rpms/libXfont/F-7 cve-2008-0006.patch, NONE, 1.1 libXfont.spec, 1.33, 1.34

[Dave Airlie (airlied)]

Author: airlied

Update of /cvs/pkgs/rpms/libXfont/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv32170

Modified Files:
	libXfont.spec 
Added Files:
	cve-2008-0006.patch 
Log Message:
* Fri Jan 18 2008 Dave Airlie <airlied at redhat.com> 1.2.9-3
- cve-2008-0006.patch: XFS Integer Overflow Vulnerability


cve-2008-0006.patch:

--- NEW FILE cve-2008-0006.patch ---
--- libXfont-1.2.2/src/bitmap/pcfread.c.jx	2008-01-14 11:10:38.000000000 -0500
+++ libXfont-1.2.2/src/bitmap/pcfread.c	2008-01-14 11:13:15.000000000 -0500
@@ -585,6 +585,9 @@ pcfReadFont(FontPtr pFont, FontFilePtr f
     pFont->info.lastRow = pcfGetINT16(file, format);
     pFont->info.defaultCh = pcfGetINT16(file, format);
     if (IS_EOF(file)) goto Bail;
+    if (pFont->info.firstCol > pFont->info.lastCol ||
+	pFont->info.firstRow > pFont->info.lastRow ||
+	pFont->info.lastCol-pFont->info.firstCol > 255) goto Bail;
 
     nencoding = (pFont->info.lastCol - pFont->info.firstCol + 1) *
 	(pFont->info.lastRow - pFont->info.firstRow + 1);
@@ -723,6 +726,9 @@ pcfReadFontInfo(FontInfoPtr pFontInfo, F
     pFontInfo->lastRow = pcfGetINT16(file, format);
     pFontInfo->defaultCh = pcfGetINT16(file, format);
     if (IS_EOF(file)) goto Bail;
+    if (pFontInfo->firstCol > pFontInfo->lastCol ||
+	pFontInfo->firstRow > pFontInfo->lastRow ||
+	pFontInfo->lastCol-pFontInfo->firstCol > 255) goto Bail;
 
     nencoding = (pFontInfo->lastCol - pFontInfo->firstCol + 1) *
 	(pFontInfo->lastRow - pFontInfo->firstRow + 1);


Index: libXfont.spec
===================================================================
RCS file: /cvs/pkgs/rpms/libXfont/F-7/libXfont.spec,v
retrieving revision 1.33
retrieving revision 1.34
diff -u -r1.33 -r1.34
--- libXfont.spec	29 Jun 2007 14:38:11 -0000	1.33
+++ libXfont.spec	18 Jan 2008 03:13:16 -0000	1.34
@@ -1,7 +1,7 @@
 Summary: X.Org X11 libXfont runtime library
 Name: libXfont
 Version: 1.2.9
-Release: 2%{?dist}
+Release: 3%{?dist}
 License: MIT/X11
 Group: System Environment/Libraries
 URL: http://www.x.org
@@ -10,6 +10,7 @@
 Source0: ftp://ftp.x.org/pub/individual/lib/%{name}-%{version}.tar.bz2
 #Patch0: libXfont-1.2.3-namespace-pollution.patch
 Patch10: strstr-hates-null.patch
+Patch20: cve-2008-0006.patch
 
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-util-macros
@@ -43,6 +44,8 @@
 #%patch0 -p1 -b .hidden
 %patch10 -p1 -b .strstr-hates-null
 
+%patch20 -p1 -b .cve2008-0006
+
 %build
 %configure --disable-static
 make 
@@ -93,6 +96,9 @@
 %{_libdir}/pkgconfig/xfont.pc
 
 %changelog
+* Fri Jan 18 2008 Dave Airlie <airlied at redhat.com> 1.2.9-3
+- cve-2008-0006.patch: XFS Integer Overflow Vulnerability
+
 * Tue Jun 26 2007 Kristian Høgsberg <krh at redhat.com> - 1.2.9-2
 - Put in stop-gap patch to fix comparing links with no attributes.