %{name}-doc package contains documentation for the %{name} library. + +%prep +%setup -q +%patch01 -p1 + +%build +sed -i 's/pthread-stubs //' configure.ac +autoreconf -v --install +%configure --disable-static --docdir=%{_datadir}/doc/%{name}-%{version} \ + --enable-selinux --enable-xkb --disable-xprint +make %{?_smp_mflags} + +%install +rm -rf $RPM_BUILD_ROOT +make install DESTDIR=$RPM_BUILD_ROOT +install -m 644 COPYING NEWS README $RPM_BUILD_ROOT/%{_datadir}/doc/%{name}-%{version} +sed 's,@libdir@,%{_libdir},;s,@prefix@,%{_prefix},;s,@exec_prefix@,%{_exec_prefix},' %{SOURCE1} > $RPM_BUILD_ROOT%{_libdir}/pkgconfig/pthread-stubs.pc + +find $RPM_BUILD_ROOT -name '*.la' -delete + +%clean +rm -rf $RPM_BUILD_ROOT + +%post -p /sbin/ldconfig +%postun -p /sbin/ldconfig + +%files +%defattr(-,root,root,-) +%{_libdir}/libxcb-composite.so.0* +%{_libdir}/libxcb-damage.so.0* +%{_libdir}/libxcb-dpms.so.0* +%{_libdir}/libxcb-dri2.so.0* +%{_libdir}/libxcb-glx.so.0* +%{_libdir}/libxcb-randr.so.0* +%{_libdir}/libxcb-record.so.0* +%{_libdir}/libxcb-render.so.0* +%{_libdir}/libxcb-res.so.0* +%{_libdir}/libxcb-screensaver.so.0* +%{_libdir}/libxcb-shape.so.0* +%{_libdir}/libxcb-shm.so.0* +%{_libdir}/libxcb-sync.so.0* +%{_libdir}/libxcb-xevie.so.0* +%{_libdir}/libxcb-xf86dri.so.0* +%{_libdir}/libxcb-xfixes.so.0* +%{_libdir}/libxcb-xinerama.so.0* +%{_libdir}/libxcb-xkb.so.0* +%{_libdir}/libxcb-xselinux.so.0* +%{_libdir}/libxcb-xtest.so.0* +%{_libdir}/libxcb-xv.so.0* +%{_libdir}/libxcb-xvmc.so.0* +%{_libdir}/libxcb.so.1* + +%files devel +%defattr(-,root,root,-) +%{_includedir}/xcb +%{_libdir}/*.so +%{_libdir}/pkgconfig/*.pc +%{_mandir}/man3/*.3* + +%files doc +%defattr(-,root,root,-) +%{_datadir}/doc/%{name}-%{version} + +%changelog +* Fri May 24 2013 Peter Hutterer 1.9-3 +- Fix integer overflow in read_packet (CVE-2013-2064) + +* Thu Feb 14 2013 Fedora Release Engineering - 1.9-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Tue Oct 16 2012 Adam Jackson 1.9-1 +- libxcb 1.9 + +* Tue Sep 04 2012 Adam Jackson 1.8.1-4 +- --enable-xkb for weston +- --disable-xprint instead of manual rm +- BuildRequire an updated xcb-proto for XKB and DRI2 fixes + +* Thu Jul 19 2012 Fedora Release Engineering - 1.8.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Mon Apr 09 2012 Adam Jackson 1.8.1-1 +- libxcb 1.8.1 + +* Fri Jan 13 2012 Adam Jackson 1.8-2 +- Don't %%doc in the base package, that pulls in copies of things we only + want in -doc subpackage. + +* Wed Jan 11 2012 Adam Jackson 1.8-1 +- libxcb 1.8 + +* Thu Jun 23 2011 Adam Jackson 1.7-3 +- libxcb-1.7-xts-fixes.patch: Backport some XTS5 fixes from git. + +* Tue Feb 08 2011 Adam Jackson 1.7-2 +- Fix FTBFS. + +* Tue Feb 08 2011 Fedora Release Engineering - 1.7-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Thu Aug 26 2010 Adam Jackson 1.7-2 +- Drop python bindings, nothing's using them. + +* Mon Aug 16 2010 Peter Hutterer 1.7-1 +- libxcb 1.7 + +* Wed Jul 21 2010 David Malcolm - 1.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Features/Python_2.7/MassRebuild + +* Thu Jul 08 2010 Adam Jackson 1.5-2 +- Include COPYING in base package too + +* Wed Jan 13 2010 Dave Airlie 1.5-1 +- libxcb 1.5 + +* Wed Dec 02 2009 Adam Jackson 1.4-2 +- libxcb-1.4-keepalive.patch: setsockopt(SO_KEEPALIVE) for TCP (#476415) + +* Thu Aug 27 2009 Adam Jackson 1.4-1 +- libxcb 1.4 (#518597) + +* Sat Jul 25 2009 Fedora Release Engineering - 1.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Tue Jul 14 2009 Adam Jackson 1.3-1 +- libxcb 1.3 +- List DSO versions explicitly. +- Don't package any xprint bits. Seriously, no. + +* Mon Jul 13 2009 Adam Jackson 1.2-8 +- Really fix xpyb build. + +* Mon Jul 06 2009 Adam Jackson 1.2-7 +- Fix xpyb build + +* Mon Jun 29 2009 Adam Jackson 1.2-6 +- BuildRequires: xcb-proto >= 1.5 + +* Wed Jun 24 2009 Adam Jackson 1.2-5 +- libxcb-1.2-no-nagle.patch: Disable Nagle's algorithm on TCP. (#442158) + +* Tue May 19 2009 Adam Jackson 1.2-4 +- Add libxcb-python subpackage + +* Tue Apr 07 2009 Adam Jackson 1.2-3 +- libxcb-1.2-to-git-6e2e87d.patch: Various updates from git, XID generation + being the most important. + +* Tue Feb 24 2009 Matthias Clasen 1.2-2 +- Make -doc noarch + +* Wed Feb 18 2009 Adam Jackson 1.2-1 +- libxcb 1.2 + +* Tue Feb 10 2009 Adam Jackson 1.1.93-4 +- Fix selinux module build. (#474249) + +* Sun Feb 08 2009 Adam Jackson 1.1.93-3 +- Remove aforementioned egregious hack. Now I can sleep easier. + +* Thu Dec 18 2008 Adam Jackson 1.1.93-2 +- Egregious hack to make the next libX11 build work. Hands... won't come + clean... + +* Wed Dec 17 2008 Adam Jackson 1.1.93-1 +- libxcb 1.1.93 + +* Sun Oct 19 2008 Adam Jackson 1.1.91-5 +- Add pthread-stubs.pc + +* Mon Oct 13 2008 Adam Jackson 1.1.91-4 +- libxcb-1.1-abstract-socket.patch: Drop. +- libxcb-1.1.91-git.patch: Update to git master. + +* Wed Sep 17 2008 Adam Jackson 1.1.91-3 +- libxcb-1.1-xreply-leak.patch: Plug a memory leak in _XReply when the + caller has a non-fatal error handler. (mclasen, fdo #17616) + +* Thu Sep 11 2008 Adam Jackson 1.1.91-2 +- Enable x-selinux bindings. + +* Wed Sep 10 2008 Adam Jackson 1.1.91-1 +- libxcb 1.1.91 + +* Tue Apr 22 2008 Adam Jackson 1.1-4 +- libxcb-1.1-sloppy-lock.patch: Turn sloppy locking on all the time. I'm + tired of fighting it. (#390261) + +* Mon Feb 18 2008 Fedora Release Engineering - 1.1-2 +- Autorebuild for GCC 4.3 + +* Mon Nov 12 2007 Adam Jackson 1.1-1 +- libxcb 1.1 + +* Fri Aug 24 2007 Adam Jackson 1.0-3 +- libxcb-1.0-abstract-socket.patch: When connecting to the X server, prefer + abstract-namespace unix sockets to filesystem-bound sockets. + +* Wed Aug 22 2007 Adam Jackson - 1.0-2 +- Rebuild for PPC toolchain bug + +* Fri Jun 29 2007 Adam Jackson 1.0-1 +- Initial revision.