debian/changelog | 6 ++++++
debian/patches/pixman-validate.patch | 27 +++++++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 34 insertions(+)
New commits:
commit a2da7671d4b5b417fa845551d758507dc52d7493
Author: Maarten Lankhorst <maarten.lankho...@canonical.com>
Date: Wed Oct 23 12:12:45 2013 +0200
pixman-validate.patch: Do not render invalid trapezoids. (LP: #1197921)
diff --git a/debian/changelog b/debian/changelog
index 5cd5b79..f25f645 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+xorg-server (2:1.14.3-3ubuntu3) trusty; urgency=low
+
+ * pixman-validate.patch: Do not render invalid trapezoids. (LP: #1197921)
+
+ -- Maarten Lankhorst <maarten.lankho...@ubuntu.com> Wed, 23 Oct 2013
12:11:27 +0200
+
xorg-server (2:1.14.3-3ubuntu2) saucy-proposed; urgency=low
* avoid-use-after-free.diff: Fix CVE-2013-4396.
diff --git a/debian/patches/pixman-validate.patch
b/debian/patches/pixman-validate.patch
new file mode 100644
index 0000000..513de6c
--- /dev/null
+++ b/debian/patches/pixman-validate.patch
@@ -0,0 +1,27 @@
+diff --git a/exa/exa_render.c b/exa/exa_render.c
+index 172e2b5..807eeba 100644
+--- a/exa/exa_render.c
++++ b/exa/exa_render.c
+@@ -1141,7 +1141,8 @@ exaTrapezoids(CARD8 op, PicturePtr pSrc, PicturePtr pDst,
+
+ exaPrepareAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
+ for (; ntrap; ntrap--, traps++)
+- (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1,
-bounds.y1);
++ if (xTrapezoidValid(traps))
++ (*ps->RasterizeTrapezoid) (pPicture, traps, -bounds.x1,
-bounds.y1);
+ exaFinishAccess(pPicture->pDrawable, EXA_PREPARE_DEST);
+
+ xRel = bounds.x1 + xSrc - xDst;
+diff --git a/render/picture.h b/render/picture.h
+index c85353a..49eb263 100644
+--- a/render/picture.h
++++ b/render/picture.h
+@@ -211,7 +211,7 @@ typedef pixman_fixed_t xFixed;
+ /* whether 't' is a well defined not obviously empty trapezoid */
+ #define xTrapezoidValid(t) ((t)->left.p1.y != (t)->left.p2.y && \
+ (t)->right.p1.y != (t)->right.p2.y && \
+- (int) ((t)->bottom - (t)->top) > 0)
++ (t)->bottom > 0 && (int) ((t)->bottom - (t)->top)
> 0)
+
+ /*
+ * Standard NTSC luminance conversions:
diff --git a/debian/patches/series b/debian/patches/series
index 4288da4..ee8ffeb 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -62,3 +62,4 @@ glx-link-against-glapi.patch
aarch64.patch
xmir.patch
avoid-use-after-free.diff
+pixman-validate.patch
--
To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/e1vb4mh-0002c1...@vasks.debian.org
