x2go-dev February 2015

x2go-dev@lists.x2go.org

28 participants
202 discussions

Generic Release Steps Documented on the Wiki
by Mihai Moldovan 18 Feb '15

18 Feb '15

Hi As promised, I have documented the generic release steps on this wiki page: http://wiki.x2go.org/doku.php/wiki:development:release-howto Also, this howto is accessible via http://wiki.x2go.org/doku.php/wiki:development:start There's probably still room for improvement and I will add more documentation related to Jenkins and Launchpad when I'm more clear on these matters. Mihai

1 0

X.org Coverity fixes (from 2006) & nx-libs
by Michael DePaulo 18 Feb '15

18 Feb '15

While I was backporting the CVE-2015-0255 fix from X.org to nx-libs, I noticed that there were a ton of Coverity fixes from 2006 in the X.org Xserver: http://cgit.freedesktop.org/xorg/xserver/log/?qt=grep&q=Coverity I backported only one of them as a prereq for CVE-2015-0255: http://cgit.freedesktop.org/xorg/xserver/commit/?id=47bdc9528c2dd4ea9d59a09… Thoughts/Comments? -Mike

3 3

Preview of X2Go Client 4.0.3.2 available
by Mihai Moldovan 18 Feb '15

18 Feb '15

Hi all I am happy to announce a preview of X2Go Client 4.0.3.2 based on on my bugfix/osx branch based on my feature/cleanup branch based on current master. This pre-release includes a fix for the problem of X2Go Client deadlocking when trying to establish more than one session sequentially. Please grab the desired DMG file from this location and optionally check the checksums and signature: http://code.x2go.org/releases/binary-macosx/x2goclient/previews/4.0.3.2/ Note that this preview includes two versions of X2Go Client. One was built on OS X 10.6 and is best-suited for OS X 10.6 and 10.7, while the other was built on OS X 10.9 and is best suited for OS X 10.9 and 10.10. For users on OS X 10.8, I recommend first trying the 10.9 version and if this misbehaves, resorting to the 10.6 version. As always, I would be delighted to get feedback and criticism. Best, Mihai

3 4

Status of fixing CVE-2015-0255 (2015-02-10)
by Michael DePaulo 18 Feb '15

18 Feb '15

I am looking into fixing the recently announced X.org vulnerability (CVE-2015-0255) in nx-libs. http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/ It looks like nx-libs is affected. It also looks like some distros (Fedora, Debian) have fixed it, while others (RHEL 5, 6 and 7, Debian LTS) have not. It also looks like the X.org 1.16.x commits are easier to apply to nx-libs than the X.org 1.17.x commits are. The 1.17.x commits are linked to on that advisory page. The X.org 1.16.x commits are here: the branch: http://cgit.freedesktop.org/xorg/xserver/log/?h=server-1.16-branch the prereq: http://cgit.freedesktop.org/xorg/xserver/commit/?h=server-1.16-branch&id=74… the fix itself: http://cgit.freedesktop.org/xorg/xserver/commit/?h=server-1.16-branch&id=8f… -Mike#2

3 6

Re: [X2Go-Dev] [X2Go-Commits] [x2goclient] 01/02: Reformat onmainwindow.cpp
by Michael DePaulo 17 Feb '15

17 Feb '15

On Tue, Feb 17, 2015 at 6:18 AM, <git-admin(a)x2go.org> wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch master > in repository x2goclient. > > commit 2b105f11d73998111956b9964292ff23583d29f4 > Author: Oleksandr Shneyder <o.shneyder(a)phoca-gmbh.de> > Date: Tue Feb 17 12:15:18 2015 +0100 > > Reformat onmainwindow.cpp > --- > debian/changelog | 1 + > onmainwindow.cpp | 6 +++--- > 2 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/debian/changelog b/debian/changelog > index c40f3ab..14c1bca 100644 > --- a/debian/changelog > +++ b/debian/changelog > @@ -5,6 +5,7 @@ x2goclient (4.0.3.2-0x2go1) UNRELEASED; urgency=medium > - Reformat onmainwindow.cpp > - Fix placement of session folders in session card column. (Fixes: #681). > - Send empty message in x2gohelper to stop AppStarting cursor. (Fixes: #616). > + - Reformat onmainwindow.cpp > > [ Mike Gabriel ] > * New upstream release (4.0.3.2): > diff --git a/onmainwindow.cpp b/onmainwindow.cpp > index 6dadd87..5bb4210 100644 > --- a/onmainwindow.cpp > +++ b/onmainwindow.cpp > @@ -3032,7 +3032,7 @@ void ONMainWindow::slotSessEnter() > > if(brokerMode) > { > - if (config.brokerNoAuth && brokerNoauthWithSessionUsername) { > + if (config.brokerNoAuth && brokerNoauthWithSessionUsername) { > config.brokerUser = login->text(); > } > broker->selectUserSession(sessionExplorer->getLastSession()->id()); > @@ -9723,8 +9723,8 @@ void ONMainWindow::startPulsed() > else > { > pulseCookieArg="auth-cookie="+ > - QDir::toNativeSeparators (wapiShortFileName( pulseBaseDir))+ > - "\\.pulse-cookie"; > + QDir::toNativeSeparators (wapiShortFileName( pulseBaseDir))+ > + "\\.pulse-cookie"; > // Double backslashes are required in config.pa > pulseCookieArg.replace("\\", "\\\\"); > out << "load-module module-native-protocol-tcp port="+ > > -- > Alioth's /srv/git/_hooks_/post-receive-email on /srv/git/code.x2go.org/x2goclient.git Hi Alex, Did I mess up the whitespace with those last 2 lines? I am asking because I want to avoid making the same mistake in the future. -Mike

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 28/52: CVE-2014-0210: unvalidated length fields in fs_read_list() from xorg/lib/libXfont commit 5fa73ac18474be3032ee7af9c6e29deab163ea39
by Mihai Moldovan 17 Feb '15

17 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit ef439da38d3a4c00a4e03e7d8f83cb359cd9a230 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:35:21 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_list() from xorg/lib/libXfont commit 5fa73ac18474be3032ee7af9c6e29deab163ea39 > > fs_read_list() parses a reply from the font server. The reply > contains a list of strings with embedded length fields, none of > which are validated. This can cause out of bound reads when looping > over the strings in the reply. > --- > nx-X11/lib/font/fc/fserve.c | 15 +++++++++++++++ > 1 file changed, 15 insertions(+) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 26218e5..60d9017 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2365,6 +2365,7 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSBlockedListPtr blist = (FSBlockedListPtr) blockrec->data; > fsListFontsReply *rep; > char *data; > + long dataleft; /* length of reply left to use */ Same here. long dataleft = 0; > int length, > i, > ret; > @@ -2382,16 +2383,30 @@ fs_read_list(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > return AllocError; > } > data = (char *) rep + SIZEOF (fsListFontsReply); > + dataleft = (rep->length << 2) - SIZEOF (fsListFontsReply); > > err = Successful; > /* copy data into FontPathRecord */ > for (i = 0; i < rep->nFonts; i++) > { > + if (dataleft < 1) > + break; Just as a heads-up: I would have moved this into the for loop condition like so: for (i = 0; (i < rep->nFonts) && (dataleft > 0); i++) to make clear, that it's really part of the looping condition. The current patch as provided by upstream is functionally equivalent and OK, though. Everything else in the patch looks good.

5 5

Bug#790: Add language chooser to X2GoClient
by Mihai Moldovan 16 Feb '15

16 Feb '15

package: x2goclient severity: wishlist On local desktops, the login manager allows users to choose a GUI language. X2GoClient, which is basically our login manager replacement (even in non-TCE mode) lacks such an option. Since we offer an option to switch the keyboard layout, a similar option to switch the GUI language (and maybe additionally automatically also the timezone) would be nice.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 51/52: glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3)
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 9c558f9ca2c0d4e34fa71dff272ed1c39c22cd9d > Author: Adam Jackson <ajax(a)redhat.com> > Date: Mon Nov 10 12:13:43 2014 -0500 > > glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3) > > This is a half-measure until we start passing request length into the > varsize function, but it's better than the nothing we had before. > > v2: Verify that there's at least a large render header's worth of > dataBytes (Julien Cristau) > > v3: backport to RHEL5 > > v4: backport to nx-libs 3.6.x (Mike DePaulo) > > Reviewed-by: Michal Srb <msrb(a)suse.com> > Reviewed-by: Andy Ritger <aritger(a)nvidia.com> > Signed-off-by: Adam Jackson <ajax(a)redhat.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Signed-off-by: Fedora X Ninjas <x(a)fedoraproject.org> > Signed-off-by: Dave Airlie <airlied(a)redhat.com> > > fixup swap > --- > nx-X11/programs/Xserver/GL/glx/glxcmds.c | 58 +++++++++++++++---------- > nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c | 59 ++++++++++++++++---------- > 2 files changed, 71 insertions(+), 46 deletions(-) > > diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmds.c b/nx-X11/programs/Xserver/GL/glx/glxcmds.c > index 831c65b..20c12f3 100644 > --- a/nx-X11/programs/Xserver/GL/glx/glxcmds.c > +++ b/nx-X11/programs/Xserver/GL/glx/glxcmds.c > @@ -1535,6 +1535,8 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** duplicated there. > */ > > + REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); > + > req = (xGLXRenderLargeReq *) pc; > glxc = __glXForceCurrent(cl, req->contextTag, &error); > if (!glxc) { > @@ -1542,12 +1544,15 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > __glXResetLargeCommandStatus(cl); > return error; > } > + if (safe_pad(req->dataBytes) < 0) > + return BadLength; > + > dataBytes = req->dataBytes; > > /* > ** Check the request length. > */ > - if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { > + if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { > client->errorValue = req->length; > /* Reset in case this isn't 1st request. */ > __glXResetLargeCommandStatus(cl); > @@ -1557,7 +1562,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > > if (cl->largeCmdRequestsSoFar == 0) { > __GLXrenderSizeData *entry; > - int extra, cmdlen; > + int extra = 0, cmdlen; > /* > ** This is the first request of a multi request command. > ** Make enough space in the buffer, then copy the entire request. > @@ -1567,9 +1572,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > return __glXBadLargeRequest; > } > > + if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) > + return BadLength; > + > hdr = (__GLXrenderLargeHeader *) pc; > - cmdlen = hdr->length; > opcode = hdr->opcode; > + if ((cmdlen = safe_pad(hdr->length)) < 0) > + return BadLength; > > /* > ** Check for core opcodes and grab entry data. > @@ -1603,16 +1612,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > if (extra < 0) { > return BadLength; > } > - /* large command's header is 4 bytes longer, so add 4 */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4 + extra)) { > - return BadLength; > - } > - } else { > - /* constant size command */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4)) { > - return BadLength; > - } > } > + > + /* the +4 is safe because we know entry.bytes is small */ > + if (cmdlen != safe_pad(safe_add(entry->bytes + 4, extra))) { > + return BadLength; > + } > + > /* > ** Make enough space in the buffer, then copy the entire request. > */ > @@ -1641,6 +1647,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** We are receiving subsequent (i.e. not the first) requests of a > ** multi request command. > */ > + int bytesSoFar; /* including this packet */ > > /* > ** Check the request number and the total request count. > @@ -1659,7 +1666,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > /* > ** Check that we didn't get too much data. > */ > - if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { > + if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { > + client->errorValue = dataBytes; > + __glXResetLargeCommandStatus(cl); > + return __glXBadLargeRequest; > + } > + > + if (bytesSoFar > cl->largeCmdBytesTotal) { > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > @@ -1673,17 +1686,16 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** This is the last request; it must have enough bytes to complete > ** the command. > */ > - /* NOTE: the two pad macros have been added below; they are needed > - ** because the client library pads the total byte count, but not > - ** the per-request byte counts. The Protocol Encoding says the > - ** total byte count should not be padded, so a proposal will be > - ** made to the ARB to relax the padding constraint on the total > - ** byte count, thus preserving backward compatibility. Meanwhile, > - ** the padding done below fixes a bug that did not allow > - ** large commands of odd sizes to be accepted by the server. > + /* NOTE: the pad macro below is needed because the client library > + ** pads the total byte count, but not the per-request byte counts. > + ** The Protocol Encoding says the total byte count should not be > + ** padded, so a proposal will be made to the ARB to relax the > + ** padding constraint on the total byte count, thus preserving > + ** backward compatibility. Meanwhile, the padding done below > + ** fixes a bug that did not allow large commands of odd sizes to > + ** be accepted by the server. > */ > - if (__GLX_PAD(cl->largeCmdBytesSoFar) != > - __GLX_PAD(cl->largeCmdBytesTotal)) { > + if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { cl->largeCmdBytesTotal is not wrapped in safe_pad(). This looks odd and could be a mistake. > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > index 2685355..2e228c0 100644 > --- a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > +++ b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > @@ -587,6 +587,8 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** duplicated there. > */ > > + REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); > + > req = (xGLXRenderLargeReq *) pc; > __GLX_SWAP_SHORT(&req->length); > __GLX_SWAP_INT(&req->contextTag); > @@ -599,12 +601,15 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > __glXResetLargeCommandStatus(cl); > return error; > } > + if (safe_pad(req->dataBytes) < 0) > + return BadLength; > + > dataBytes = req->dataBytes; > > /* > ** Check the request length. > */ > - if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { > + if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { > client->errorValue = req->length; > /* Reset in case this isn't 1st request. */ > __glXResetLargeCommandStatus(cl); > @@ -614,7 +619,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > > if (cl->largeCmdRequestsSoFar == 0) { > __GLXrenderSizeData *entry; > - int extra; > + int extra = 0; > size_t cmdlen; > /* > ** This is the first request of a multi request command. > @@ -624,12 +629,17 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > client->errorValue = req->requestNumber; > return __glXBadLargeRequest; > } > + if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) > + return BadLength; > + > hdr = (__GLXrenderLargeHeader *) pc; > __GLX_SWAP_INT(&hdr->length); > __GLX_SWAP_INT(&hdr->opcode); > - cmdlen = hdr->length; > opcode = hdr->opcode; > > + if ((cmdlen = safe_pad(hdr->length)) < 0) > + return BadLength; > + > if ( (opcode >= __GLX_MIN_RENDER_OPCODE) && > (opcode <= __GLX_MAX_RENDER_OPCODE) ) { > entry = &__glXRenderSizeTable[opcode]; > @@ -661,16 +671,12 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > if (extra < 0) { > return BadLength; > } > - /* large command's header is 4 bytes longer, so add 4 */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4 + extra)) { > - return BadLength; > - } > - } else { > - /* constant size command */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4)) { > - return BadLength; > - } > } > + /* the +4 is safe because we know entry->bytes is small */ > + if (cmdlen != safe_pad(safe_add(entry->bytes + 4, extra))) { > + return BadLength; > + } > + > /* > ** Make enough space in the buffer, then copy the entire request. > */ > @@ -698,6 +704,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** We are receiving subsequent (i.e. not the first) requests of a > ** multi request command. > */ > + int bytesSoFar; /* including this packet */ > > /* > ** Check the request number and the total request count. > @@ -716,7 +723,13 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > /* > ** Check that we didn't get too much data. > */ > - if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { > + if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { > + client->errorValue = dataBytes; > + __glXResetLargeCommandStatus(cl); > + return __glXBadLargeRequest; > + } > + > + if (bytesSoFar > cl->largeCmdBytesTotal) { > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > @@ -730,17 +743,17 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** This is the last request; it must have enough bytes to complete > ** the command. > */ > - /* NOTE: the two pad macros have been added below; they are needed > - ** because the client library pads the total byte count, but not > - ** the per-request byte counts. The Protocol Encoding says the > - ** total byte count should not be padded, so a proposal will be > - ** made to the ARB to relax the padding constraint on the total > - ** byte count, thus preserving backward compatibility. Meanwhile, > - ** the padding done below fixes a bug that did not allow > - ** large commands of odd sizes to be accepted by the server. > + /* NOTE: the pad macro below is needed because the client library > + ** pads the total byte count, but not the per-request byte counts. > + ** The Protocol Encoding says the total byte count should not be > + ** padded, so a proposal will be made to the ARB to relax the > + ** padding constraint on the total byte count, thus preserving > + ** backward compatibility. Meanwhile, the padding done below > + ** fixes a bug that did not allow large commands of odd sizes to > + ** be accepted by the server. > */ > - if (__GLX_PAD(cl->largeCmdBytesSoFar) != > - __GLX_PAD(cl->largeCmdBytesTotal)) { > + > + if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { Similarly not wrapped in safe_pad() here. Not sure whether this happened on purpose or is an error.

2 1

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 13/52: LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit af55da1e9c1a6a352b24823a8f7062c288ffbbc0 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 19:15:20 2015 -0500 > > LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0 > > Specially crafted LZW stream can crash an application using libXfont > that is used to open untrusted font files. With X server, this may > allow privilege escalation when exploited > --- > nx-X11/lib/font/fontfile/decompress.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/nx-X11/lib/font/fontfile/decompress.c b/nx-X11/lib/font/fontfile/decompress.c > index a4c5468..553b315 100644 > --- a/nx-X11/lib/font/fontfile/decompress.c > +++ b/nx-X11/lib/font/fontfile/decompress.c > @@ -261,6 +261,8 @@ BufCompressedFill (BufFilePtr f) > */ > while ( code >= 256 ) > { > + if (stackp - de_stack >= STACK_SIZE - 1) > + return BUFFILEEOF; Personally, I would have written that as if ((stackp - de_stack) >= (STACK_SIZE - 1)) But that's my personal style and I like to over-parenthesis.

2 5

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 19/52: CVE-2014-0210: unvalidated length in _fs_recv_conn_setup() from xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 94c6de0649cd295044b1e4ff7265949c9c787519 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 21:03:33 2015 -0500 > > CVE-2014-0210: unvalidated length in _fs_recv_conn_setup() from xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d > > The connection setup reply from the font server can include a list > of alternate servers to contact if this font server stops working. > > The reply specifies a total size of all the font server names, and > then provides a list of names. _fs_recv_conn_setup() allocated the > specified total size for copying the names to, but didn't check to > make sure it wasn't copying more data to that buffer than the size > it had allocated. > --- > nx-X11/lib/font/fc/fserve.c | 21 ++++++++++++++++++--- > 1 file changed, 18 insertions(+), 3 deletions(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index bac0b8e..0fdcc1d 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2782,7 +2782,7 @@ _fs_recv_conn_setup (FSFpePtr conn) > int ret; > fsConnSetup *setup; > FSFpeAltPtr alts; > - int i, alt_len; > + unsigned int i, alt_len; > int setup_len; > char *alt_save, *alt_names; > > @@ -2809,9 +2809,9 @@ _fs_recv_conn_setup (FSFpePtr conn) > } > if (setup->num_alternates) > { > + size_t alt_name_len = setup->alternate_len << 2; > alts = (FSFpeAltPtr) xalloc (setup->num_alternates * > - sizeof (FSFpeAltRec) + > - (setup->alternate_len << 2)); > + sizeof (FSFpeAltRec) + alt_name_len); > if (alts) > { > alt_names = (char *) (setup + 1); > @@ -2820,10 +2820,25 @@ _fs_recv_conn_setup (FSFpePtr conn) > { > alts[i].subset = alt_names[0]; > alt_len = alt_names[1]; > + if (alt_len >= alt_name_len) { > + /* > + * Length is longer than setup->alternate_len > + * told us to allocate room for, assume entire > + * alternate list is corrupted. > + */ > +#ifdef DEBUG > + fprintf (stderr, > + "invalid alt list (length %lx >= %lx)\n", > + (long) alt_len, (long) alt_name_len); > +#endif > + free(alts); Shouldn't this be xfree(alts) if using xalloc previously?

2 3

← Newer
1
...
12
13
14
15
16
17
18
...
21
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev February 2015