Bug 695603 - xrdb passes broken defines to cpp
Summary: xrdb passes broken defines to cpp
Keywords:
Status: CLOSED DUPLICATE of bug 696316
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: xorg-x11-server-utils
Version: 5.6
Hardware: Unspecified
OS: Linux
medium
high
Target Milestone: rc
: ---
Assignee: Adam Jackson
QA Contact: desktop-bugs@redhat.com
URL:
Whiteboard:
Depends On:
Blocks: 697490
TreeView+ depends on / blocked
 
Reported: 2011-04-12 07:03 UTC by Peder Stray
Modified: 2018-11-14 13:05 UTC (History)
23 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 697490 (view as bug list)
Environment:
Last Closed: 2011-04-18 17:33:18 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
Proposed cve-2011-0465 fix (4.13 KB, patch)
2011-04-14 18:04 UTC, Uwe Menges
no flags Details | Diff

Description Peder Stray 2011-04-12 07:03:15 UTC
Description of problem:

xrdb in the xorg-x11-server-utils-7.1-5.el5_6.1.x86_64 package passes broken defines through sh to cpp causing sh to fail parsing the command line, thus failing to preprocess the xresources file passed and not loading anything.

The cause is the xdb-defined constant VENDOR, which is set to '_The X.Org Foundation"'

Version-Release number of selected component (if applicable):
xorg-x11-server-utils-7.1-5.el5_6.1.x86_64

How reproducible:

just run xrdb on any file

  
Actual results:
sh: -c: line 0: unexpected EOF while looking for matching `"'
sh: -c: line 1: syntax error: unexpected end of file

Expected results:
no errors from sh

Comment 1 Patrik Martinsson 2011-04-12 09:34:13 UTC
I can confirm the same behaviour on RHEL 6. 

This needs an immediate fix.

Comment 2 David M. Cooke 2011-04-13 15:14:38 UTC
I can confirm this on RHEL5.  I have many users complaining.

Comment 3 Peder Stray 2011-04-13 19:18:50 UTC
For those of you needing a quick fix, put the following line in /etc/yum.conf:

   exclude=xorg-x11-server-utils-7.1-5.el5_6.1

and run 'yum downgrade xorg-x11-server-utils'.  That should block the broken version on RHEL5 at least, and seems to do the trick here.

Comment 4 gregory 2011-04-14 09:24:55 UTC
I confirm this for xorg-x11-server-utils-7.1-5.el5_6.1.i386
This is appartently related to

* Wed Mar 16 2011 Adam Jackson <ajax> 7.1-5.el5_6.1
- cve-2011-0465.patch: Sanitize cpp macro expansion. (CVE 2011-0465)

The following appears to work fine
$ xrdb -nocpp -load .Xresources

Comment 5 Uwe Menges 2011-04-14 18:02:29 UTC
This issue also occurs on RHEL6 (xorg-x11-server-utils-7.4-15.el6_0.1.x86_64).

We have '-DVENDOR=_The X.Org Foundation\"' in the /usr/bin/mcpp call.

The workaround with -nocpp does not work (there), because all the option parsing code does on -nocpp is "cpp_program = NULL;" (xrdb.c:815), which causes it to be auto-filled (in xrdb.c:881)! This makes the -nocpp parameter completely pointless.

Comment 6 Uwe Menges 2011-04-14 18:04:53 UTC
Created attachment 492187 [details]
Proposed cve-2011-0465 fix

Comment 8 Gary Gatling 2011-04-15 19:05:46 UTC
I am seeing this problem also. My .Xresources file is no longer being
loaded. downgrading to xorg-x11-server-utils 7.1-4 temporarily fixes the problem
for me.

Comment 9 Adam Jackson 2011-04-18 17:33:18 UTC

*** This bug has been marked as a duplicate of bug 696316 ***


Note You need to log in before you can comment on or make changes to this bug.