rpms/libXfont/F-8 cve-2008-0006.patch, NONE, 1.1 libXfont.spec, 1.38, 1.39

[Dave Airlie (airlied)]

Author: airlied

Update of /cvs/pkgs/rpms/libXfont/F-8
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv32172

Modified Files:
	libXfont.spec 
Added Files:
	cve-2008-0006.patch 
Log Message:
* Fri Jan 18 2008 Dave Airlie <airlied at redhat.com> 1.3.1-2
- cve-2008-0006.patch: XFS Integer Overflow Vulnerability


cve-2008-0006.patch:

--- NEW FILE cve-2008-0006.patch ---
--- libXfont-1.2.2/src/bitmap/pcfread.c.jx	2008-01-14 11:10:38.000000000 -0500
+++ libXfont-1.2.2/src/bitmap/pcfread.c	2008-01-14 11:13:15.000000000 -0500
@@ -585,6 +585,9 @@ pcfReadFont(FontPtr pFont, FontFilePtr f
     pFont->info.lastRow = pcfGetINT16(file, format);
     pFont->info.defaultCh = pcfGetINT16(file, format);
     if (IS_EOF(file)) goto Bail;
+    if (pFont->info.firstCol > pFont->info.lastCol ||
+	pFont->info.firstRow > pFont->info.lastRow ||
+	pFont->info.lastCol-pFont->info.firstCol > 255) goto Bail;
 
     nencoding = (pFont->info.lastCol - pFont->info.firstCol + 1) *
 	(pFont->info.lastRow - pFont->info.firstRow + 1);
@@ -723,6 +726,9 @@ pcfReadFontInfo(FontInfoPtr pFontInfo, F
     pFontInfo->lastRow = pcfGetINT16(file, format);
     pFontInfo->defaultCh = pcfGetINT16(file, format);
     if (IS_EOF(file)) goto Bail;
+    if (pFontInfo->firstCol > pFontInfo->lastCol ||
+	pFontInfo->firstRow > pFontInfo->lastRow ||
+	pFontInfo->lastCol-pFontInfo->firstCol > 255) goto Bail;
 
     nencoding = (pFontInfo->lastCol - pFontInfo->firstCol + 1) *
 	(pFontInfo->lastRow - pFontInfo->firstRow + 1);


Index: libXfont.spec
===================================================================
RCS file: /cvs/pkgs/rpms/libXfont/F-8/libXfont.spec,v
retrieving revision 1.38
retrieving revision 1.39
diff -u -r1.38 -r1.39
--- libXfont.spec	24 Sep 2007 18:28:28 -0000	1.38
+++ libXfont.spec	18 Jan 2008 03:13:24 -0000	1.39
@@ -1,14 +1,15 @@
 Summary: X.Org X11 libXfont runtime library
 Name: libXfont
 Version: 1.3.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: MIT/X11
 Group: System Environment/Libraries
 URL: http://www.x.org
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 
 Source0: ftp://ftp.x.org/pub/individual/lib/%{name}-%{version}.tar.bz2
-#Patch0: libXfont-1.2.3-namespace-pollution.patch
+
+Patch0: cve-2008-0006.patch
 
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-util-macros
@@ -39,7 +40,7 @@
 
 %prep
 %setup -q
-#%patch0 -p1 -b .hidden
+%patch0 -p1 -b .cve-2008-0006
 
 %build
 %configure --disable-static
@@ -91,6 +92,9 @@
 %{_libdir}/pkgconfig/xfont.pc
 
 %changelog
+* Fri Jan 18 2008 Dave Airlie <airlied at redhat.com> 1.3.1-2
+- cve-2008-0006.patch: XFS Integer Overflow Vulnerability
+
 * Mon Sep 24 2007 Adam Jackson <ajax at redhat.com> 1.3.1-1
 - libXfont 1.3.1