ChangeLog | 49 ++++++++++++++++++++++++++++++++++++++++++++ autogen.sh | 4 ++- configure.ac | 9 ++++++-- debian/changelog | 16 ++++++++++++++ debian/compat | 2 - debian/control | 2 + debian/rules | 19 ++++++----------- src/Xinerama.c | 61 ++++++++++++++++++++++++++++++++++++++++--------------- 8 files changed, 130 insertions(+), 32 deletions(-)
New commits: commit 6f5f44df24e5d22ab249531c3bc2981b7ac373be Author: Julien Cristau <jcris...@debian.org> Date: Sun Jun 30 18:06:03 2013 +0200 Upload to unstable diff --git a/debian/changelog b/debian/changelog index 0a46ec5..0b18d7e 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -libxinerama (2:1.1.3-1) UNRELEASED; urgency=low +libxinerama (2:1.1.3-1) sid; urgency=low * New upstream release. * Bump debhelper compat level to 7. @@ -6,7 +6,7 @@ libxinerama (2:1.1.3-1) UNRELEASED; urgency=low * Use dh_prep instead of dh_clean -k. * Disable silent build rules. - -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 17:55:23 +0200 + -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 18:05:54 +0200 libxinerama (2:1.1.2-1+deb7u1) wheezy-security; urgency=high commit eac5cb4345cca7cfae785979dc7579ee77c4cc2b Author: Julien Cristau <jcris...@debian.org> Date: Sun Jun 30 18:01:45 2013 +0200 Disable silent build rules. diff --git a/debian/changelog b/debian/changelog index 8108218..0a46ec5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -4,6 +4,7 @@ libxinerama (2:1.1.3-1) UNRELEASED; urgency=low * Bump debhelper compat level to 7. * Use dpkg-buildflags. * Use dh_prep instead of dh_clean -k. + * Disable silent build rules. -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 17:55:23 +0200 diff --git a/debian/rules b/debian/rules index 7e7fab3..572ce56 100755 --- a/debian/rules +++ b/debian/rules @@ -41,6 +41,7 @@ build-stamp: ../configure --prefix=/usr --mandir=\$${prefix}/share/man \ --libdir=\$${prefix}/lib/$(DEB_HOST_MULTIARCH) \ --infodir=\$${prefix}/share/info \ + --disable-silent-rules \ $(confflags) cd build && $(MAKE) >$@ commit b6bc94bd23a679ece7065568e28f6c7263698b10 Author: Julien Cristau <jcris...@debian.org> Date: Sun Jun 30 18:01:23 2013 +0200 Use dh_prep instead of dh_clean -k. diff --git a/debian/changelog b/debian/changelog index 16e9a4c..8108218 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,6 +3,7 @@ libxinerama (2:1.1.3-1) UNRELEASED; urgency=low * New upstream release. * Bump debhelper compat level to 7. * Use dpkg-buildflags. + * Use dh_prep instead of dh_clean -k. -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 17:55:23 +0200 diff --git a/debian/rules b/debian/rules index 1a9b09d..7e7fab3 100755 --- a/debian/rules +++ b/debian/rules @@ -62,7 +62,7 @@ clean: install: build dh_testdir dh_testroot - dh_clean -k + dh_prep dh_installdirs cd build && $(MAKE) DESTDIR=$(CURDIR)/debian/tmp install commit bc035473e07b4640bdb96d417369798f6e9fb18a Author: Julien Cristau <jcris...@debian.org> Date: Sun Jun 30 18:00:10 2013 +0200 Use dpkg-buildflags. diff --git a/debian/changelog b/debian/changelog index cd42d76..16e9a4c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -2,6 +2,7 @@ libxinerama (2:1.1.3-1) UNRELEASED; urgency=low * New upstream release. * Bump debhelper compat level to 7. + * Use dpkg-buildflags. -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 17:55:23 +0200 diff --git a/debian/control b/debian/control index 617fc8e..e0a811c 100644 --- a/debian/control +++ b/debian/control @@ -5,6 +5,8 @@ Maintainer: Debian X Strike Force <debian-x@lists.debian.org> Uploaders: Cyril Brulebois <k...@debian.org> Build-Depends: debhelper (>= 8.1.3), +# dpkg-buildflags --export=configure + dpkg-dev (>= 1.16.1), libx11-dev (>= 2:1.3.3-2), libxext-dev (>= 2:1.1.1-3), x11proto-xinerama-dev (>= 1.2), diff --git a/debian/rules b/debian/rules index 28f26e0..1a9b09d 100755 --- a/debian/rules +++ b/debian/rules @@ -12,12 +12,6 @@ PACKAGE = libxinerama1 include debian/xsfbs/xsfbs.mk -CFLAGS = -Wall -g -ifneq (,$(filter noopt,$(DEB_BUILD_OPTIONS))) - CFLAGS += -O0 -else - CFLAGS += -O2 -endif ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS))) NUMJOBS = $(patsubst parallel=%,%,$(filter parallel=%,$(DEB_BUILD_OPTIONS))) MAKEFLAGS += -j$(NUMJOBS) @@ -32,7 +26,7 @@ ifeq ($(DEB_BUILD_GNU_TYPE), $(DEB_HOST_GNU_TYPE)) else confflags += --build=$(DEB_BUILD_GNU_TYPE) --host=$(DEB_HOST_GNU_TYPE) endif - +confflags += $(shell DEB_CFLAGS_MAINT_APPEND=-Wall dpkg-buildflags --export=configure) build: build-arch build-indep build-arch: build-stamp @@ -46,8 +40,8 @@ build-stamp: cd build && \ ../configure --prefix=/usr --mandir=\$${prefix}/share/man \ --libdir=\$${prefix}/lib/$(DEB_HOST_MULTIARCH) \ - --infodir=\$${prefix}/share/info $(confflags) \ - CFLAGS="$(CFLAGS)" + --infodir=\$${prefix}/share/info \ + $(confflags) cd build && $(MAKE) >$@ commit b6c0b20a59620e539dcfa82f094bfc69376d9aa6 Author: Julien Cristau <jcris...@debian.org> Date: Sun Jun 30 17:58:20 2013 +0200 Bump debhelper compat level to 7. diff --git a/debian/changelog b/debian/changelog index 182d6f0..cd42d76 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,7 @@ libxinerama (2:1.1.3-1) UNRELEASED; urgency=low * New upstream release. + * Bump debhelper compat level to 7. -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 17:55:23 +0200 diff --git a/debian/compat b/debian/compat index 7ed6ff8..7f8f011 100644 --- a/debian/compat +++ b/debian/compat @@ -1 +1 @@ -5 +7 diff --git a/debian/rules b/debian/rules index f716417..28f26e0 100755 --- a/debian/rules +++ b/debian/rules @@ -79,8 +79,8 @@ binary-arch: build install dh_testroot dh_installdocs - dh_install --sourcedir=debian/tmp --fail-missing -XlibXinerama.la - dh_installchangelogs ChangeLog + dh_install --fail-missing -XlibXinerama.la + dh_installchangelogs dh_installman dh_link dh_strip -p$(PACKAGE) --dbg-package=$(PACKAGE)-dbg commit 27df895a2fa5c14be301f66bb4ced6e6bdc70692 Author: Julien Cristau <jcris...@debian.org> Date: Sun Jun 30 17:55:41 2013 +0200 Bump changelogs diff --git a/ChangeLog b/ChangeLog index 779346a..e66f8c7 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,52 @@ +commit 6e1d1dc328ba8162bba2f4694e7f3c706a1491ff +Author: Alan Coopersmith <alan.coopersm...@oracle.com> +Date: Thu May 30 17:27:51 2013 -0700 + + libXinerama 1.1.3 + + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit 99c644fc8488657bdd106717df7446d606f9ef22 +Author: Alan Coopersmith <alan.coopersm...@oracle.com> +Date: Fri Mar 8 19:55:55 2013 -0800 + + integer overflow in XineramaQueryScreens() [CVE-2013-1985] + + If the reported number of screens is too large, the calculations to + allocate memory for them may overflow, leaving us writing beyond the + bounds of the allocation. + + Reported-by: Ilja Van Sprundel <ivansprun...@ioactive.com> + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit 7ce3ce4be46087f9cc57cb415875abaaa961f734 +Author: Alan Coopersmith <alan.coopersm...@oracle.com> +Date: Sat May 4 09:21:14 2013 -0700 + + Use _XEatDataWords to avoid overflow of _XEatData calculations + + rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds + + Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> + +commit 470b9356af961ff7d3968b164aa73872b49a5dcc +Author: Colin Walters <walt...@verbum.org> +Date: Wed Jan 4 17:37:06 2012 -0500 + + autogen.sh: Implement GNOME Build API + + http://people.gnome.org/~walters/docs/build-api.txt + + Signed-off-by: Adam Jackson <a...@redhat.com> + +commit c20859051442e4a262895a78ae934758fbdc34a0 +Author: Adam Jackson <a...@redhat.com> +Date: Tue Jan 15 14:28:48 2013 -0500 + + configure: Remove AM_MAINTAINER_MODE + + Signed-off-by: Adam Jackson <a...@redhat.com> + commit 34b66b71eeb04a50125a3e5c59fe0d22500ab679 Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Wed Mar 7 20:29:30 2012 -0800 diff --git a/debian/changelog b/debian/changelog index 646c2c8..182d6f0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +libxinerama (2:1.1.3-1) UNRELEASED; urgency=low + + * New upstream release. + + -- Julien Cristau <jcris...@debian.org> Sun, 30 Jun 2013 17:55:23 +0200 + libxinerama (2:1.1.2-1+deb7u1) wheezy-security; urgency=high * integer overflow in XineramaQueryScreens() [CVE-2013-1985] commit 6e1d1dc328ba8162bba2f4694e7f3c706a1491ff Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Thu May 30 17:27:51 2013 -0700 libXinerama 1.1.3 Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> diff --git a/configure.ac b/configure.ac index 046a1aa..17c5cb1 100644 --- a/configure.ac +++ b/configure.ac @@ -21,7 +21,7 @@ # Initialize Autoconf AC_PREREQ([2.60]) -AC_INIT([libXinerama], [1.1.2], +AC_INIT([libXinerama], [1.1.3], [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], [libXinerama]) AC_CONFIG_SRCDIR([Makefile.am]) AC_CONFIG_HEADERS([config.h]) commit 0a024e79b44f0c2800a33a5bed3e27b5a21b47c9 Author: Julien Cristau <jcris...@debian.org> Date: Tue May 14 16:49:22 2013 +0200 Upload to wheezy-security diff --git a/debian/changelog b/debian/changelog index 774a9c1..646c2c8 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +libxinerama (2:1.1.2-1+deb7u1) wheezy-security; urgency=high + + * integer overflow in XineramaQueryScreens() [CVE-2013-1985] + + -- Julien Cristau <jcris...@debian.org> Tue, 14 May 2013 16:48:48 +0200 + libxinerama (2:1.1.2-1) unstable; urgency=low * New upstream release. commit 0e1cc86e8fc9f56ac97a60ed22270b230207a1cf Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Fri Mar 8 19:55:55 2013 -0800 integer overflow in XineramaQueryScreens() [CVE-2013-1985] If the reported number of screens is too large, the calculations to allocate memory for them may overflow, leaving us writing beyond the bounds of the allocation. Reported-by: Ilja Van Sprundel <ivansprun...@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> Signed-off-by: Julien Cristau <jcris...@debian.org> diff --git a/src/Xinerama.c b/src/Xinerama.c index 04189b6..67a35b5 100644 --- a/src/Xinerama.c +++ b/src/Xinerama.c @@ -303,24 +303,36 @@ XineramaQueryScreens( return NULL; } - if(rep.number) { - if((scrnInfo = Xmalloc(sizeof(XineramaScreenInfo) * rep.number))) { + /* + * rep.number is a CARD32 so could be as large as 2^32 + * The X11 protocol limits the total screen size to 64k x 64k, + * and no screen can be smaller than a pixel. While technically + * that means we could theoretically reach 2^32 screens, and that's + * not even taking overlap into account, Xorg is currently limited + * to 16 screens, and few known servers have a much higher limit, + * so 1024 seems more than enough to prevent both integer overflow + * and insane X server responses causing massive memory allocation. + */ + if ((rep.number > 0) && (rep.number <= 1024)) + scrnInfo = Xmalloc(sizeof(XineramaScreenInfo) * rep.number); + if (scrnInfo != NULL) { + int i; + + for (i = 0; i < rep.number; i++) { xXineramaScreenInfo scratch; - int i; - - for(i = 0; i < rep.number; i++) { - _XRead(dpy, (char*)(&scratch), sz_XineramaScreenInfo); - scrnInfo[i].screen_number = i; - scrnInfo[i].x_org = scratch.x_org; - scrnInfo[i].y_org = scratch.y_org; - scrnInfo[i].width = scratch.width; - scrnInfo[i].height = scratch.height; - } - - *number = rep.number; - } else - _XEatDataWords(dpy, rep.length); + + _XRead(dpy, (char*)(&scratch), sz_XineramaScreenInfo); + + scrnInfo[i].screen_number = i; + scrnInfo[i].x_org = scratch.x_org; + scrnInfo[i].y_org = scratch.y_org; + scrnInfo[i].width = scratch.width; + scrnInfo[i].height = scratch.height; + } + + *number = rep.number; } else { + _XEatDataWords(dpy, rep.length); *number = 0; } commit 8c1bc19660e55761b2418d0d12e63eec5e423932 Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Sat May 4 09:21:14 2013 -0700 Use _XEatDataWords to avoid overflow of _XEatData calculations rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> Signed-off-by: Julien Cristau <jcris...@debian.org> diff --git a/configure.ac b/configure.ac index 545c946..d5a7696 100644 --- a/configure.ac +++ b/configure.ac @@ -43,6 +43,12 @@ XORG_CHECK_MALLOC_ZERO # Obtain compiler/linker options for depedencies PKG_CHECK_MODULES(XINERAMA, x11 xext xextproto [xineramaproto >= 1.1.99.1]) +# Check for _XEatDataWords function that may be patched into older Xlib releases +SAVE_LIBS="$LIBS" +LIBS="$XINERAMA_LIBS" +AC_CHECK_FUNCS([_XEatDataWords]) +LIBS="$SAVE_LIBS" + # Allow checking code with lint, sparse, etc. XORG_WITH_LINT LINT_FLAGS="${LINT_FLAGS} ${XINERAMA_CFLAGS}" diff --git a/src/Xinerama.c b/src/Xinerama.c index 7d7e4d8..04189b6 100644 --- a/src/Xinerama.c +++ b/src/Xinerama.c @@ -23,6 +23,10 @@ dealings in this Software without prior written authorization from Digital Equipment Corporation. ******************************************************************/ +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif + #include <X11/Xlibint.h> #include <X11/Xutil.h> #include <X11/extensions/Xext.h> @@ -31,6 +35,19 @@ Equipment Corporation. #include <X11/extensions/panoramiXproto.h> #include <X11/extensions/Xinerama.h> +#ifndef HAVE__XEATDATAWORDS +#include <X11/Xmd.h> /* for LONG64 on 64-bit platforms */ +#include <limits.h> + +static inline void _XEatDataWords(Display *dpy, unsigned long n) +{ +# ifndef LONG64 + if (n >= (ULONG_MAX >> 2)) + _XIOError(dpy); +# endif + _XEatData (dpy, n << 2); +} +#endif static XExtensionInfo _panoramiX_ext_info_data; static XExtensionInfo *panoramiX_ext_info = &_panoramiX_ext_info_data; @@ -302,7 +319,7 @@ XineramaQueryScreens( *number = rep.number; } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } else { *number = 0; } commit 99c644fc8488657bdd106717df7446d606f9ef22 Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Fri Mar 8 19:55:55 2013 -0800 integer overflow in XineramaQueryScreens() [CVE-2013-1985] If the reported number of screens is too large, the calculations to allocate memory for them may overflow, leaving us writing beyond the bounds of the allocation. Reported-by: Ilja Van Sprundel <ivansprun...@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> diff --git a/src/Xinerama.c b/src/Xinerama.c index 04189b6..67a35b5 100644 --- a/src/Xinerama.c +++ b/src/Xinerama.c @@ -303,24 +303,36 @@ XineramaQueryScreens( return NULL; } - if(rep.number) { - if((scrnInfo = Xmalloc(sizeof(XineramaScreenInfo) * rep.number))) { + /* + * rep.number is a CARD32 so could be as large as 2^32 + * The X11 protocol limits the total screen size to 64k x 64k, + * and no screen can be smaller than a pixel. While technically + * that means we could theoretically reach 2^32 screens, and that's + * not even taking overlap into account, Xorg is currently limited + * to 16 screens, and few known servers have a much higher limit, + * so 1024 seems more than enough to prevent both integer overflow + * and insane X server responses causing massive memory allocation. + */ + if ((rep.number > 0) && (rep.number <= 1024)) + scrnInfo = Xmalloc(sizeof(XineramaScreenInfo) * rep.number); + if (scrnInfo != NULL) { + int i; + + for (i = 0; i < rep.number; i++) { xXineramaScreenInfo scratch; - int i; - - for(i = 0; i < rep.number; i++) { - _XRead(dpy, (char*)(&scratch), sz_XineramaScreenInfo); - scrnInfo[i].screen_number = i; - scrnInfo[i].x_org = scratch.x_org; - scrnInfo[i].y_org = scratch.y_org; - scrnInfo[i].width = scratch.width; - scrnInfo[i].height = scratch.height; - } - - *number = rep.number; - } else - _XEatDataWords(dpy, rep.length); + + _XRead(dpy, (char*)(&scratch), sz_XineramaScreenInfo); + + scrnInfo[i].screen_number = i; + scrnInfo[i].x_org = scratch.x_org; + scrnInfo[i].y_org = scratch.y_org; + scrnInfo[i].width = scratch.width; + scrnInfo[i].height = scratch.height; + } + + *number = rep.number; } else { + _XEatDataWords(dpy, rep.length); *number = 0; } commit 7ce3ce4be46087f9cc57cb415875abaaa961f734 Author: Alan Coopersmith <alan.coopersm...@oracle.com> Date: Sat May 4 09:21:14 2013 -0700 Use _XEatDataWords to avoid overflow of _XEatData calculations rep.length is a CARD32, so rep.length << 2 could overflow in 32-bit builds Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com> diff --git a/configure.ac b/configure.ac index e335508..046a1aa 100644 --- a/configure.ac +++ b/configure.ac @@ -42,6 +42,12 @@ XORG_CHECK_MALLOC_ZERO # Obtain compiler/linker options for depedencies PKG_CHECK_MODULES(XINERAMA, x11 xext xextproto [xineramaproto >= 1.1.99.1]) +# Check for _XEatDataWords function that may be patched into older Xlib releases +SAVE_LIBS="$LIBS" +LIBS="$XINERAMA_LIBS" +AC_CHECK_FUNCS([_XEatDataWords]) +LIBS="$SAVE_LIBS" + # Allow checking code with lint, sparse, etc. XORG_WITH_LINT LINT_FLAGS="${LINT_FLAGS} ${XINERAMA_CFLAGS}" diff --git a/src/Xinerama.c b/src/Xinerama.c index 7d7e4d8..04189b6 100644 --- a/src/Xinerama.c +++ b/src/Xinerama.c @@ -23,6 +23,10 @@ dealings in this Software without prior written authorization from Digital Equipment Corporation. ******************************************************************/ +#ifdef HAVE_CONFIG_H +# include "config.h" +#endif + #include <X11/Xlibint.h> #include <X11/Xutil.h> #include <X11/extensions/Xext.h> @@ -31,6 +35,19 @@ Equipment Corporation. #include <X11/extensions/panoramiXproto.h> #include <X11/extensions/Xinerama.h> +#ifndef HAVE__XEATDATAWORDS +#include <X11/Xmd.h> /* for LONG64 on 64-bit platforms */ +#include <limits.h> + +static inline void _XEatDataWords(Display *dpy, unsigned long n) +{ +# ifndef LONG64 + if (n >= (ULONG_MAX >> 2)) + _XIOError(dpy); +# endif + _XEatData (dpy, n << 2); +} +#endif static XExtensionInfo _panoramiX_ext_info_data; static XExtensionInfo *panoramiX_ext_info = &_panoramiX_ext_info_data; @@ -302,7 +319,7 @@ XineramaQueryScreens( *number = rep.number; } else - _XEatData(dpy, rep.length << 2); + _XEatDataWords(dpy, rep.length); } else { *number = 0; } commit 470b9356af961ff7d3968b164aa73872b49a5dcc Author: Colin Walters <walt...@verbum.org> Date: Wed Jan 4 17:37:06 2012 -0500 autogen.sh: Implement GNOME Build API http://people.gnome.org/~walters/docs/build-api.txt Signed-off-by: Adam Jackson <a...@redhat.com> diff --git a/autogen.sh b/autogen.sh index 904cd67..fc34bd5 100755 --- a/autogen.sh +++ b/autogen.sh @@ -9,4 +9,6 @@ cd $srcdir autoreconf -v --install || exit 1 cd $ORIGDIR || exit $? -$srcdir/configure --enable-maintainer-mode "$@" +if test -z "$NOCONFIGURE"; then + $srcdir/configure "$@" +fi commit c20859051442e4a262895a78ae934758fbdc34a0 Author: Adam Jackson <a...@redhat.com> Date: Tue Jan 15 14:28:48 2013 -0500 configure: Remove AM_MAINTAINER_MODE Signed-off-by: Adam Jackson <a...@redhat.com> diff --git a/configure.ac b/configure.ac index 545c946..e335508 100644 --- a/configure.ac +++ b/configure.ac @@ -28,7 +28,6 @@ AC_CONFIG_HEADERS([config.h]) # Initialize Automake AM_INIT_AUTOMAKE([foreign dist-bzip2]) -AM_MAINTAINER_MODE # Initialize libtool AC_PROG_LIBTOOL -- To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/e1utkbo-0002pj...@vasks.debian.org