debian/changelog | 10 +++++
debian/patches/16-xaa-fbcomposite-fix-negative-size.diff | 26 +++++++++++++++
debian/patches/series | 1
3 files changed, 37 insertions(+)
New commits:
commit c352ad2c99d27d65fd3f22a41a96180ac673b5d8
Author: Cyril Brulebois <k...@debian.org>
Date: Mon Apr 5 20:31:36 2010 +0200
Merge 112_xaa-fbcomposite-fix-negative-size.patch from ubuntu to fix
possible X crashes/exploits with XAA/compositing.
diff --git a/debian/changelog b/debian/changelog
index e9690f5..b4e1756 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+xorg-server (2:1.7.6-3) UNRELEASED; urgency=low
+
+ * Steal patch 112_xaa-fbcomposite-fix-negative-size.patch from ubuntu,
+ and rename it 16-xaa-fbcomposite-fix-negative-size.diff as it's now
+ applied in Debian as well. It fixes arithmetic bugs in mod(), which
+ could lead to X crashes/exploits when XAA and compositing are used;
+ thanks to Bryce Harrington.
+
+ -- Cyril Brulebois <k...@debian.org> Mon, 05 Apr 2010 20:25:26 +0200
+
xorg-server (2:1.7.6-2) unstable; urgency=low
[ Timo Aaltonen ]
diff --git a/debian/patches/16-xaa-fbcomposite-fix-negative-size.diff
b/debian/patches/16-xaa-fbcomposite-fix-negative-size.diff
new file mode 100644
index 0000000..39c1d87
--- /dev/null
+++ b/debian/patches/16-xaa-fbcomposite-fix-negative-size.diff
@@ -0,0 +1,26 @@
+diff --git a/fb/fbpict.c b/fb/fbpict.c
+index c046bae..7c06a64 100644
+--- a/fb/fbpict.c
++++ b/fb/fbpict.c
+@@ -37,7 +37,7 @@
+ #include "mipict.h"
+ #include "fbpict.h"
+
+-#define mod(a,b) ((b) == 1 ? 0 : (a) >= 0 ? (a) % (b) : (b) - (-a) % (b))
++#define mod(a,b) ((b) == 1 ? 0 : (a) >= 0 ? (a) % (b) : (b) - (-(a)) % (b))
+
+ void
+ fbWalkCompositeRegion (CARD8 op,
+diff --git a/mi/miarc.c b/mi/miarc.c
+index a3e2580..54fd743 100644
+--- a/mi/miarc.c
++++ b/mi/miarc.c
+@@ -1524,7 +1524,7 @@ miRoundCap(
+
+ # define Dsin(d) ((d) == 0.0 ? 0.0 : ((d) == 90.0 ? 1.0 :
sin(d*M_PI/180.0)))
+ # define Dcos(d) ((d) == 0.0 ? 1.0 : ((d) == 90.0 ? 0.0 :
cos(d*M_PI/180.0)))
+-# define mod(a,b) ((a) >= 0 ? (a) % (b) : (b) - (-a) % (b))
++# define mod(a,b) ((a) >= 0 ? (a) % (b) : (b) - (-(a)) % (b))
+
+ static double
+ miDcos (double a)
diff --git a/debian/patches/series b/debian/patches/series
index f6afe60..75bd49b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -17,3 +17,4 @@
13-unbreak-input-abi.diff
14-tone-down-nidr-errors.diff
15-keep-udev-x11-driver.diff
+16-xaa-fbcomposite-fix-negative-size.diff
--
To UNSUBSCRIBE, email to debian-x-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/e1nyr5r-0005le...@alioth.debian.org
