rpms/xorg-x11-server/devel cve-2008-0006-server-fixup.patch, NONE, 1.1 xorg-x11-server.spec, 1.287, 1.288

[Dave Airlie (airlied)]

Author: airlied

Update of /cvs/pkgs/rpms/xorg-x11-server/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv31913

Modified Files:
	xorg-x11-server.spec 
Added Files:
	cve-2008-0006-server-fixup.patch 
Log Message:
* Fri Jan 18 2008 Dave Airlie <airlied at redhat.com> 1.4.99.1-0.17
- cve-2007-5760.patch: XFree86-Misc Extension Invalid Array Index Vulnerability
- cve-2007-5958.patch: Xorg / XFree86 file existence disclosure vulnerability
- cve-2007-6427.patch: XInput Extension Memory Corruption Vulnerability
- cve-2007-6428.patch: TOG-CUP Extension Memory Corruption Vulnerability
- cve-2007-6429.patch: EVI and MIT-SHM Extension Integer Overflow Vulnerability
- cve-2008-0006-server-fixup.patch: PCF Font Vulnerability - this patch isn't strictly required with new version of libXfont.


cve-2008-0006-server-fixup.patch:

--- NEW FILE cve-2008-0006-server-fixup.patch ---
diff -up xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c
--- xorg-x11-6.8.2/xc/programs/Xserver/dix/dixfonts.c.jx	2004-04-23 15:04:44.000000000 -0400
+++ xorg-x11-server/dix/dixfonts.c	2008-01-14 11:15:00.000000000 -0500
@@ -339,6 +339,13 @@ doOpenFont(ClientPtr client, OFclosurePt
 	err = BadFontName;
 	goto bail;
     }
+    /* check values for firstCol, lastCol, firstRow, and lastRow */
+    if (pfont->info.firstCol > pfont->info.lastCol ||
+	pfont->info.firstRow > pfont->info.lastRow ||
+	pfont->info.lastCol - pfont->info.firstCol > 255) {
+	err = AllocError;
+	goto bail;
+    }
     if (!pfont->fpe)
 	pfont->fpe = fpe;
     pfont->refcnt++;


Index: xorg-x11-server.spec
===================================================================
RCS file: /cvs/pkgs/rpms/xorg-x11-server/devel/xorg-x11-server.spec,v
retrieving revision 1.287
retrieving revision 1.288
diff -u -r1.287 -r1.288
--- xorg-x11-server.spec	18 Jan 2008 02:52:04 -0000	1.287
+++ xorg-x11-server.spec	18 Jan 2008 03:06:10 -0000	1.288
@@ -63,6 +63,7 @@
 Patch3002:  cve-2007-6427.patch
 Patch3003:  cve-2007-6428.patch
 Patch3004:  cve-2007-6429.patch
+Patch3005:  cve-2008-0006-server-fixup.patch
 
 # Trivial things to maybe merge upstream at next rebase
 #Patch4003: argh-pixman.patch #fixme
@@ -521,6 +522,7 @@
 - cve-2007-6427.patch: XInput Extension Memory Corruption Vulnerability
 - cve-2007-6428.patch: TOG-CUP Extension Memory Corruption Vulnerability
 - cve-2007-6429.patch: EVI and MIT-SHM Extension Integer Overflow Vulnerability
+- cve-2008-0006-server-fixup.patch: PCF Font Vulnerability - this patch isn't strictly required with new version of libXfont.
 
 * Wed Jan 16 2008 Kristian Høgsberg <krh at redhat.com> 1.4.99.1-0.16
 - Add xserver-1.4.99-engage-composite-crack-mode.patch to better hide