CVS commit: [pkgsrc-2013Q3] pkgsrc/x11/modular-xorg-server

["S.P.Zeidler" <spz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   spz
Date:           Wed Oct  9 07:36:30 UTC 2013

Modified Files:
        pkgsrc/x11/modular-xorg-server [pkgsrc-2013Q3]: Makefile distinfo
Added Files:
        pkgsrc/x11/modular-xorg-server/patches [pkgsrc-2013Q3]:
            patch-dix_dixfonts.c

Log Message:
Pullup ticket #4240 - requested by wiz
x11/modular-xorg-server: security fix

Revisions pulled up:
- x11/modular-xorg-server/Makefile                              1.81
- x11/modular-xorg-server/distinfo                              1.52
- x11/modular-xorg-server/patches/patch-dix_dixfonts.c          1.1

-------------------------------------------------------------------
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Tue Oct  8 20:33:54 UTC 2013

   Modified Files:
        pkgsrc/x11/modular-xorg-server: Makefile distinfo
   Added Files:
        pkgsrc/x11/modular-xorg-server/patches: patch-dix_dixfonts.c

   Log Message:
   Fix CVE-2013-4396.

   From a4d9bf1259ad28f54b6d59a480b2009cc89ca623 Mon Sep 17 00:00:00 2001
   From: Alan Coopersmith <alan.coopersmith%oracle.com@localhost>
   Date: Mon, 16 Sep 2013 21:47:16 -0700
   Subject: [PATCH] Avoid use-after-free in dix/dixfonts.c: doImageText()

   Save a pointer to the passed in closure structure before copying it
   and overwriting the *c pointer to point to our copy instead of the
   original.  If we hit an error, once we free(c), reset c to point to
   the original structure before jumping to the cleanup code that
   references *c.

   Since one of the errors being checked for is whether the server was
   able to malloc(c->nChars * itemSize), the client can potentially pass
   a number of characters chosen to cause the malloc to fail and the
   error path to be taken, resulting in the read from freed memory.

   Since the memory is accessed almost immediately afterwards, and the
   X server is mostly single threaded, the odds of the free memory having
   invalid contents are low with most malloc implementations when not using
   memory debugging features, but some allocators will definitely overwrite
   the memory there, leading to a likely crash.

   Reported-by: Pedro Ribeiro <pedrib%gmail.com@localhost>
   Signed-off-by: Alan Coopersmith <alan.coopersmith%oracle.com@localhost>
   Reviewed-by: Julien Cristau <jcristau%debian.org@localhost>

   Bump PKGREVISION.

   To generate a diff of this commit:
   cvs rdiff -u -r1.80 -r1.81 pkgsrc/x11/modular-xorg-server/Makefile
   cvs rdiff -u -r1.51 -r1.52 pkgsrc/x11/modular-xorg-server/distinfo
   cvs rdiff -u -r0 -r1.1 \
       pkgsrc/x11/modular-xorg-server/patches/patch-dix_dixfonts.c


To generate a diff of this commit:
cvs rdiff -u -r1.80 -r1.80.4.1 pkgsrc/x11/modular-xorg-server/Makefile
cvs rdiff -u -r1.51 -r1.51.4.1 pkgsrc/x11/modular-xorg-server/distinfo
cvs rdiff -u -r0 -r1.1.2.2 \
    pkgsrc/x11/modular-xorg-server/patches/patch-dix_dixfonts.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.