mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-04-04 23:02:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

libxfont: Security Advisory - libxfont - CVE-2015-1804

Browse Source 
bdfReadCharacters: ensure metrics fit into xCharInfo struct

We use 32-bit ints to read from the bdf file, but then try to stick
into a 16-bit int in the xCharInfo struct, so make sure they won't
overflow that range.

(From OE-Core rev: 4dd4b96b6d60246338bb30ede9f3ab1b2e757be9)

Signed-off-by: Li Zhou <li.zhou@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Li Zhou
2015-04-27 10:54:22 +08:00
committed by Richard Purdie
parent 8f8858bfb0
commit ae736dbdd1
2 changed files with 81 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

80
meta/recipes-graphics/xorg-lib/libxfont/0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch Normal file
View File

@@ -0,0 +1,80 @@
From 2351c83a77a478b49cba6beb2ad386835e264744 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri, 6 Mar 2015 22:54:58 -0800
Subject: [PATCH] bdfReadCharacters: ensure metrics fit into xCharInfo struct
[CVE-2015-1804]
We use 32-bit ints to read from the bdf file, but then try to stick
into a 16-bit int in the xCharInfo struct, so make sure they won't
overflow that range.
Found by afl-1.24b.
v2: Verify that additions won't overflow 32-bit int range either.
v3: As Julien correctly observes, the previous check for bh & bw not
being < 0 reduces the number of cases we need to check for overflow.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Upstream-Status: backport
Signed-off-by: Li Zhou <li.zhou@windriver.com>
---
src/bitmap/bdfread.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)
diff --git a/src/bitmap/bdfread.c b/src/bitmap/bdfread.c
index 1b29b81..a0ace8f 100644
--- a/src/bitmap/bdfread.c
+++ b/src/bitmap/bdfread.c
@@ -62,8 +62,16 @@ from The Open Group.
#if HAVE_STDINT_H
#include <stdint.h>
-#elif !defined(INT32_MAX)
-#define INT32_MAX 0x7fffffff
+#else
+# ifndef INT32_MAX
+# define INT32_MAX 0x7fffffff
+# endif
+# ifndef INT16_MAX
+# define INT16_MAX 0x7fff
+# endif
+# ifndef INT16_MIN
+# define INT16_MIN (0 - 0x8000)
+# endif
#endif
#define INDICES 256
@@ -417,6 +425,12 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
bdfError("DWIDTH y value must be zero\n");
goto BAILOUT;
}
+ /* xCharInfo metrics are stored as INT16 */
+ if ((wx < 0) || (wx > INT16_MAX)) {
+ bdfError("character '%s' has out of range width, %d\n",
+ charName, wx);
+ goto BAILOUT;
+ }
line = bdfGetLine(file, lineBuf, BDFLINELEN);
if ((!line) || (sscanf((char *) line, "BBX %d %d %d %d", &bw, &bh, &bl, &bb) != 4)) {
bdfError("bad 'BBX'\n");
@@ -427,6 +441,14 @@ bdfReadCharacters(FontFilePtr file, FontPtr pFont, bdfFileState *pState,
charName, bw, bh);
goto BAILOUT;
}
+ /* xCharInfo metrics are read as int, but stored as INT16 */
+ if ((bl > INT16_MAX) || (bl < INT16_MIN) ||
+ (bb > INT16_MAX) || (bb < INT16_MIN) ||
+ (bw > (INT16_MAX - bl)) || (bh > (INT16_MAX - bb))) {
+ bdfError("character '%s' has out of range metrics, %d %d %d %d\n",
+ charName, bl, (bl+bw), (bh+bb), -bb);
+ goto BAILOUT;
+ }
line = bdfGetLine(file, lineBuf, BDFLINELEN);
if ((line) && (bdfIsPrefix(line, "ATTRIBUTES"))) {
for (p = line + strlen("ATTRIBUTES ");
--
1.7.9.5

1
meta/recipes-graphics/xorg-lib/libxfont_1.5.0.bb
View File

@@ -20,6 +20,7 @@ BBCLASSEXTEND = "native"
SRC_URI += "file://0001-bdfReadProperties-property-count-needs-range-check-C.patch \
file://0001-bdfReadCharacters-bailout-if-a-char-s-bitmap-cannot-.patch \
file://0001-bdfReadCharacters-ensure-metrics-fit-into-xCharInfo-.patch \
"
SRC_URI[md5sum] = "664629bfa7cdf8b984155019fd395dcb"