<!DOCTYPE html>
<html lang='en'>
<head>
<title>gnu: gnome-mines: Replace intltool with gettext-minimal. - guix - Wojtek's customized Guix</title>
<meta name='generator' content='cgit v1.2.3'/>
<meta name='robots' content='noindex, nofollow'/>
<link rel='stylesheet' type='text/css' href='/cgit-static/cgit.css'/>
<link rel='stylesheet' type='text/css' href='/cgit-static/better-cgit-markdown-heading-color.css'/>
<link rel='shortcut icon' href='/cgit-static/favicon.ico'/>
<link rel='alternate' title='Atom feed' href='https://git.koszko.org/guix/atom/etc/committer.scm.in?h=koszko' type='application/atom+xml'/>
</head>
<body>
<div id='cgit'><table id='header'>
<tr>
<td class='logo' rowspan='2'><a href='/'><img src='https://git.koszko.org/cgit-static/cgit.png' alt='cgit logo'/></a></td>
<td class='main'><a href='/'>index</a> : <a href='/guix/'>guix</a></td><td class='form'><form method='get'>
<input type='hidden' name='id' value='7d38c6261d97223b3ab10a19b35175846d491ed2'/><select name='h' onchange='this.form.submit();'>
<option value='koszko' selected='selected'>koszko</option>
<option value='koszko-scripts'>koszko-scripts</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>Wojtek's customized Guix</td><td class='sub right'>witch'/></form></td></tr>
<tr><td class='sub'>Wojtek's customized Guix</td><td class='sub right'></td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>refs</a><a href='/guix/log/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch'>log</a><a class='active' href='/guix/tree/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>tree</a><a href='/guix/commit/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>commit</a><a href='/guix/diff/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch'>
<input type='hidden' name='id' value='bd1b1e0517b046a6ad6d48633d43c644edea7424'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/tree/?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>root</a>/<a href='/guix/tree/gnu?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>gnu</a>/<a href='/guix/tree/gnu/packages?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>packages</a>/<a href='/guix/tree/gnu/packages/patches?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>patches</a>/<a href='/guix/tree/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>libxtst-CVE-2016-7951-CVE-2016-7952.patch</a></div><div class='content'>blob: 9df6cf3f4de2e3e6a1218373e4af5b416e630cd0 (<a href='/guix/about/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>about</a>) (<a href='/guix/plain/gnu/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch?id=bd1b1e0517b046a6ad6d48633d43c644edea7424'>plain</a>)
<table summary='blob content' class='blob'>
<tr><td class='linenumbers'><pre><a id='n1' href='#n1'>1</a>
<a id='n2' href='#n2'>2</a>
<a id='n3' href='#n3'>3</a>
<a id='n4' href='#n4'>4</a>
<a id='n5' href='#n5'>5</a>
<a id='n6' href='#n6'>6</a>
<a id='n7' href='#n7'>7</a>
<a id='n8' href='#n8'>8</a>
<a id='n9' href='#n9'>9</a>
<a id='n10' href='#n10'>10</a>
<a id='n11' href='#n11'>11</a>
<a id='n12' href='#n12'>12</a>
<a id='n13' href='#n13'>13</a>
<a id='n14' href='#n14'>14</a>
<a id='n15' href='#n15'>15</a>
<a id='n16' href='#n16'>16</a>
<a id='n17' href='#n17'>17</a>
<a id='n18' href='#n18'>18</a>
<a id='n19' href='#n19'>19</a>
<a id='n20' href='#n20'>20</a>
<a id='n21' href='#n21'>21</a>
<a id='n22' href='#n22'>22</a>
<a id='n23' href='#n23'>23</a>
<a id='n24' href='#n24'>24</a>
<a id='n25' href='#n25'>25</a>
<a id='n26' href='#n26'>26</a>
<a id='n27' href='#n27'>27</a>
<a id='n28' href='#n28'>28</a>
<a id='n29' href='#n29'>29</a>
<a id='n30' href='#n30'>30</a>
<a id='n31' href='#n31'>31</a>
<a id='n32' href='#n32'>32</a>
<a id='n33' href='#n33'>33</a>
<a id='n34' href='#n34'>34</a>
<a id='n35' href='#n35'>35</a>
<a id='n36' href='#n36'>36</a>
<a id='n37' href='#n37'>37</a>
<a id='n38' href='#n38'>38</a>
<a id='n39' href='#n39'>39</a>
<a id='n40' href='#n40'>40</a>
<a id='n41' href='#n41'>41</a>
<a id='n42' href='#n42'>42</a>
<a id='n43' href='#n43'>43</a>
<a id='n44' href='#n44'>44</a>
<a id='n45' href='#n45'>45</a>
<a id='n46' href='#n46'>46</a>
<a id='n47' href='#n47'>47</a>
<a id='n48' href='#n48'>48</a>
<a id='n49' href='#n49'>49</a>
<a id='n50' href='#n50'>50</a>
<a id='n51' href='#n51'>51</a>
<a id='n52' href='#n52'>52</a>
<a id='n53' href='#n53'>53</a>
<a id='n54' href='#n54'>54</a>
<a id='n55' href='#n55'>55</a>
<a id='n56' href='#n56'>56</a>
<a id='n57' href='#n57'>57</a>
<a id='n58' href='#n58'>58</a>
<a id='n59' href='#n59'>59</a>
<a id='n60' href='#n60'>60</a>
<a id='n61' href='#n61'>61</a>
<a id='n62' href='#n62'>62</a>
<a id='n63' href='#n63'>63</a>
<a id='n64' href='#n64'>64</a>
<a id='n65' href='#n65'>65</a>
<a id='n66' href='#n66'>66</a>
<a id='n67' href='#n67'>67</a>
<a id='n68' href='#n68'>68</a>
<a id='n69' href='#n69'>69</a>
<a id='n70' href='#n70'>70</a>
<a id='n71' href='#n71'>71</a>
<a id='n72' href='#n72'>72</a>
<a id='n73' href='#n73'>73</a>
<a id='n74' href='#n74'>74</a>
<a id='n75' href='#n75'>75</a>
<a id='n76' href='#n76'>76</a>
<a id='n77' href='#n77'>77</a>
<a id='n78' href='#n78'>78</a>
<a id='n79' href='#n79'>79</a>
<a id='n80' href='#n80'>80</a>
<a id='n81' href='#n81'>81</a>
<a id='n82' href='#n82'>82</a>
<a id='n83' href='#n83'>83</a>
<a id='n84' href='#n84'>84</a>
<a id='n85' href='#n85'>85</a>
<a id='n86' href='#n86'>86</a>
<a id='n87' href='#n87'>87</a>
<a id='n88' href='#n88'>88</a>
<a id='n89' href='#n89'>89</a>
<a id='n90' href='#n90'>90</a>
<a id='n91' href='#n91'>91</a>
<a id='n92' href='#n92'>92</a>
<a id='n93' href='#n93'>93</a>
<a id='n94' href='#n94'>94</a>
<a id='n95' href='#n95'>95</a>
<a id='n96' href='#n96'>96</a>
<a id='n97' href='#n97'>97</a>
<a id='n98' href='#n98'>98</a>
<a id='n99' href='#n99'>99</a>
<a id='n100' href='#n100'>100</a>
<a id='n101' href='#n101'>101</a>
<a id='n102' href='#n102'>102</a>
<a id='n103' href='#n103'>103</a>
<a id='n104' href='#n104'>104</a>
<a id='n105' href='#n105'>105</a>
<a id='n106' href='#n106'>106</a>
<a id='n107' href='#n107'>107</a>
<a id='n108' href='#n108'>108</a>
<a id='n109' href='#n109'>109</a>
<a id='n110' href='#n110'>110</a>
<a id='n111' href='#n111'>111</a>
<a id='n112' href='#n112'>112</a>
<a id='n113' href='#n113'>113</a>
<a id='n114' href='#n114'>114</a>
<a id='n115' href='#n115'>115</a>
<a id='n116' href='#n116'>116</a>
<a id='n117' href='#n117'>117</a>
<a id='n118' href='#n118'>118</a>
<a id='n119' href='#n119'>119</a>
<a id='n120' href='#n120'>120</a>
<a id='n121' href='#n121'>121</a>
<a id='n122' href='#n122'>122</a>
<a id='n123' href='#n123'>123</a>
<a id='n124' href='#n124'>124</a>
<a id='n125' href='#n125'>125</a>
<a id='n126' href='#n126'>126</a>
<a id='n127' href='#n127'>127</a>
<a id='n128' href='#n128'>128</a>
<a id='n129' href='#n129'>129</a>
<a id='n130' href='#n130'>130</a>
<a id='n131' href='#n131'>131</a>
<a id='n132' href='#n132'>132</a>
<a id='n133' href='#n133'>133</a>
<a id='n134' href='#n134'>134</a>
<a id='n135' href='#n135'>135</a>
<a id='n136' href='#n136'>136</a>
<a id='n137' href='#n137'>137</a>
<a id='n138' href='#n138'>138</a>
<a id='n139' href='#n139'>139</a>
<a id='n140' href='#n140'>140</a>
<a id='n141' href='#n141'>141</a>
<a id='n142' href='#n142'>142</a>
<a id='n143' href='#n143'>143</a>
<a id='n144' href='#n144'>144</a>
<a id='n145' href='#n145'>145</a>
<a id='n146' href='#n146'>146</a>
<a id='n147' href='#n147'>147</a>
<a id='n148' href='#n148'>148</a>
<a id='n149' href='#n149'>149</a>
<a id='n150' href='#n150'>150</a>
<a id='n151' href='#n151'>151</a>
<a id='n152' href='#n152'>152</a>
</pre></td>
<td class='lines'><pre><code>Fix CVE-2016-7951 and CVE-2016-7952

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7951
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7952

Patch copied from upstream source repository:

https://cgit.freedesktop.org/xorg/lib/libXtst/commit/?id=9556ad67af3129ec4a7a4f4b54a0d59701beeae3

From 9556ad67af3129ec4a7a4f4b54a0d59701beeae3 Mon Sep 17 00:00:00 2001
From: Tobias Stoeckmann &lt;tobias@stoeckmann.org&gt;
Date: Sun, 25 Sep 2016 21:37:01 +0200
Subject: [PATCH] Out of boundary access and endless loop in libXtst

A lack of range checks in libXtst allows out of boundary accesses.
The checks have to be done in-place here, because it cannot be done
without in-depth knowledge of the read data.

If XRecordStartOfData, XRecordEndOfData, or XRecordClientDied
without a client sequence have attached data, an endless loop would
occur. The do-while-loop continues until the current index reaches
the end. But in these cases, the current index would not be
incremented, leading to an endless processing.

Signed-off-by: Tobias Stoeckmann &lt;tobias@stoeckmann.org&gt;
Reviewed-by: Matthieu Herrb &lt;matthieu@herrb.eu&gt;
---
 src/XRecord.c | 43 +++++++++++++++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 4 deletions(-)

diff --git a/src/XRecord.c b/src/XRecord.c
index 50420c0..fefd842 100644
--- a/src/XRecord.c
+++ b/src/XRecord.c
@@ -749,15 +749,23 @@ parse_reply_call_callback(
 	switch (rep-&gt;category) {
 	case XRecordFromServer:
 	    if (rep-&gt;elementHeader&amp;XRecordFromServerTime) {
+		if (current_index + 4 &gt; rep-&gt;length &lt;&lt; 2)
+		    return Error;
 		EXTRACT_CARD32(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index,
 			       data-&gt;server_time);
 		current_index += 4;
 	    }
+	    if (current_index + 1 &gt; rep-&gt;length &lt;&lt; 2)
+		return Error;
 	    switch (reply-&gt;buf[current_index]) {
 	    case X_Reply: /* reply */
+		if (current_index + 8 &gt; rep-&gt;length &lt;&lt; 2)
+		    return Error;
 		EXTRACT_CARD32(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index+4, datum_bytes);
+		if (datum_bytes &lt; 0 || datum_bytes &gt; ((INT_MAX &gt;&gt; 2) - 8))
+		    return Error;
 		datum_bytes = (datum_bytes+8) &lt;&lt; 2;
 		break;
 	    default: /* error or event */
@@ -766,52 +774,73 @@ parse_reply_call_callback(
 	    break;
 	case XRecordFromClient:
 	    if (rep-&gt;elementHeader&amp;XRecordFromClientTime) {
+		if (current_index + 4 &gt; rep-&gt;length &lt;&lt; 2)
+		    return Error;
 		EXTRACT_CARD32(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index,
 			       data-&gt;server_time);
 		current_index += 4;
 	    }
 	    if (rep-&gt;elementHeader&amp;XRecordFromClientSequence) {
+		if (current_index + 4 &gt; rep-&gt;length &lt;&lt; 2)
+		    return Error;
 		EXTRACT_CARD32(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index,
 			       data-&gt;client_seq);
 		current_index += 4;
 	    }
+	    if (current_index + 4 &gt; rep-&gt;length&lt;&lt;2)
+		return Error;
 	    if (reply-&gt;buf[current_index+2] == 0
 		&amp;&amp; reply-&gt;buf[current_index+3] == 0) /* needn't swap 0 */
 	    {	/* BIG-REQUESTS */
+		if (current_index + 8 &gt; rep-&gt;length &lt;&lt; 2)
+		    return Error;
 		EXTRACT_CARD32(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index+4, datum_bytes);
 	    } else {
 		EXTRACT_CARD16(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index+2, datum_bytes);
 	    }
+	    if (datum_bytes &lt; 0 || datum_bytes &gt; INT_MAX &gt;&gt; 2)
+		return Error;
 	    datum_bytes &lt;&lt;= 2;
 	    break;
 	case XRecordClientStarted:
+	    if (current_index + 8 &gt; rep-&gt;length &lt;&lt; 2)
+		return Error;
 	    EXTRACT_CARD16(rep-&gt;clientSwapped,
 			   reply-&gt;buf+current_index+6, datum_bytes);
 	    datum_bytes = (datum_bytes+2) &lt;&lt; 2;
 	    break;
 	case XRecordClientDied:
 	    if (rep-&gt;elementHeader&amp;XRecordFromClientSequence) {
+		if (current_index + 4 &gt; rep-&gt;length &lt;&lt; 2)
+		    return Error;
 		EXTRACT_CARD32(rep-&gt;clientSwapped,
 			       reply-&gt;buf+current_index,
 			       data-&gt;client_seq);
 		current_index += 4;
-	    }
-	    /* fall through */
+	    } else if (current_index &lt; rep-&gt;length &lt;&lt; 2)
+		return Error;
+	    datum_bytes = 0;
+	    break;
 	case XRecordStartOfData:
 	case XRecordEndOfData:
+	    if (current_index &lt; rep-&gt;length &lt;&lt; 2)
+		return Error;
 	    datum_bytes = 0;
+	    break;
 	}
 
 	if (datum_bytes &gt; 0) {
-	    if (current_index + datum_bytes &gt; rep-&gt;length &lt;&lt; 2)
+	    if (INT_MAX - datum_bytes &lt; (rep-&gt;length &lt;&lt; 2) - current_index) {
 		fprintf(stderr,
 			"XRecord: %lu-byte reply claims %d-byte element (seq %lu)\n",
-			(long)rep-&gt;length &lt;&lt; 2, current_index + datum_bytes,
+			(unsigned long)rep-&gt;length &lt;&lt; 2, current_index + datum_bytes,
 			dpy-&gt;last_request_read);
+		return Error;
+	    }
 	    /*
 	     * This assignment (and indeed the whole buffer sharing
 	     * scheme) assumes arbitrary 4-byte boundaries are
@@ -863,6 +892,12 @@ XRecordEnableContext(Display *dpy, XRecordContext context,
 	    return 0;
 	}
 
+	if (rep.length &gt; INT_MAX &gt;&gt; 2) {
+	    UnlockDisplay(dpy);
+	    SyncHandle();
+	    return 0;
+	}
+
 	if (rep.length &gt; 0) {
 	    reply = alloc_reply_buffer(info, rep.length&lt;&lt;2);
 	    if (!reply) {
-- 
2.10.1

</code></pre></td></tr></table>
</div> <!-- class=content -->
                         <div class=footer>generated by
                             <a href="https://git.zx2c4.com/cgit/about/">
                                 cgit
                             </a>
                         </div>
                        </div> <!-- id=cgit -->
</body>
</html>
