mirror of
git://slackware.nl/current.git
synced 2024-12-31 10:28:29 +01:00
dd0455444d
a/dialog-1.3_20211214-x86_64-1.txz: Upgraded.
a/kernel-generic-5.15.8-x86_64-1.txz: Upgraded.
a/kernel-huge-5.15.8-x86_64-1.txz: Upgraded.
a/kernel-modules-5.15.8-x86_64-1.txz: Upgraded.
a/sysvinit-3.01-x86_64-1.txz: Upgraded.
d/kernel-headers-5.15.8-x86-1.txz: Upgraded.
d/patchelf-0.14.3-x86_64-1.txz: Upgraded.
k/kernel-source-5.15.8-noarch-1.txz: Upgraded.
l/oniguruma-6.9.7.1-x86_64-1.txz: Upgraded.
l/pipewire-0.3.41-x86_64-1.txz: Upgraded.
x/libinput-1.19.3-x86_64-1.txz: Upgraded.
x/xorg-server-1.20.13-x86_64-2.txz: Rebuilt.
Fixes for multiple input validation failures in X server extensions:
render: Fix out of bounds access in SProcRenderCompositeGlyphs()
xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
Xext: Fix out of bounds access in SProcScreenSaverSuspend()
record: Fix out of bounds access in SwapCreateRegister()
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4008
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4009
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4010
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4011
(* Security fix *)
x/xorg-server-xephyr-1.20.13-x86_64-2.txz: Rebuilt.
x/xorg-server-xnest-1.20.13-x86_64-2.txz: Rebuilt.
x/xorg-server-xvfb-1.20.13-x86_64-2.txz: Rebuilt.
x/xorg-server-xwayland-21.1.4-x86_64-1.txz: Upgraded.
Fixes for multiple input validation failures in X server extensions:
render: Fix out of bounds access in SProcRenderCompositeGlyphs()
xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
Xext: Fix out of bounds access in SProcScreenSaverSuspend()
record: Fix out of bounds access in SwapCreateRegister()
For more information, see:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4008
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4009
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4010
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4011
(* Security fix *)
xap/xsnow-3.4.1-x86_64-1.txz: Upgraded.
isolinux/initrd.img: Rebuilt.
kernels/*: Upgraded.
usb-and-pxe-installers/usbboot.img: Rebuilt.
52 lines
1.5 KiB
Diff
52 lines
1.5 KiB
Diff
From ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60 Mon Sep 17 00:00:00 2001
|
|
From: Povilas Kanapickas <povilas@radix.lt>
|
|
Date: Tue, 14 Dec 2021 15:00:03 +0200
|
|
Subject: [PATCH] render: Fix out of bounds access in
|
|
SProcRenderCompositeGlyphs()
|
|
|
|
ZDI-CAN-14192, CVE-2021-4008
|
|
|
|
This vulnerability was discovered and the fix was suggested by:
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
|
|
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
|
|
---
|
|
render/render.c | 9 +++++++++
|
|
1 file changed, 9 insertions(+)
|
|
|
|
diff --git a/render/render.c b/render/render.c
|
|
index c376090ca..456f156d4 100644
|
|
--- a/render/render.c
|
|
+++ b/render/render.c
|
|
@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
|
|
|
|
i = elt->len;
|
|
if (i == 0xff) {
|
|
+ if (buffer + 4 > end) {
|
|
+ return BadLength;
|
|
+ }
|
|
swapl((int *) buffer);
|
|
buffer += 4;
|
|
}
|
|
@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
|
|
buffer += i;
|
|
break;
|
|
case 2:
|
|
+ if (buffer + i * 2 > end) {
|
|
+ return BadLength;
|
|
+ }
|
|
while (i--) {
|
|
swaps((short *) buffer);
|
|
buffer += 2;
|
|
}
|
|
break;
|
|
case 4:
|
|
+ if (buffer + i * 4 > end) {
|
|
+ return BadLength;
|
|
+ }
|
|
while (i--) {
|
|
swapl((int *) buffer);
|
|
buffer += 4;
|
|
--
|
|
GitLab
|
|
|