← Back to branch summary

~ubuntu-branches/ubuntu/utopic/libxfont/utopic-proposed

« back to all changes in this revision

Viewing changes to debian/patches/0010-CVE-2014-XXXB-unvalidated-length-fields-in-fs_read_g.patch

  • Committer: Package Import Robot
  • Author(s): Julien Cristau
  • Date: 2014-05-13 17:25:49 UTC
  • Revision ID: package-import@ubuntu.com-20140513172549-0tospr47im3q9bej
Tags: 1:1.4.7-2
http://bugs.debian.org/746052
* Pull from upstream git to fix FTBFS with new fontsproto (closes: #746052)
* CVE-2014-0209: integer overflow of allocations in font metadata
* CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies
* CVE-2014-0211: integer overflows calculating memory needs for xfs replies
* Add breaks on xfs because we broke it by disabling font protocol support
  in 1.4.7.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/0010-CVE-2014-XXXB-unvalidated-length-fields-in-fs_read_g.patch
 
1
From b6002903efd840672d070d317911c675c2d23c1c Mon Sep 17 00:00:00 2001
 
2
From: Alan Coopersmith <alan.coopersmith@oracle.com>
 
3
Date: Fri, 25 Apr 2014 23:03:24 -0700
 
4
Subject: [PATCH:libXfont 10/12] CVE-2014-XXXB: unvalidated length fields in
 
5
 fs_read_glyphs()
 
6
 
 
7
fs_read_glyphs() parses a reply from the font server.  The reply
 
8
contains embedded length fields, none of which are validated.
 
9
This can cause out of bound reads when looping over the glyph
 
10
bitmaps in the reply.
 
11
 
 
12
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
 
13
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
 
14
Reviewed-by: Adam Jackson <ajax@redhat.com>
 
15
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
 
16
---
 
17
 src/fc/fserve.c |   29 ++++++++++++++++++++++++++++-
 
18
 1 file changed, 28 insertions(+), 1 deletion(-)
 
19
 
 
20
Index: libxfont/src/fc/fserve.c
 
21
===================================================================
 
22
--- libxfont.orig/src/fc/fserve.c
 
23
+++ libxfont/src/fc/fserve.c
 
24
@@ -1909,6 +1909,7 @@ fs_read_glyphs(FontPathElementPtr fpe, F
 
25
     FontInfoPtr                    pfi = &pfont->info;
 
26
     fsQueryXBitmaps16Reply  *rep;
 
27
     char                   *buf;
 
28
+    long                   bufleft; /* length of reply left to use */
 
29
     fsOffset32             *ppbits;
 
30
     fsOffset32             local_off;
 
31
     char                   *off_adr;
 
32
@@ -1940,9 +1941,33 @@ fs_read_glyphs(FontPathElementPtr fpe, F
 
33
     buf = (char *) rep;
 
34
     buf += SIZEOF (fsQueryXBitmaps16Reply);
 
35
 
 
36
+    bufleft = rep->length << 2;
 
37
+    bufleft -= SIZEOF (fsQueryXBitmaps16Reply);
 
38
+
 
39
+    if ((bufleft / SIZEOF (fsOffset32)) < rep->num_chars)
 
40
+    {
 
41
+#ifdef DEBUG
 
42
+       fprintf(stderr,
 
43
+               "fsQueryXBitmaps16: num_chars (%d) > bufleft (%ld) / %d\n",
 
44
+               rep->num_chars, bufleft, SIZEOF (fsOffset32));
 
45
+#endif
 
46
+       err = AllocError;
 
47
+       goto bail;
 
48
+    }
 
49
     ppbits = (fsOffset32 *) buf;
 
50
     buf += SIZEOF (fsOffset32) * (rep->num_chars);
 
51
+    bufleft -= SIZEOF (fsOffset32) * (rep->num_chars);
 
52
 
 
53
+    if (bufleft < rep->nbytes)
 
54
+    {
 
55
+#ifdef DEBUG
 
56
+       fprintf(stderr,
 
57
+               "fsQueryXBitmaps16: nbytes (%d) > bufleft (%ld)\n",
 
58
+               rep->nbytes, bufleft);
 
59
+#endif
 
60
+       err = AllocError;
 
61
+       goto bail;
 
62
+    }
 
63
     pbitmaps = (pointer ) buf;
 
64
 
 
65
     if (blockrec->type == FS_LOAD_GLYPHS)
 
66
@@ -2000,7 +2025,9 @@ fs_read_glyphs(FontPathElementPtr fpe, F
 
67
             */
 
68
            if (NONZEROMETRICS(&fsdata->encoding[minchar].metrics))
 
69
            {
 
70
-               if (local_off.length)
 
71
+               if (local_off.length &&
 
72
+                   (local_off.position < rep->nbytes) &&
 
73
+                   (local_off.length <= (rep->nbytes - local_off.position)))
 
74
                {
 
75
                    bits = allbits;
 
76
                    allbits += local_off.length;