From 4dd4b96b6d60246338bb30ede9f3ab1b2e757be9 Mon Sep 17 00:00:00 2001 From: Li Zhou Date: Mon, 27 Apr 2015 10:54:22 +0800 Subject: libxfont: Security Advisory - libxfont - CVE-2015-1804 bdfReadCharacters: ensure metrics fit into xCharInfo struct We use 32-bit ints to read from the bdf file, but then try to stick into a 16-bit int in the xCharInfo struct, so make sure they won't overflow that range. Signed-off-by: Li Zhou Signed-off-by: Richard Purdie --- ...acters-ensure-metrics-fit-into-xCharInfo-.patch | 80 ++++++++++++++++++++++ meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb | 1 + 2 files changed, 81 insertions(+) create mode 100644 meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch (limited to 'meta/recipes-graphics/xorg-lib') diff --git a/meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch b/meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch new file mode 100644 index 0000000000..b64f1d9a87 --- /dev/null +++ b/meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch @@ -0,0 +1,80 @@ +From 2351c83a77a478b49cba6beb2ad386835e264744 Mon Sep 17 00:00:00 2001 +From: Alan Coopersmith +Date: Fri, 6 Mar 2015 22:54:58 -0800 +Subject: [PATCH] bdfReadCharacters: ensure metrics fit into xCharInfo struct + [CVE-2015-1804] + +We use 32-bit ints to read from the bdf file, but then try to stick +into a 16-bit int in the xCharInfo struct, so make sure they won't +overflow that range. + +Found by afl-1.24b. + +v2: Verify that additions won't overflow 32-bit int range either. +v3: As Julien correctly observes, the previous check for bh & bw not + being < 0 reduces the number of cases we need to check for overflow. + +Signed-off-by: Alan Coopersmith +Reviewed-by: Julien Cristau + +Upstream-Status: backport + +Signed-off-by: Li Zhou +--- + src/bitmap/bdfread.c | 26 ++++++++++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c +index 1b29b81..a0ace8f 100644 +--- a/src/bitmap/bdfread.c ++++ b/src/bitmap/bdfread.c +@@ -62,8 +62,16 @@ from The Open Group. + + #if HAVE_STDINT_H + #include +-#elif !defined(INT32_MAX) +-#define INT32_MAX 0x7fffffff ++#else ++# ifndef INT32_MAX ++# define INT32_MAX 0x7fffffff ++# endif ++# ifndef INT16_MAX ++# define INT16_MAX 0x7fff ++# endif ++# ifndef INT16_MIN ++# define INT16_MIN (0 - 0x8000) ++# endif + #endif + + #define INDICES 256 +@@ -417,6 +425,12 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState, + bdfError("DWIDTH y value must be zero\n"); + goto BAILOUT; + } ++ /* xCharInfo metrics are stored as INT16 */ ++ if ((wx < 0) || (wx > INT16_MAX)) { ++ bdfError("character '%s' has out of range width, %d\n", ++ charName, wx); ++ goto BAILOUT; ++ } + line = bdfGetLine(file, lineBuf, BDFLINELEN); + if ((!line) || (sscanf((char *) line, "BBX %d %d %d %d", &bw, &bh, &bl, &bb) != 4)) { + bdfError("bad 'BBX'\n"); +@@ -427,6 +441,14 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState, + charName, bw, bh); + goto BAILOUT; + } ++ /* xCharInfo metrics are read as int, but stored as INT16 */ ++ if ((bl > INT16_MAX) || (bl < INT16_MIN) || ++ (bb > INT16_MAX) || (bb < INT16_MIN) || ++ (bw > (INT16_MAX - bl)) || (bh > (INT16_MAX - bb))) { ++ bdfError("character '%s' has out of range metrics, %d %d %d %d\n", ++ charName, bl, (bl+bw), (bh+bb), -bb); ++ goto BAILOUT; ++ } + line = bdfGetLine(file, lineBuf, BDFLINELEN); + if ((line) && (bdfIsPrefix(line, "ATTRIBUTES"))) { + for (p = line + strlen("ATTRIBUTES "); +-- +1.7.9.5 + diff --git a/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb b/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb index 64ec6a3422..dfd2dc67a2 100644 --- a/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb +++ b/meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb @@ -20,6 +20,7 @@ BBCLASSEXTEND = "native" SRC_URI += "file://0001-bdfReadProperties-property-count-needs-range-check-C.patch \ file://0001-bdfReadCharacters-bailout-if-a-char-s-bitmap-cannot-.patch \ + file://0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch \ " SRC_URI[md5sum] = "664629bfa7cdf8b984155019fd395dcb" -- cgit 1.2.3-korg