Pullup ticket #2433 - requested by joerg
Security patch for modular-xorg-server

Revisions pulled up:
- x11/modular-xorg-server/Makefile		1.30 via patch
- x11/modular-xorg-server/distinfo		1.21
- x11/modular-xorg-server/patches/patch-ac	1.3
- x11/modular-xorg-server/patches/patch-ae	1.5
- x11/modular-xorg-server/patches/patch-da	delete
- x11/modular-xorg-server/patches/patch-ed	1.2
- x11/modular-xorg-server/patches/patch-ef	1.2
---
    Module Name:    pkgsrc
    Committed By:   joerg
    Date:           Fri Jun 20 13:34:40 UTC 2008

    Modified Files:
        pkgsrc/x11/modular-xorg-server: Makefile distinfo
        pkgsrc/x11/modular-xorg-server/patches: patch-ed patch-ef
    Added Files:
        pkgsrc/x11/modular-xorg-server/patches: patch-ac patch-ae
    Removed Files:
        pkgsrc/x11/modular-xorg-server/patches: patch-da

    Log Message:
    modular-xorg-server-1.3.0.0nb9:
    Fix CVE-2008-1377, CVE-2008-1379, CVE-2008-2360, CVE-2008-2361 and
    CVE-2008-2362 based on upstream patches.


(tron)

$NetBSD: patch-ac,v 1.2.10.1 2008/06/25 10:20:58 tron Exp $

CVE-2008-2360

--- render/glyph.c.orig	2006-09-18 08:04:18.000000000 +0200
+++ render/glyph.c
@@ -42,6 +42,12 @@
 #include "picturestr.h"
 #include "glyphstr.h"
 
+#if HAVE_STDINT_H
+#include <stdint.h>
+#elif !defined(UINT32_MAX)
+#define UINT32_MAX 0xffffffffU
+#endif
+
 /*
  * From Knuth -- a good choice for hash/rehash values is p, p-2 where
  * p and p-2 are both prime.  These tables are sized to have an extra 10%
@@ -626,8 +632,12 @@ AllocateGlyph (xGlyphInfo *gi, int fdept
     int		     size;
     GlyphPtr	     glyph;
     int		     i;
-
-    size = gi->height * PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    size_t	     padded_width;
+    
+    padded_width = PixmapBytePad (gi->width, glyphDepths[fdepth]);
+    if (gi->height && padded_width > (UINT32_MAX - sizeof(GlyphRec))/gi->height)
+	return 0;
+    size = gi->height * padded_width;
     glyph = (GlyphPtr) xalloc (size + sizeof (GlyphRec));
     if (!glyph)
 	return 0;

$NetBSD: patch-ae,v 1.4.6.1 2008/06/25 10:20:58 tron Exp $

CVE-2008-1377

--- record/record.c.orig	2006-09-18 08:04:18.000000000 +0200
+++ record/record.c
@@ -2656,7 +2656,7 @@ SProcRecordQueryVersion(ClientPtr client
 } /* SProcRecordQueryVersion */
 
 
-static void
+static int
 SwapCreateRegister(xRecordRegisterClientsReq *stuff)
 {
     register char n;
@@ -2667,11 +2667,17 @@ SwapCreateRegister(xRecordRegisterClient
     swapl(&stuff->nClients, n);
     swapl(&stuff->nRanges, n);
     pClientID = (XID *)&stuff[1];
+    if (stuff->nClients > stuff->length - (sz_xRecordRegisterClientsReq >> 2))
+	return BadLength;
     for (i = 0; i < stuff->nClients; i++, pClientID++)
     {
 	swapl(pClientID, n);
     }
+    if (stuff->nRanges > stuff->length - (sz_xRecordRegisterClientsReq >> 2)
+	- stuff->nClients)
+	return BadLength;
     RecordSwapRanges((xRecordRange *)pClientID, stuff->nRanges);
+    return Success;
 } /* SwapCreateRegister */
 
 
@@ -2679,11 +2685,13 @@ static int
 SProcRecordCreateContext(ClientPtr client)
 {
     REQUEST(xRecordCreateContextReq);
+    int			status;
     register char 	n;
 
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq);
-    SwapCreateRegister((pointer)stuff);
+    if ((status = SwapCreateRegister((pointer)stuff)) != Success)
+	return status;
     return ProcRecordCreateContext(client);
 } /* SProcRecordCreateContext */
 
@@ -2692,11 +2700,13 @@ static int
 SProcRecordRegisterClients(ClientPtr client)
 {
     REQUEST(xRecordRegisterClientsReq);
+    int			status;
     register char 	n;
 
     swaps(&stuff->length, n);
     REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq);
-    SwapCreateRegister((pointer)stuff);
+    if ((status = SwapCreateRegister((pointer)stuff)) != Success)
+	return status;
     return ProcRecordRegisterClients(client);
 } /* SProcRecordRegisterClients */