nx-libs/nx-X11/lib/X11/ModMap.c, branch 3.6.x

Convert nx-X11/lib/ build flow from imake to autotools.

2017-08-25T08:06:49+00:00

Fixes: warning: variable 'req' set but not,used

2016-10-20T08:16:35+00:00

Fixes: warning: variable 'req' set but not used [-Wunused-but-set-variable] by marking req _X_UNUSED Solution was discussed on xorg-devel ML Peter Hutter, Alan Coopersmith Re: [PATCH libX11 3/5] fix: warning: pointer targets in passing argument 2 of '_XSend' differ in signedness [-Wpointer-sign] Signed-off-by: harms wharms@bfs.de

fix: warning: pointer targets in passing argument 2 of '_XSend' differ in signedness [-Wpointer-sign]

2016-10-20T08:16:35+00:00

fix signess warning by casting Signed-off-by: walter harms

The validation of server responses avoids out of boundary accesses.

2016-10-19T19:40:30+00:00

v2: FontNames.c return a NULL list whenever a single length field from the server is incohent. Signed-off-by: Tobias Stoeckmann Reviewed-by: Matthieu Herrb Backported-to-NX-by: Ulrich Sibiller

Remove redundant null checks before free

2016-10-19T19:40:29+00:00

This patch removes some redundant null checks before free. It should not change the code otherwise. Be aware that this is only the first series. Signed-off-by: Harms Reviewed-by: Alan Coopersmith Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller

Remove unnecessary casts of pointers to (char *) in calls to Xfree()

2016-10-19T19:40:28+00:00

Left one cast behind that is necessary to change from const char * to char * in nx-X11/lib/X11/lcCharSet.c. Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller

XSetModifierMapping: Use Data instead of GetReqExtra

2016-10-19T19:40:28+00:00

Handle arbitrary length data in the same fashion as other calls, avoiding need to ensure it fits all in the request buffer. Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller

libX11: check size of GetReqExtra after XFlush

2016-10-19T19:40:28+00:00

Two users of GetReqExtra pass arbitrarily sized allocations from the caller (ModMap and Host). Adjust _XGetRequest() (called by the GetReqExtra macro) to double-check the requested length and invalidate "req" when this happens. Users of GetReqExtra passing lengths greater than the Xlib buffer size (normally 16K) must check "req" and fail gracefully instead of crashing. Any callers of GetReqExtra that do not check "req" for NULL will experience this change, in the pathological case, as a NULL dereference instead of a buffer overflow. This is an improvement, but the documentation for GetReqExtra has been updated to reflect the need to check the value of "req" after the call. Bug that manifested the problem: https://bugs.launchpad.net/ubuntu/+source/x11-xserver-utils/+bug/792628 Signed-off-by: Kees Cook Reviewed-by: Alan Coopersmith Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller

Tighten out-of-range comparisons.

2016-10-19T19:40:27+00:00

[For all of these, LONG_MAX was the correct value to prevent overflows for the recent CVEs. Lowering to INT_MAX catches buggy replies from the server that 32-bit clients would reject but 64-bit would accept, so we catch bugs sooner, and really, no sane & working server should ever report more than 2gb of extension names, font path entries, key modifier maps, etc. -alan- ] Reviewed-by: Alan Coopersmith Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller

Remove more unnecessary casts from Xmalloc/calloc calls

2016-10-19T19:40:27+00:00

Signed-off-by: Alan Coopersmith Backported-to-NX-by: Ulrich Sibiller