Description of problem:
Invalid write access when copying label fonts in the XKB geometry code xbk/xkbUtils:_XkbCopyGeom().

Classic bug of
foo = malloc(strlen(bar));
strcpy(foo, bar);

strcopy copies the null-byte, strlen doesn't count it, resulting in an invalid write past the allocated memory.

Version-Release number of selected component (if applicable):
xorg-x11-server-Xorg-1.7.7-2.el6.x86_64


How reproducible:
Tricky. Easy reproducible test case is "valgrind Xephyr :1" which yields a complaint of:

==8591== Invalid write of size 1
==8591==    at 0x4A0638F: strcpy (mc_replace_strmem.c:311)
==8591==    by 0x605593: _XkbCopyGeom (xkbUtils.c:1994)
==8591==    by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591==    by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591==    by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591==    by 0x447162: ActivateDevice (devices.c:530)
==8591==    by 0x4475D6: InitCoreDevices (devices.c:672)
==8591==    by 0x4449EE: main (main.c:254)
==8591==  Address 0x6f96505 is 0 bytes after a block of size 53 alloc'd
==8591==    at 0x4A0515D: malloc (vg_replace_malloc.c:195)
==8591==    by 0x6054B7: _XkbCopyGeom (xkbUtils.c:1980)
==8591==    by 0x605973: XkbCopyKeymap (xkbUtils.c:2118)
==8591==    by 0x6122B3: InitKeyboardDeviceStruct (xkbInit.c:560)
==8591==    by 0x4472E2: CoreKeyboardProc (devices.c:577)
==8591==    by 0x447162: ActivateDevice (devices.c:530)
==8591==    by 0x4475D6: InitCoreDevices (devices.c:672)
==8591==    by 0x4449EE: main (main.c:254)

This is with upstream, that has the identical source except for the removal of the libc wrappers. I the code in RHEL6 suffers from the same issue but valgrind doesn't give out for some reason. See

http://lists.freedesktop.org/archives/xorg-devel/2010-June/009604.html