libxcursor: CVE-2017-16612

affects: <= 1.1.14

CVE-2017-16612: Fix heap overflows when parsing malicious files

It is possible to trigger heap overflows due to an integer overflow
while parsing images and a signedness issue while parsing comments.

The integer overflow occurs because the chosen limit 0x10000 for
dimensions is too large for 32 bit systems, because each pixel takes 4 bytes.
Properly chosen values allow an overflow which in turn will lead to less
allocated memory than needed for subsequent reads.

The signedness bug is triggered by reading the length of a comment
as unsigned int, but casting it to int when calling the function
XcursorCommentCreate. Turning length into a negative value allows the
check against XCURSOR_COMMENT_MAX_LEN to pass, and the following
addition of sizeof (XcursorComment) + 1 makes it possible to allocate
less memory than needed for subsequent reads.

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Armin Kuster <akuster@mvista.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/meta/recipes-graphics/xorg-lib/libxcursor_1.1.14.bb b/meta/recipes-graphics/xorg-lib/libxcursor_1.1.14.bb
index 17629047b7..ccc4347820 100644
--- a/meta/recipes-graphics/xorg-lib/libxcursor_1.1.14.bb
+++ b/meta/recipes-graphics/xorg-lib/libxcursor_1.1.14.bb
@@ -16,6 +16,8 @@ BBCLASSEXTEND = "native nativesdk"
 
 PE = "1"
 
+SRC_URI += "file://CVE-2017-16612.patch"
+
 XORG_PN = "libXcursor"
 
 SRC_URI[md5sum] = "1e7c17afbbce83e2215917047c57d1b3"