Fri Aug 19 08:18:32 2011 UTC ()
Pullup ticket #3501 - requested by joerg
x11/libXfont buffer overflow fix
Revisions pulled up:
- x11/libXfont/Makefile 1.18
- x11/libXfont/distinfo 1.16
- x11/libXfont/patches/patch-src-fontfile-decompress.c 1.1
---
Module Name: pkgsrc
Committed By: joerg
Date: Thu Aug 18 22:58:24 UTC 2011
Modified Files:
pkgsrc/x11/libXfont: Makefile distinfo
Added Files:
pkgsrc/x11/libXfont/patches: patch-src-fontfile-decompress.c
Log Message:
Fix buffer overflow in LZW handler.
(sbd)
diff -r1.17 -r1.17.8.1 pkgsrc/x11/libXfont/Makefile
diff -r1.15 -r1.15.8.1 pkgsrc/x11/libXfont/distinfo
diff -r0 -r1.1.2.2 pkgsrc/x11/libXfont/patches/patch-src-fontfile-decompress.c
--- pkgsrc/x11/libXfont/Makefile 2010/09/10 18:49:43 1.17
+++ pkgsrc/x11/libXfont/Makefile 2011/08/19 08:18:32 1.17.8.1
| @@ -1,17 +1,18 @@ | | | @@ -1,17 +1,18 @@ |
| 1 | # $NetBSD: Makefile,v 1.17 2010/09/10 18:49:43 joerg Exp $ | | 1 | # $NetBSD: Makefile,v 1.17.8.1 2011/08/19 08:18:32 sbd Exp $ |
| 2 | # | | 2 | # |
| 3 | | | 3 | |
| 4 | DISTNAME= libXfont-1.4.2 | | 4 | DISTNAME= libXfont-1.4.2 |
| | | 5 | PKGREVISION= 1 |
| 5 | CATEGORIES= x11 devel fonts | | 6 | CATEGORIES= x11 devel fonts |
| 6 | MASTER_SITES= ${MASTER_SITE_XORG:=lib/} | | 7 | MASTER_SITES= ${MASTER_SITE_XORG:=lib/} |
| 7 | EXTRACT_SUFX= .tar.bz2 | | 8 | EXTRACT_SUFX= .tar.bz2 |
| 8 | | | 9 | |
| 9 | MAINTAINER= joerg@NetBSD.org | | 10 | MAINTAINER= joerg@NetBSD.org |
| 10 | HOMEPAGE= http://xorg.freedesktop.org/ | | 11 | HOMEPAGE= http://xorg.freedesktop.org/ |
| 11 | COMMENT= X font Library | | 12 | COMMENT= X font Library |
| 12 | LICENSE= mit AND modified-bsd | | 13 | LICENSE= mit AND modified-bsd |
| 13 | | | 14 | |
| 14 | PKG_DESTDIR_SUPPORT= user-destdir | | 15 | PKG_DESTDIR_SUPPORT= user-destdir |
| 15 | | | 16 | |
| 16 | USE_LIBTOOL= yes | | 17 | USE_LIBTOOL= yes |
| 17 | GNU_CONFIGURE= yes | | 18 | GNU_CONFIGURE= yes |
--- pkgsrc/x11/libXfont/distinfo 2010/09/10 18:49:43 1.15
+++ pkgsrc/x11/libXfont/distinfo 2011/08/19 08:18:32 1.15.8.1
| @@ -1,5 +1,6 @@ | | | @@ -1,5 +1,6 @@ |
| 1 | $NetBSD: distinfo,v 1.15 2010/09/10 18:49:43 joerg Exp $ | | 1 | $NetBSD: distinfo,v 1.15.8.1 2011/08/19 08:18:32 sbd Exp $ |
| 2 | | | 2 | |
| 3 | SHA1 (libXfont-1.4.2.tar.bz2) = 79c2089fec014da4b7976e6762f1e9e447fd5767 | | 3 | SHA1 (libXfont-1.4.2.tar.bz2) = 79c2089fec014da4b7976e6762f1e9e447fd5767 |
| 4 | RMD160 (libXfont-1.4.2.tar.bz2) = 5812959009f15b321ebe6cfb9bea9c7abbbef940 | | 4 | RMD160 (libXfont-1.4.2.tar.bz2) = 5812959009f15b321ebe6cfb9bea9c7abbbef940 |
| 5 | Size (libXfont-1.4.2.tar.bz2) = 433887 bytes | | 5 | Size (libXfont-1.4.2.tar.bz2) = 433887 bytes |
| | | 6 | SHA1 (patch-src-fontfile-decompress.c) = 9a51f6be0a40e3d785d6cf7d14f09c165be09f0b |
$NetBSD: patch-src-fontfile-decompress.c,v 1.1.2.2 2011/08/19 08:18:32 sbd Exp $
Fix buffer overflow in LZW handler.
--- src/fontfile/decompress.c.orig 2010-06-23 11:18:18.000000000 +0000
+++ src/fontfile/decompress.c
@@ -99,7 +99,7 @@ static char_type magic_header[] = { "\03
#define FIRST 257 /* first free entry */
#define CLEAR 256 /* table clear output code */
-#define STACK_SIZE 8192
+#define STACK_SIZE 65300
typedef struct _compressedFILE {
BufFilePtr file;
@@ -180,14 +180,12 @@ BufFilePushCompressed (BufFilePtr f)
file->tab_suffix[code] = (char_type) code;
}
file->free_ent = ((file->block_compress) ? FIRST : 256 );
+ file->oldcode = -1;
file->clear_flg = 0;
file->offset = 0;
file->size = 0;
file->stackp = file->de_stack;
bzero(file->buf, BITS);
- file->finchar = file->oldcode = getcode (file);
- if (file->oldcode != -1)
- *file->stackp++ = file->finchar;
return BufFileCreate ((char *) file,
BufCompressedFill,
0,
@@ -232,9 +230,6 @@ BufCompressedFill (BufFilePtr f)
if (buf == bufend)
break;
- if (oldcode == -1)
- break;
-
code = getcode (file);
if (code == -1)
break;
@@ -243,19 +238,29 @@ BufCompressedFill (BufFilePtr f)
for ( code = 255; code >= 0; code-- )
file->tab_prefix[code] = 0;
file->clear_flg = 1;
- file->free_ent = FIRST - 1;
- if ( (code = getcode (file)) == -1 ) /* O, untimely death! */
- break;
+ file->free_ent = FIRST;
+ oldcode = -1;
+ continue;
}
incode = code;
/*
* Special case for KwKwK string.
*/
if ( code >= file->free_ent ) {
+ if ( code > file->free_ent || oldcode == -1 ) {
+ /* Bad stream. */
+ return BUFFILEEOF;
+ }
*stackp++ = finchar;
code = oldcode;
}
-
+ /*
+ * The above condition ensures that code < free_ent.
+ * The construction of tab_prefixof in turn guarantees that
+ * each iteration decreases code and therefore stack usage is
+ * bound by 1 << BITS - 256.
+ */
+
/*
* Generate output characters in reverse order
*/
@@ -270,7 +275,7 @@ BufCompressedFill (BufFilePtr f)
/*
* Generate the new entry.
*/
- if ( (code=file->free_ent) < file->maxmaxcode ) {
+ if ( (code=file->free_ent) < file->maxmaxcode && oldcode != -1) {
file->tab_prefix[code] = (unsigned short)oldcode;
file->tab_suffix[code] = finchar;
file->free_ent = code+1;