Attachment 946490 Details for Bug 1151312 – tigervnc-CVE-2014-8241.patch (proposed RHEL-7.1 patch)

[patch] tigervnc-CVE-2014-8241.patch (proposed RHEL-7.1 patch)

tigervnc-CVE-2014-8241.patch (text/plain), 4.00 KB, created by Tim Waugh on 2014-10-13 16:59:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tim Waugh

Created: 2014-10-13 16:59:54 UTC

Size: 4.00 KB

patch

obsolete

>diff -up tigervnc-1.2.80-20130314svn5065/CMakeLists.txt.CVE-2014-8241 tigervnc-1.2.80-20130314svn5065/CMakeLists.txt
>--- tigervnc-1.2.80-20130314svn5065/CMakeLists.txt.CVE-2014-8241	2014-10-13 17:49:04.444856814 +0100
>+++ tigervnc-1.2.80-20130314svn5065/CMakeLists.txt	2014-10-13 17:49:05.657862949 +0100
>@@ -63,6 +63,14 @@ endif()
> message(STATUS "VERSION = ${VERSION}, BUILD = ${BUILD}")
> add_definitions(-D__BUILD__="${BUILD}")
> 
>+# We want to keep our asserts even in release builds so remove NDEBUG
>+set(CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE} -UNDEBUG")
>+set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -UNDEBUG")
>+set(CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO} -UNDEBUG")
>+set(CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO} -UNDEBUG")
>+set(CMAKE_C_FLAGS_MINSIZEREL "${CMAKE_C_FLAGS_MINSIZEREL} -UNDEBUG")
>+set(CMAKE_CXX_FLAGS_MINSIZEREL "${CMAKE_CXX_FLAGS_MINSIZEREL} -UNDEBUG")
>+
> if(NOT DEFINED BUILD_WINVNC)
>   set(BUILD_WINVNC 1)
> endif()
>diff -up tigervnc-1.2.80-20130314svn5065/common/Xregion/Region.c.CVE-2014-8241 tigervnc-1.2.80-20130314svn5065/common/Xregion/Region.c
>--- tigervnc-1.2.80-20130314svn5065/common/Xregion/Region.c.CVE-2014-8241	2008-12-03 14:24:01.000000000 +0000
>+++ tigervnc-1.2.80-20130314svn5065/common/Xregion/Region.c	2014-10-13 17:47:57.766519601 +0100
>@@ -1083,6 +1083,8 @@ miRegionOp(newReg, reg1, reg2, overlapFu
> 	    newReg->size = 1;
> 	    Xfree((char *) newReg->rects);
> 	    newReg->rects = (BoxPtr) Xmalloc(sizeof(BoxRec));
>+	    if (! newReg->rects)
>+	      newReg->size = 0;
> 	}
>     }
>     Xfree ((char *) oldRects);
>diff -up tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncconfig.cxx.CVE-2014-8241 tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncconfig.cxx
>--- tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncconfig.cxx.CVE-2014-8241	2012-04-26 10:04:14.000000000 +0100
>+++ tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncconfig.cxx	2014-10-13 17:47:57.766519601 +0100
>@@ -215,6 +215,10 @@ public:
>       if (cutText)
>         XFree(cutText);
>       cutText = (char*)malloc(nitems); // assuming XFree() same as free()
>+      if (!cutText) {
>+        vlog.error("unable to allocate selection buffer");
>+        return;
>+      }
>       memcpy(cutText, data, nitems);
>       cutTextLen = nitems;
>       vlog.debug("sending %s selection as server cut text: '%.*s%s'",
>diff -up tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncExt.c.CVE-2014-8241 tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncExt.c
>--- tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncExt.c.CVE-2014-8241	2006-05-18 12:08:21.000000000 +0100
>+++ tigervnc-1.2.80-20130314svn5065/unix/vncconfig/vncExt.c	2014-10-13 17:47:57.767519606 +0100
>@@ -109,6 +109,10 @@ Bool XVncExtGetParam(Display* dpy, const
>   if (rep.success) {
>     *len = rep.valueLen;
>     *value = (char*) Xmalloc (*len+1);
>+    if (!*value) {
>+      _XEatData(dpy, (*len+1)&~1);
>+      return False;
>+    }
>     _XReadPad(dpy, *value, *len);
>     (*value)[*len] = 0;
>   }
>@@ -141,6 +145,10 @@ char* XVncExtGetParamDesc(Display* dpy,
>   }
>   if (rep.success) {
>     desc = (char*)Xmalloc(rep.descLen+1);
>+    if (!*desc) {
>+      _XEatData(dpy, (rep.descLen+1)&~1);
>+      return False;
>+    }
>     _XReadPad(dpy, desc, rep.descLen);
>     desc[rep.descLen] = 0;
>   }
>@@ -243,6 +251,10 @@ Bool XVncExtGetClientCutText(Display* dp
>   SyncHandle();
>   *len = rep.textLen;
>   *str = (char*) Xmalloc (*len+1);
>+  if (!*str) {
>+    _XEatData(dpy, (*len+1)&~1);
>+    return False;
>+  }
>   _XReadPad(dpy, *str, *len);
>   (*str)[*len] = 0;
>   return True;
>@@ -312,9 +324,15 @@ Bool XVncExtGetQueryConnect(Display* dpy
>   SyncHandle();
> 
>   *addr = Xmalloc(rep.addrLen+1);
>+  *user = Xmalloc(rep.userLen+1);
>+  if (!*addr || !*user) {
>+    Xfree(*addr);
>+    Xfree(*user);
>+    _XEatData(dpy, (rep.addrLen+1)&~1 + (rep.userLen+1)&~1);
>+    return False;
>+  }
>   _XReadPad(dpy, *addr, rep.addrLen);
>   (*addr)[rep.addrLen] = 0;
>-  *user = Xmalloc(rep.userLen+1);
>   _XReadPad(dpy, *user, rep.userLen);
>   (*user)[rep.userLen] = 0;
>   *timeout = rep.timeout;

Actions: View | Diff

Attachments on bug 1151312: 946490