* [oe-core][dunfell][PATCH v2] libx11: Fix CVE-2021-31535
@ 2021-06-22 12:08 Jasper Orschulko
2021-06-22 14:30 ` Steve Sakoman
0 siblings, 1 reply; 3+ messages in thread
From: Jasper Orschulko @ 2021-06-22 12:08 UTC (permalink / raw)
To: openembedded-core; +Cc: Jasper Orschulko
https://lists.x.org/archives/xorg-announce/2021-May/003088.html
XLookupColor() and other X libraries function lack proper validation
of the length of their string parameters. If those parameters can be
controlled by an external application (for instance a color name that
can be emitted via a terminal control sequence) it can lead to the
emission of extra X protocol requests to the X server.
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605]
CVE: CVE-2021-31535
Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu>
---
.../xorg-lib/libx11/CVE-2021-31535.patch | 322 ++++++++++++++++++
.../recipes-graphics/xorg-lib/libx11_1.6.9.bb | 1 +
2 files changed, 323 insertions(+)
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
new file mode 100644
index 0000000000..1112320acf
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
@@ -0,0 +1,322 @@
+From 5c539ee6aba5872fcc73aa3d46a4e9a33dc030db Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Fri, 19 Feb 2021 15:30:39 +0100
+Subject: [PATCH] Reject string longer than USHRT_MAX before sending them on
+ the wire
+
+The X protocol uses CARD16 values to represent the length so
+this would overflow.
+
+CVE-2021-31535
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+Signed-off-by: Jasper Orschulko <Jasper.Orschulko@iris-sensing.com>
+---
+ src/Font.c | 6 ++++--
+ src/FontInfo.c | 3 +++
+ src/FontNames.c | 3 +++
+ src/GetColor.c | 4 ++++
+ src/LoadFont.c | 4 ++++
+ src/LookupCol.c | 6 ++++--
+ src/ParseCol.c | 5 ++++-
+ src/QuExt.c | 5 +++++
+ src/SetFPath.c | 8 +++++++-
+ src/SetHints.c | 7 +++++++
+ src/StNColor.c | 3 +++
+ src/StName.c | 7 ++++++-
+ 12 files changed, 54 insertions(+), 7 deletions(-)
+
+diff --git a/src/Font.c b/src/Font.c
+index 09d2ae91..3f468e4b 100644
+--- a/src/Font.c
++++ b/src/Font.c
+@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
+ XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
+ #endif
+
++ if (strlen(name) >= USHRT_MAX)
++ return NULL;
+ if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
+ return font_result;
+ LockDisplay(dpy);
+@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
+
+ if (!name)
+ return 0;
+- l = strlen(name);
+- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
++ l = (int) strlen(name);
++ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
+ return 0;
+ charset = NULL;
+ /* next three lines stolen from _XkbGetCharset() */
+diff --git a/src/FontInfo.c b/src/FontInfo.c
+index f870e431..51b48e29 100644
+--- a/src/FontInfo.c
++++ b/src/FontInfo.c
+@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
+ register xListFontsReq *req;
+ int j;
+
++ if (strlen(pattern) >= USHRT_MAX)
++ return NULL;
++
+ LockDisplay(dpy);
+ GetReq(ListFontsWithInfo, req);
+ req->maxNames = maxNames;
+diff --git a/src/FontNames.c b/src/FontNames.c
+index b78792d6..4dac4916 100644
+--- a/src/FontNames.c
++++ b/src/FontNames.c
+@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
+ register xListFontsReq *req;
+ unsigned long rlen = 0;
+
++ if (strlen(pattern) >= USHRT_MAX)
++ return NULL;
++
+ LockDisplay(dpy);
+ GetReq(ListFonts, req);
+ req->maxNames = maxNames;
+diff --git a/src/GetColor.c b/src/GetColor.c
+index cd0eb9f6..512ac308 100644
+--- a/src/GetColor.c
++++ b/src/GetColor.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
+ XcmsColor cmsColor_exact;
+ Status ret;
+
++ if (strlen(colorname) >= USHRT_MAX)
++ return (0);
++
+ #ifdef XCMS
+ /*
+ * Let's Attempt to use Xcms and i18n approach to Parse Color
+diff --git a/src/LoadFont.c b/src/LoadFont.c
+index f547976b..85735249 100644
+--- a/src/LoadFont.c
++++ b/src/LoadFont.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include "Xlibint.h"
+
+ Font
+@@ -38,6 +39,9 @@ XLoadFont (
+ Font fid;
+ register xOpenFontReq *req;
+
++ if (strlen(name) >= USHRT_MAX)
++ return (0);
++
+ if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
+ return fid;
+
+diff --git a/src/LookupCol.c b/src/LookupCol.c
+index f7f969f5..cd9b1368 100644
+--- a/src/LookupCol.c
++++ b/src/LookupCol.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,9 @@ XLookupColor (
+ XcmsCCC ccc;
+ XcmsColor cmsColor_exact;
+
++ n = (int) strlen (spec);
++ if (n >= USHRT_MAX)
++ return 0;
+ #ifdef XCMS
+ /*
+ * Let's Attempt to use Xcms and i18n approach to Parse Color
+@@ -77,8 +81,6 @@ XLookupColor (
+ * Xcms and i18n methods failed, so lets pass it to the server
+ * for parsing.
+ */
+-
+- n = strlen (spec);
+ LockDisplay(dpy);
+ GetReq (LookupColor, req);
+ req->cmap = cmap;
+diff --git a/src/ParseCol.c b/src/ParseCol.c
+index e997b1b8..180132dd 100644
+--- a/src/ParseCol.c
++++ b/src/ParseCol.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,7 +47,9 @@ XParseColor (
+ XcmsColor cmsColor;
+
+ if (!spec) return(0);
+- n = strlen (spec);
++ n = (int) strlen (spec);
++ if (n >= USHRT_MAX)
++ return(0);
+ if (*spec == '#') {
+ /*
+ * RGB
+diff --git a/src/QuExt.c b/src/QuExt.c
+index 4e230e77..d38a1572 100644
+--- a/src/QuExt.c
++++ b/src/QuExt.c
+@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
++#include <stdbool.h>
+ #include "Xlibint.h"
+
+ Bool
+@@ -40,6 +42,9 @@ XQueryExtension(
+ xQueryExtensionReply rep;
+ register xQueryExtensionReq *req;
+
++ if (strlen(name) >= USHRT_MAX)
++ return false;
++
+ LockDisplay(dpy);
+ GetReq(QueryExtension, req);
+ req->nbytes = name ? strlen(name) : 0;
+diff --git a/src/SetFPath.c b/src/SetFPath.c
+index 60aaef01..3d8c50cb 100644
+--- a/src/SetFPath.c
++++ b/src/SetFPath.c
+@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
+
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
++#include <limits.h>
+ #endif
+ #include "Xlibint.h"
+
+@@ -48,7 +49,12 @@ XSetFontPath (
+ GetReq (SetFontPath, req);
+ req->nFonts = ndirs;
+ for (i = 0; i < ndirs; i++) {
+- n += safestrlen (directories[i]) + 1;
++ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
++ if (n >= USHRT_MAX) {
++ UnlockDisplay(dpy);
++ SyncHandle();
++ return 0;
++ }
+ }
+ nbytes = (n + 3) & ~3;
+ req->length += nbytes >> 2;
+diff --git a/src/SetHints.c b/src/SetHints.c
+index bc46498a..f3d727ec 100644
+--- a/src/SetHints.c
++++ b/src/SetHints.c
+@@ -49,6 +49,7 @@ SOFTWARE.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xutil.h>
+ #include "Xatomtype.h"
+@@ -214,6 +215,8 @@ XSetCommand (
+ register char *buf, *bp;
+ for (i = 0, nbytes = 0; i < argc; i++) {
+ nbytes += safestrlen(argv[i]) + 1;
++ if (nbytes >= USHRT_MAX)
++ return 1;
+ }
+ if ((bp = buf = Xmalloc(nbytes))) {
+ /* copy arguments into single buffer */
+@@ -256,6 +259,8 @@ XSetStandardProperties (
+
+ if (name != NULL) XStoreName (dpy, w, name);
+
++ if (safestrlen(icon_string) >= USHRT_MAX)
++ return 1;
+ if (icon_string != NULL) {
+ XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+ PropModeReplace,
+@@ -298,6 +303,8 @@ XSetClassHint(
+
+ len_nm = safestrlen(classhint->res_name);
+ len_cl = safestrlen(classhint->res_class);
++ if (len_nm + len_cl >= USHRT_MAX)
++ return 1;
+ if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
+ if (len_nm) {
+ strcpy(s, classhint->res_name);
+diff --git a/src/StNColor.c b/src/StNColor.c
+index 8b821c3e..ba021958 100644
+--- a/src/StNColor.c
++++ b/src/StNColor.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
+ XcmsColor cmsColor_exact;
+ XColor scr_def;
+
++ if (strlen(name) >= USHRT_MAX)
++ return 0;
+ #ifdef XCMS
+ /*
+ * Let's Attempt to use Xcms approach to Parse Color
+diff --git a/src/StName.c b/src/StName.c
+index b4048bff..5a632d0c 100644
+--- a/src/StName.c
++++ b/src/StName.c
+@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
++#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xatom.h>
+
+@@ -36,7 +37,9 @@ XStoreName (
+ Window w,
+ _Xconst char *name)
+ {
+- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
++ if (strlen(name) >= USHRT_MAX)
++ return 0;
++ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
+ 8, PropModeReplace, (_Xconst unsigned char *)name,
+ name ? strlen(name) : 0);
+ }
+@@ -47,6 +50,8 @@ XSetIconName (
+ Window w,
+ _Xconst char *icon_name)
+ {
++ if (strlen(icon_name) >= USHRT_MAX)
++ return 0;
+ return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+ PropModeReplace, (_Xconst unsigned char *)icon_name,
+ icon_name ? strlen(icon_name) : 0);
+--
+2.32.0
+
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
index ebd2640743..ff2a6f7265 100644
--- a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
+++ b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
@@ -15,6 +15,7 @@ SRC_URI += "file://Fix-hanging-issue-in-_XReply.patch \
file://libx11-whitespace.patch \
file://CVE-2020-14344.patch \
file://CVE-2020-14363.patch \
+ file://CVE-2021-31535.patch \
"
SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2"
--
2.32.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [oe-core][dunfell][PATCH v2] libx11: Fix CVE-2021-31535
2021-06-22 12:08 [oe-core][dunfell][PATCH v2] libx11: Fix CVE-2021-31535 Jasper Orschulko
@ 2021-06-22 14:30 ` Steve Sakoman
2021-06-22 14:45 ` Jasper Orschulko
0 siblings, 1 reply; 3+ messages in thread
From: Steve Sakoman @ 2021-06-22 14:30 UTC (permalink / raw)
To: jasper; +Cc: Patches and discussions about the oe-core layer
On Tue, Jun 22, 2021 at 2:09 AM Jasper Orschulko via
lists.openembedded.org <jasper=fancydomain.eu@lists.openembedded.org>
wrote:
>
> https://lists.x.org/archives/xorg-announce/2021-May/003088.html
>
> XLookupColor() and other X libraries function lack proper validation
> of the length of their string parameters. If those parameters can be
> controlled by an external application (for instance a color name that
> can be emitted via a terminal control sequence) it can lead to the
> emission of extra X protocol requests to the X server.
>
> Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605]
> CVE: CVE-2021-31535
> Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu>
These three lines should be in the patch file itself. See the "Patch
name convention and commit message" section at
https://wiki.yoctoproject.org/wiki/Security for details.
Thanks!
Steve
> ---
> .../xorg-lib/libx11/CVE-2021-31535.patch | 322 ++++++++++++++++++
> .../recipes-graphics/xorg-lib/libx11_1.6.9.bb | 1 +
> 2 files changed, 323 insertions(+)
> create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
>
> diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
> new file mode 100644
> index 0000000000..1112320acf
> --- /dev/null
> +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
> @@ -0,0 +1,322 @@
> +From 5c539ee6aba5872fcc73aa3d46a4e9a33dc030db Mon Sep 17 00:00:00 2001
> +From: Matthieu Herrb <matthieu@herrb.eu>
> +Date: Fri, 19 Feb 2021 15:30:39 +0100
> +Subject: [PATCH] Reject string longer than USHRT_MAX before sending them on
> + the wire
> +
> +The X protocol uses CARD16 values to represent the length so
> +this would overflow.
> +
> +CVE-2021-31535
> +
> +Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
> +Signed-off-by: Jasper Orschulko <Jasper.Orschulko@iris-sensing.com>
> +---
> + src/Font.c | 6 ++++--
> + src/FontInfo.c | 3 +++
> + src/FontNames.c | 3 +++
> + src/GetColor.c | 4 ++++
> + src/LoadFont.c | 4 ++++
> + src/LookupCol.c | 6 ++++--
> + src/ParseCol.c | 5 ++++-
> + src/QuExt.c | 5 +++++
> + src/SetFPath.c | 8 +++++++-
> + src/SetHints.c | 7 +++++++
> + src/StNColor.c | 3 +++
> + src/StName.c | 7 ++++++-
> + 12 files changed, 54 insertions(+), 7 deletions(-)
> +
> +diff --git a/src/Font.c b/src/Font.c
> +index 09d2ae91..3f468e4b 100644
> +--- a/src/Font.c
> ++++ b/src/Font.c
> +@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
> + XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
> + #endif
> +
> ++ if (strlen(name) >= USHRT_MAX)
> ++ return NULL;
> + if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
> + return font_result;
> + LockDisplay(dpy);
> +@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
> +
> + if (!name)
> + return 0;
> +- l = strlen(name);
> +- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
> ++ l = (int) strlen(name);
> ++ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
> + return 0;
> + charset = NULL;
> + /* next three lines stolen from _XkbGetCharset() */
> +diff --git a/src/FontInfo.c b/src/FontInfo.c
> +index f870e431..51b48e29 100644
> +--- a/src/FontInfo.c
> ++++ b/src/FontInfo.c
> +@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
> + register xListFontsReq *req;
> + int j;
> +
> ++ if (strlen(pattern) >= USHRT_MAX)
> ++ return NULL;
> ++
> + LockDisplay(dpy);
> + GetReq(ListFontsWithInfo, req);
> + req->maxNames = maxNames;
> +diff --git a/src/FontNames.c b/src/FontNames.c
> +index b78792d6..4dac4916 100644
> +--- a/src/FontNames.c
> ++++ b/src/FontNames.c
> +@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
> + register xListFontsReq *req;
> + unsigned long rlen = 0;
> +
> ++ if (strlen(pattern) >= USHRT_MAX)
> ++ return NULL;
> ++
> + LockDisplay(dpy);
> + GetReq(ListFonts, req);
> + req->maxNames = maxNames;
> +diff --git a/src/GetColor.c b/src/GetColor.c
> +index cd0eb9f6..512ac308 100644
> +--- a/src/GetColor.c
> ++++ b/src/GetColor.c
> +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include <stdio.h>
> + #include "Xlibint.h"
> + #include "Xcmsint.h"
> +@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
> + XcmsColor cmsColor_exact;
> + Status ret;
> +
> ++ if (strlen(colorname) >= USHRT_MAX)
> ++ return (0);
> ++
> + #ifdef XCMS
> + /*
> + * Let's Attempt to use Xcms and i18n approach to Parse Color
> +diff --git a/src/LoadFont.c b/src/LoadFont.c
> +index f547976b..85735249 100644
> +--- a/src/LoadFont.c
> ++++ b/src/LoadFont.c
> +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include "Xlibint.h"
> +
> + Font
> +@@ -38,6 +39,9 @@ XLoadFont (
> + Font fid;
> + register xOpenFontReq *req;
> +
> ++ if (strlen(name) >= USHRT_MAX)
> ++ return (0);
> ++
> + if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
> + return fid;
> +
> +diff --git a/src/LookupCol.c b/src/LookupCol.c
> +index f7f969f5..cd9b1368 100644
> +--- a/src/LookupCol.c
> ++++ b/src/LookupCol.c
> +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include <stdio.h>
> + #include "Xlibint.h"
> + #include "Xcmsint.h"
> +@@ -46,6 +47,9 @@ XLookupColor (
> + XcmsCCC ccc;
> + XcmsColor cmsColor_exact;
> +
> ++ n = (int) strlen (spec);
> ++ if (n >= USHRT_MAX)
> ++ return 0;
> + #ifdef XCMS
> + /*
> + * Let's Attempt to use Xcms and i18n approach to Parse Color
> +@@ -77,8 +81,6 @@ XLookupColor (
> + * Xcms and i18n methods failed, so lets pass it to the server
> + * for parsing.
> + */
> +-
> +- n = strlen (spec);
> + LockDisplay(dpy);
> + GetReq (LookupColor, req);
> + req->cmap = cmap;
> +diff --git a/src/ParseCol.c b/src/ParseCol.c
> +index e997b1b8..180132dd 100644
> +--- a/src/ParseCol.c
> ++++ b/src/ParseCol.c
> +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include <stdio.h>
> + #include "Xlibint.h"
> + #include "Xcmsint.h"
> +@@ -46,7 +47,9 @@ XParseColor (
> + XcmsColor cmsColor;
> +
> + if (!spec) return(0);
> +- n = strlen (spec);
> ++ n = (int) strlen (spec);
> ++ if (n >= USHRT_MAX)
> ++ return(0);
> + if (*spec == '#') {
> + /*
> + * RGB
> +diff --git a/src/QuExt.c b/src/QuExt.c
> +index 4e230e77..d38a1572 100644
> +--- a/src/QuExt.c
> ++++ b/src/QuExt.c
> +@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> ++#include <stdbool.h>
> + #include "Xlibint.h"
> +
> + Bool
> +@@ -40,6 +42,9 @@ XQueryExtension(
> + xQueryExtensionReply rep;
> + register xQueryExtensionReq *req;
> +
> ++ if (strlen(name) >= USHRT_MAX)
> ++ return false;
> ++
> + LockDisplay(dpy);
> + GetReq(QueryExtension, req);
> + req->nbytes = name ? strlen(name) : 0;
> +diff --git a/src/SetFPath.c b/src/SetFPath.c
> +index 60aaef01..3d8c50cb 100644
> +--- a/src/SetFPath.c
> ++++ b/src/SetFPath.c
> +@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
> +
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> ++#include <limits.h>
> + #endif
> + #include "Xlibint.h"
> +
> +@@ -48,7 +49,12 @@ XSetFontPath (
> + GetReq (SetFontPath, req);
> + req->nFonts = ndirs;
> + for (i = 0; i < ndirs; i++) {
> +- n += safestrlen (directories[i]) + 1;
> ++ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
> ++ if (n >= USHRT_MAX) {
> ++ UnlockDisplay(dpy);
> ++ SyncHandle();
> ++ return 0;
> ++ }
> + }
> + nbytes = (n + 3) & ~3;
> + req->length += nbytes >> 2;
> +diff --git a/src/SetHints.c b/src/SetHints.c
> +index bc46498a..f3d727ec 100644
> +--- a/src/SetHints.c
> ++++ b/src/SetHints.c
> +@@ -49,6 +49,7 @@ SOFTWARE.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include <X11/Xlibint.h>
> + #include <X11/Xutil.h>
> + #include "Xatomtype.h"
> +@@ -214,6 +215,8 @@ XSetCommand (
> + register char *buf, *bp;
> + for (i = 0, nbytes = 0; i < argc; i++) {
> + nbytes += safestrlen(argv[i]) + 1;
> ++ if (nbytes >= USHRT_MAX)
> ++ return 1;
> + }
> + if ((bp = buf = Xmalloc(nbytes))) {
> + /* copy arguments into single buffer */
> +@@ -256,6 +259,8 @@ XSetStandardProperties (
> +
> + if (name != NULL) XStoreName (dpy, w, name);
> +
> ++ if (safestrlen(icon_string) >= USHRT_MAX)
> ++ return 1;
> + if (icon_string != NULL) {
> + XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
> + PropModeReplace,
> +@@ -298,6 +303,8 @@ XSetClassHint(
> +
> + len_nm = safestrlen(classhint->res_name);
> + len_cl = safestrlen(classhint->res_class);
> ++ if (len_nm + len_cl >= USHRT_MAX)
> ++ return 1;
> + if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
> + if (len_nm) {
> + strcpy(s, classhint->res_name);
> +diff --git a/src/StNColor.c b/src/StNColor.c
> +index 8b821c3e..ba021958 100644
> +--- a/src/StNColor.c
> ++++ b/src/StNColor.c
> +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include <stdio.h>
> + #include "Xlibint.h"
> + #include "Xcmsint.h"
> +@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
> + XcmsColor cmsColor_exact;
> + XColor scr_def;
> +
> ++ if (strlen(name) >= USHRT_MAX)
> ++ return 0;
> + #ifdef XCMS
> + /*
> + * Let's Attempt to use Xcms approach to Parse Color
> +diff --git a/src/StName.c b/src/StName.c
> +index b4048bff..5a632d0c 100644
> +--- a/src/StName.c
> ++++ b/src/StName.c
> +@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
> + #ifdef HAVE_CONFIG_H
> + #include <config.h>
> + #endif
> ++#include <limits.h>
> + #include <X11/Xlibint.h>
> + #include <X11/Xatom.h>
> +
> +@@ -36,7 +37,9 @@ XStoreName (
> + Window w,
> + _Xconst char *name)
> + {
> +- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
> ++ if (strlen(name) >= USHRT_MAX)
> ++ return 0;
> ++ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
> + 8, PropModeReplace, (_Xconst unsigned char *)name,
> + name ? strlen(name) : 0);
> + }
> +@@ -47,6 +50,8 @@ XSetIconName (
> + Window w,
> + _Xconst char *icon_name)
> + {
> ++ if (strlen(icon_name) >= USHRT_MAX)
> ++ return 0;
> + return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
> + PropModeReplace, (_Xconst unsigned char *)icon_name,
> + icon_name ? strlen(icon_name) : 0);
> +--
> +2.32.0
> +
> diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
> index ebd2640743..ff2a6f7265 100644
> --- a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
> +++ b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
> @@ -15,6 +15,7 @@ SRC_URI += "file://Fix-hanging-issue-in-_XReply.patch \
> file://libx11-whitespace.patch \
> file://CVE-2020-14344.patch \
> file://CVE-2020-14363.patch \
> + file://CVE-2021-31535.patch \
> "
>
> SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2"
> --
> 2.32.0
>
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [oe-core][dunfell][PATCH v2] libx11: Fix CVE-2021-31535
2021-06-22 14:30 ` Steve Sakoman
@ 2021-06-22 14:45 ` Jasper Orschulko
0 siblings, 0 replies; 3+ messages in thread
From: Jasper Orschulko @ 2021-06-22 14:45 UTC (permalink / raw)
To: openembedded-core, Steve Sakoman
Cc: Patches and discussions about the oe-core layer
[-- Attachment #1: Type: text/plain, Size: 13412 bytes --]
Obviously, patch files in patch files still confuse me... :D v3 on it's way!
On 22 June 2021 16:30:40 CEST, Steve Sakoman <steve@sakoman.com> wrote:
>On Tue, Jun 22, 2021 at 2:09 AM Jasper Orschulko via
>lists.openembedded.org <jasper=fancydomain.eu@lists.openembedded.org>
>wrote:
>>
>> https://lists.x.org/archives/xorg-announce/2021-May/003088.html
>>
>> XLookupColor() and other X libraries function lack proper validation
>> of the length of their string parameters. If those parameters can be
>> controlled by an external application (for instance a color name that
>> can be emitted via a terminal control sequence) it can lead to the
>> emission of extra X protocol requests to the X server.
>>
>> Upstream-Status: Backport
>[https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605]
>> CVE: CVE-2021-31535
>> Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu>
>
>These three lines should be in the patch file itself. See the "Patch
>name convention and commit message" section at
>https://wiki.yoctoproject.org/wiki/Security for details.
>
>Thanks!
>
>Steve
>
>> ---
>> .../xorg-lib/libx11/CVE-2021-31535.patch | 322
>++++++++++++++++++
>> .../recipes-graphics/xorg-lib/libx11_1.6.9.bb | 1 +
>> 2 files changed, 323 insertions(+)
>> create mode 100644
>meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
>>
>> diff --git
>a/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
>b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
>> new file mode 100644
>> index 0000000000..1112320acf
>> --- /dev/null
>> +++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2021-31535.patch
>> @@ -0,0 +1,322 @@
>> +From 5c539ee6aba5872fcc73aa3d46a4e9a33dc030db Mon Sep 17 00:00:00
>2001
>> +From: Matthieu Herrb <matthieu@herrb.eu>
>> +Date: Fri, 19 Feb 2021 15:30:39 +0100
>> +Subject: [PATCH] Reject string longer than USHRT_MAX before sending
>them on
>> + the wire
>> +
>> +The X protocol uses CARD16 values to represent the length so
>> +this would overflow.
>> +
>> +CVE-2021-31535
>> +
>> +Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
>> +Signed-off-by: Jasper Orschulko <Jasper.Orschulko@iris-sensing.com>
>> +---
>> + src/Font.c | 6 ++++--
>> + src/FontInfo.c | 3 +++
>> + src/FontNames.c | 3 +++
>> + src/GetColor.c | 4 ++++
>> + src/LoadFont.c | 4 ++++
>> + src/LookupCol.c | 6 ++++--
>> + src/ParseCol.c | 5 ++++-
>> + src/QuExt.c | 5 +++++
>> + src/SetFPath.c | 8 +++++++-
>> + src/SetHints.c | 7 +++++++
>> + src/StNColor.c | 3 +++
>> + src/StName.c | 7 ++++++-
>> + 12 files changed, 54 insertions(+), 7 deletions(-)
>> +
>> +diff --git a/src/Font.c b/src/Font.c
>> +index 09d2ae91..3f468e4b 100644
>> +--- a/src/Font.c
>> ++++ b/src/Font.c
>> +@@ -102,6 +102,8 @@ XFontStruct *XLoadQueryFont(
>> + XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
>> + #endif
>> +
>> ++ if (strlen(name) >= USHRT_MAX)
>> ++ return NULL;
>> + if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font
>*)0))
>> + return font_result;
>> + LockDisplay(dpy);
>> +@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
>> +
>> + if (!name)
>> + return 0;
>> +- l = strlen(name);
>> +- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
>> ++ l = (int) strlen(name);
>> ++ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >=
>USHRT_MAX)
>> + return 0;
>> + charset = NULL;
>> + /* next three lines stolen from _XkbGetCharset() */
>> +diff --git a/src/FontInfo.c b/src/FontInfo.c
>> +index f870e431..51b48e29 100644
>> +--- a/src/FontInfo.c
>> ++++ b/src/FontInfo.c
>> +@@ -58,6 +58,9 @@ XFontStruct **info) /* RETURN */
>> + register xListFontsReq *req;
>> + int j;
>> +
>> ++ if (strlen(pattern) >= USHRT_MAX)
>> ++ return NULL;
>> ++
>> + LockDisplay(dpy);
>> + GetReq(ListFontsWithInfo, req);
>> + req->maxNames = maxNames;
>> +diff --git a/src/FontNames.c b/src/FontNames.c
>> +index b78792d6..4dac4916 100644
>> +--- a/src/FontNames.c
>> ++++ b/src/FontNames.c
>> +@@ -51,6 +51,9 @@ int *actualCount) /* RETURN */
>> + register xListFontsReq *req;
>> + unsigned long rlen = 0;
>> +
>> ++ if (strlen(pattern) >= USHRT_MAX)
>> ++ return NULL;
>> ++
>> + LockDisplay(dpy);
>> + GetReq(ListFonts, req);
>> + req->maxNames = maxNames;
>> +diff --git a/src/GetColor.c b/src/GetColor.c
>> +index cd0eb9f6..512ac308 100644
>> +--- a/src/GetColor.c
>> ++++ b/src/GetColor.c
>> +@@ -27,6 +27,7 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include <stdio.h>
>> + #include "Xlibint.h"
>> + #include "Xcmsint.h"
>> +@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
>> + XcmsColor cmsColor_exact;
>> + Status ret;
>> +
>> ++ if (strlen(colorname) >= USHRT_MAX)
>> ++ return (0);
>> ++
>> + #ifdef XCMS
>> + /*
>> + * Let's Attempt to use Xcms and i18n approach to Parse Color
>> +diff --git a/src/LoadFont.c b/src/LoadFont.c
>> +index f547976b..85735249 100644
>> +--- a/src/LoadFont.c
>> ++++ b/src/LoadFont.c
>> +@@ -27,6 +27,7 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include "Xlibint.h"
>> +
>> + Font
>> +@@ -38,6 +39,9 @@ XLoadFont (
>> + Font fid;
>> + register xOpenFontReq *req;
>> +
>> ++ if (strlen(name) >= USHRT_MAX)
>> ++ return (0);
>> ++
>> + if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0,
>&fid))
>> + return fid;
>> +
>> +diff --git a/src/LookupCol.c b/src/LookupCol.c
>> +index f7f969f5..cd9b1368 100644
>> +--- a/src/LookupCol.c
>> ++++ b/src/LookupCol.c
>> +@@ -27,6 +27,7 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include <stdio.h>
>> + #include "Xlibint.h"
>> + #include "Xcmsint.h"
>> +@@ -46,6 +47,9 @@ XLookupColor (
>> + XcmsCCC ccc;
>> + XcmsColor cmsColor_exact;
>> +
>> ++ n = (int) strlen (spec);
>> ++ if (n >= USHRT_MAX)
>> ++ return 0;
>> + #ifdef XCMS
>> + /*
>> + * Let's Attempt to use Xcms and i18n approach to Parse Color
>> +@@ -77,8 +81,6 @@ XLookupColor (
>> + * Xcms and i18n methods failed, so lets pass it to the
>server
>> + * for parsing.
>> + */
>> +-
>> +- n = strlen (spec);
>> + LockDisplay(dpy);
>> + GetReq (LookupColor, req);
>> + req->cmap = cmap;
>> +diff --git a/src/ParseCol.c b/src/ParseCol.c
>> +index e997b1b8..180132dd 100644
>> +--- a/src/ParseCol.c
>> ++++ b/src/ParseCol.c
>> +@@ -27,6 +27,7 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include <stdio.h>
>> + #include "Xlibint.h"
>> + #include "Xcmsint.h"
>> +@@ -46,7 +47,9 @@ XParseColor (
>> + XcmsColor cmsColor;
>> +
>> + if (!spec) return(0);
>> +- n = strlen (spec);
>> ++ n = (int) strlen (spec);
>> ++ if (n >= USHRT_MAX)
>> ++ return(0);
>> + if (*spec == '#') {
>> + /*
>> + * RGB
>> +diff --git a/src/QuExt.c b/src/QuExt.c
>> +index 4e230e77..d38a1572 100644
>> +--- a/src/QuExt.c
>> ++++ b/src/QuExt.c
>> +@@ -27,6 +27,8 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> ++#include <stdbool.h>
>> + #include "Xlibint.h"
>> +
>> + Bool
>> +@@ -40,6 +42,9 @@ XQueryExtension(
>> + xQueryExtensionReply rep;
>> + register xQueryExtensionReq *req;
>> +
>> ++ if (strlen(name) >= USHRT_MAX)
>> ++ return false;
>> ++
>> + LockDisplay(dpy);
>> + GetReq(QueryExtension, req);
>> + req->nbytes = name ? strlen(name) : 0;
>> +diff --git a/src/SetFPath.c b/src/SetFPath.c
>> +index 60aaef01..3d8c50cb 100644
>> +--- a/src/SetFPath.c
>> ++++ b/src/SetFPath.c
>> +@@ -26,6 +26,7 @@ in this Software without prior written
>authorization from The Open Group.
>> +
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> ++#include <limits.h>
>> + #endif
>> + #include "Xlibint.h"
>> +
>> +@@ -48,7 +49,12 @@ XSetFontPath (
>> + GetReq (SetFontPath, req);
>> + req->nFonts = ndirs;
>> + for (i = 0; i < ndirs; i++) {
>> +- n += safestrlen (directories[i]) + 1;
>> ++ n = (int) ((size_t) n + (safestrlen (directories[i])
>+ 1));
>> ++ if (n >= USHRT_MAX) {
>> ++ UnlockDisplay(dpy);
>> ++ SyncHandle();
>> ++ return 0;
>> ++ }
>> + }
>> + nbytes = (n + 3) & ~3;
>> + req->length += nbytes >> 2;
>> +diff --git a/src/SetHints.c b/src/SetHints.c
>> +index bc46498a..f3d727ec 100644
>> +--- a/src/SetHints.c
>> ++++ b/src/SetHints.c
>> +@@ -49,6 +49,7 @@ SOFTWARE.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include <X11/Xlibint.h>
>> + #include <X11/Xutil.h>
>> + #include "Xatomtype.h"
>> +@@ -214,6 +215,8 @@ XSetCommand (
>> + register char *buf, *bp;
>> + for (i = 0, nbytes = 0; i < argc; i++) {
>> + nbytes += safestrlen(argv[i]) + 1;
>> ++ if (nbytes >= USHRT_MAX)
>> ++ return 1;
>> + }
>> + if ((bp = buf = Xmalloc(nbytes))) {
>> + /* copy arguments into single buffer */
>> +@@ -256,6 +259,8 @@ XSetStandardProperties (
>> +
>> + if (name != NULL) XStoreName (dpy, w, name);
>> +
>> ++ if (safestrlen(icon_string) >= USHRT_MAX)
>> ++ return 1;
>> + if (icon_string != NULL) {
>> + XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
>> + PropModeReplace,
>> +@@ -298,6 +303,8 @@ XSetClassHint(
>> +
>> + len_nm = safestrlen(classhint->res_name);
>> + len_cl = safestrlen(classhint->res_class);
>> ++ if (len_nm + len_cl >= USHRT_MAX)
>> ++ return 1;
>> + if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
>> + if (len_nm) {
>> + strcpy(s, classhint->res_name);
>> +diff --git a/src/StNColor.c b/src/StNColor.c
>> +index 8b821c3e..ba021958 100644
>> +--- a/src/StNColor.c
>> ++++ b/src/StNColor.c
>> +@@ -27,6 +27,7 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include <stdio.h>
>> + #include "Xlibint.h"
>> + #include "Xcmsint.h"
>> +@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
>> + XcmsColor cmsColor_exact;
>> + XColor scr_def;
>> +
>> ++ if (strlen(name) >= USHRT_MAX)
>> ++ return 0;
>> + #ifdef XCMS
>> + /*
>> + * Let's Attempt to use Xcms approach to Parse Color
>> +diff --git a/src/StName.c b/src/StName.c
>> +index b4048bff..5a632d0c 100644
>> +--- a/src/StName.c
>> ++++ b/src/StName.c
>> +@@ -27,6 +27,7 @@ in this Software without prior written
>authorization from The Open Group.
>> + #ifdef HAVE_CONFIG_H
>> + #include <config.h>
>> + #endif
>> ++#include <limits.h>
>> + #include <X11/Xlibint.h>
>> + #include <X11/Xatom.h>
>> +
>> +@@ -36,7 +37,9 @@ XStoreName (
>> + Window w,
>> + _Xconst char *name)
>> + {
>> +- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
>> ++ if (strlen(name) >= USHRT_MAX)
>> ++ return 0;
>> ++ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
>> + 8, PropModeReplace, (_Xconst unsigned char
>*)name,
>> + name ? strlen(name) : 0);
>> + }
>> +@@ -47,6 +50,8 @@ XSetIconName (
>> + Window w,
>> + _Xconst char *icon_name)
>> + {
>> ++ if (strlen(icon_name) >= USHRT_MAX)
>> ++ return 0;
>> + return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
>> + PropModeReplace, (_Xconst unsigned char
>*)icon_name,
>> + icon_name ? strlen(icon_name) : 0);
>> +--
>> +2.32.0
>> +
>> diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
>b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
>> index ebd2640743..ff2a6f7265 100644
>> --- a/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
>> +++ b/meta/recipes-graphics/xorg-lib/libx11_1.6.9.bb
>> @@ -15,6 +15,7 @@ SRC_URI +=
>"file://Fix-hanging-issue-in-_XReply.patch \
>> file://libx11-whitespace.patch \
>> file://CVE-2020-14344.patch \
>> file://CVE-2020-14363.patch \
>> + file://CVE-2021-31535.patch \
>> "
>>
>> SRC_URI[md5sum] = "55adbfb6d4370ecac5e70598c4e7eed2"
>> --
>> 2.32.0
>>
>>
>>
>>
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
[-- Attachment #2: Type: text/html, Size: 14319 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-06-22 14:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-22 12:08 [oe-core][dunfell][PATCH v2] libx11: Fix CVE-2021-31535 Jasper Orschulko
2021-06-22 14:30 ` Steve Sakoman
2021-06-22 14:45 ` Jasper Orschulko
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.