x2go-dev

x2go-dev@lists.x2go.org

2 participants
5403 discussions

Bug#790: Add language chooser to X2GoClient
by Mihai Moldovan 16 Feb '15

16 Feb '15

package: x2goclient severity: wishlist On local desktops, the login manager allows users to choose a GUI language. X2GoClient, which is basically our login manager replacement (even in non-TCE mode) lacks such an option. Since we offer an option to switch the keyboard layout, a similar option to switch the GUI language (and maybe additionally automatically also the timezone) would be nice.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 51/52: glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3)
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 9c558f9ca2c0d4e34fa71dff272ed1c39c22cd9d > Author: Adam Jackson <ajax(a)redhat.com> > Date: Mon Nov 10 12:13:43 2014 -0500 > > glx: Length checking for RenderLarge requests (v2) [CVE-2014-8098 3/8] (v3) > > This is a half-measure until we start passing request length into the > varsize function, but it's better than the nothing we had before. > > v2: Verify that there's at least a large render header's worth of > dataBytes (Julien Cristau) > > v3: backport to RHEL5 > > v4: backport to nx-libs 3.6.x (Mike DePaulo) > > Reviewed-by: Michal Srb <msrb(a)suse.com> > Reviewed-by: Andy Ritger <aritger(a)nvidia.com> > Signed-off-by: Adam Jackson <ajax(a)redhat.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Signed-off-by: Fedora X Ninjas <x(a)fedoraproject.org> > Signed-off-by: Dave Airlie <airlied(a)redhat.com> > > fixup swap > --- > nx-X11/programs/Xserver/GL/glx/glxcmds.c | 58 +++++++++++++++---------- > nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c | 59 ++++++++++++++++---------- > 2 files changed, 71 insertions(+), 46 deletions(-) > > diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmds.c b/nx-X11/programs/Xserver/GL/glx/glxcmds.c > index 831c65b..20c12f3 100644 > --- a/nx-X11/programs/Xserver/GL/glx/glxcmds.c > +++ b/nx-X11/programs/Xserver/GL/glx/glxcmds.c > @@ -1535,6 +1535,8 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** duplicated there. > */ > > + REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); > + > req = (xGLXRenderLargeReq *) pc; > glxc = __glXForceCurrent(cl, req->contextTag, &error); > if (!glxc) { > @@ -1542,12 +1544,15 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > __glXResetLargeCommandStatus(cl); > return error; > } > + if (safe_pad(req->dataBytes) < 0) > + return BadLength; > + > dataBytes = req->dataBytes; > > /* > ** Check the request length. > */ > - if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { > + if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { > client->errorValue = req->length; > /* Reset in case this isn't 1st request. */ > __glXResetLargeCommandStatus(cl); > @@ -1557,7 +1562,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > > if (cl->largeCmdRequestsSoFar == 0) { > __GLXrenderSizeData *entry; > - int extra, cmdlen; > + int extra = 0, cmdlen; > /* > ** This is the first request of a multi request command. > ** Make enough space in the buffer, then copy the entire request. > @@ -1567,9 +1572,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > return __glXBadLargeRequest; > } > > + if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) > + return BadLength; > + > hdr = (__GLXrenderLargeHeader *) pc; > - cmdlen = hdr->length; > opcode = hdr->opcode; > + if ((cmdlen = safe_pad(hdr->length)) < 0) > + return BadLength; > > /* > ** Check for core opcodes and grab entry data. > @@ -1603,16 +1612,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > if (extra < 0) { > return BadLength; > } > - /* large command's header is 4 bytes longer, so add 4 */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4 + extra)) { > - return BadLength; > - } > - } else { > - /* constant size command */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4)) { > - return BadLength; > - } > } > + > + /* the +4 is safe because we know entry.bytes is small */ > + if (cmdlen != safe_pad(safe_add(entry->bytes + 4, extra))) { > + return BadLength; > + } > + > /* > ** Make enough space in the buffer, then copy the entire request. > */ > @@ -1641,6 +1647,7 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** We are receiving subsequent (i.e. not the first) requests of a > ** multi request command. > */ > + int bytesSoFar; /* including this packet */ > > /* > ** Check the request number and the total request count. > @@ -1659,7 +1666,13 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > /* > ** Check that we didn't get too much data. > */ > - if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { > + if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { > + client->errorValue = dataBytes; > + __glXResetLargeCommandStatus(cl); > + return __glXBadLargeRequest; > + } > + > + if (bytesSoFar > cl->largeCmdBytesTotal) { > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > @@ -1673,17 +1686,16 @@ int __glXRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** This is the last request; it must have enough bytes to complete > ** the command. > */ > - /* NOTE: the two pad macros have been added below; they are needed > - ** because the client library pads the total byte count, but not > - ** the per-request byte counts. The Protocol Encoding says the > - ** total byte count should not be padded, so a proposal will be > - ** made to the ARB to relax the padding constraint on the total > - ** byte count, thus preserving backward compatibility. Meanwhile, > - ** the padding done below fixes a bug that did not allow > - ** large commands of odd sizes to be accepted by the server. > + /* NOTE: the pad macro below is needed because the client library > + ** pads the total byte count, but not the per-request byte counts. > + ** The Protocol Encoding says the total byte count should not be > + ** padded, so a proposal will be made to the ARB to relax the > + ** padding constraint on the total byte count, thus preserving > + ** backward compatibility. Meanwhile, the padding done below > + ** fixes a bug that did not allow large commands of odd sizes to > + ** be accepted by the server. > */ > - if (__GLX_PAD(cl->largeCmdBytesSoFar) != > - __GLX_PAD(cl->largeCmdBytesTotal)) { > + if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { cl->largeCmdBytesTotal is not wrapped in safe_pad(). This looks odd and could be a mistake. > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > diff --git a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > index 2685355..2e228c0 100644 > --- a/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > +++ b/nx-X11/programs/Xserver/GL/glx/glxcmdsswap.c > @@ -587,6 +587,8 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** duplicated there. > */ > > + REQUEST_AT_LEAST_SIZE(xGLXRenderLargeReq); > + > req = (xGLXRenderLargeReq *) pc; > __GLX_SWAP_SHORT(&req->length); > __GLX_SWAP_INT(&req->contextTag); > @@ -599,12 +601,15 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > __glXResetLargeCommandStatus(cl); > return error; > } > + if (safe_pad(req->dataBytes) < 0) > + return BadLength; > + > dataBytes = req->dataBytes; > > /* > ** Check the request length. > */ > - if ((req->length << 2) != __GLX_PAD(dataBytes) + sz_xGLXRenderLargeReq) { > + if ((req->length << 2) != safe_pad(dataBytes) + sz_xGLXRenderLargeReq) { > client->errorValue = req->length; > /* Reset in case this isn't 1st request. */ > __glXResetLargeCommandStatus(cl); > @@ -614,7 +619,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > > if (cl->largeCmdRequestsSoFar == 0) { > __GLXrenderSizeData *entry; > - int extra; > + int extra = 0; > size_t cmdlen; > /* > ** This is the first request of a multi request command. > @@ -624,12 +629,17 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > client->errorValue = req->requestNumber; > return __glXBadLargeRequest; > } > + if (dataBytes < __GLX_RENDER_LARGE_HDR_SIZE) > + return BadLength; > + > hdr = (__GLXrenderLargeHeader *) pc; > __GLX_SWAP_INT(&hdr->length); > __GLX_SWAP_INT(&hdr->opcode); > - cmdlen = hdr->length; > opcode = hdr->opcode; > > + if ((cmdlen = safe_pad(hdr->length)) < 0) > + return BadLength; > + > if ( (opcode >= __GLX_MIN_RENDER_OPCODE) && > (opcode <= __GLX_MAX_RENDER_OPCODE) ) { > entry = &__glXRenderSizeTable[opcode]; > @@ -661,16 +671,12 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > if (extra < 0) { > return BadLength; > } > - /* large command's header is 4 bytes longer, so add 4 */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4 + extra)) { > - return BadLength; > - } > - } else { > - /* constant size command */ > - if (cmdlen != __GLX_PAD(entry->bytes + 4)) { > - return BadLength; > - } > } > + /* the +4 is safe because we know entry->bytes is small */ > + if (cmdlen != safe_pad(safe_add(entry->bytes + 4, extra))) { > + return BadLength; > + } > + > /* > ** Make enough space in the buffer, then copy the entire request. > */ > @@ -698,6 +704,7 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** We are receiving subsequent (i.e. not the first) requests of a > ** multi request command. > */ > + int bytesSoFar; /* including this packet */ > > /* > ** Check the request number and the total request count. > @@ -716,7 +723,13 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > /* > ** Check that we didn't get too much data. > */ > - if ((cl->largeCmdBytesSoFar + dataBytes) > cl->largeCmdBytesTotal) { > + if ((bytesSoFar = safe_add(cl->largeCmdBytesSoFar, dataBytes)) < 0) { > + client->errorValue = dataBytes; > + __glXResetLargeCommandStatus(cl); > + return __glXBadLargeRequest; > + } > + > + if (bytesSoFar > cl->largeCmdBytesTotal) { > client->errorValue = dataBytes; > __glXResetLargeCommandStatus(cl); > return __glXBadLargeRequest; > @@ -730,17 +743,17 @@ int __glXSwapRenderLarge(__GLXclientState *cl, GLbyte *pc) > ** This is the last request; it must have enough bytes to complete > ** the command. > */ > - /* NOTE: the two pad macros have been added below; they are needed > - ** because the client library pads the total byte count, but not > - ** the per-request byte counts. The Protocol Encoding says the > - ** total byte count should not be padded, so a proposal will be > - ** made to the ARB to relax the padding constraint on the total > - ** byte count, thus preserving backward compatibility. Meanwhile, > - ** the padding done below fixes a bug that did not allow > - ** large commands of odd sizes to be accepted by the server. > + /* NOTE: the pad macro below is needed because the client library > + ** pads the total byte count, but not the per-request byte counts. > + ** The Protocol Encoding says the total byte count should not be > + ** padded, so a proposal will be made to the ARB to relax the > + ** padding constraint on the total byte count, thus preserving > + ** backward compatibility. Meanwhile, the padding done below > + ** fixes a bug that did not allow large commands of odd sizes to > + ** be accepted by the server. > */ > - if (__GLX_PAD(cl->largeCmdBytesSoFar) != > - __GLX_PAD(cl->largeCmdBytesTotal)) { > + > + if (safe_pad(cl->largeCmdBytesSoFar) != cl->largeCmdBytesTotal) { Similarly not wrapped in safe_pad() here. Not sure whether this happened on purpose or is an error.

2 1

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 13/52: LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit af55da1e9c1a6a352b24823a8f7062c288ffbbc0 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 19:15:20 2015 -0500 > > LZW decompress: fix for CVE-2011-2895 From xorg/lib/Xfont commit d11ee5886e9d9ec610051a206b135a4cdc1e09a0 > > Specially crafted LZW stream can crash an application using libXfont > that is used to open untrusted font files. With X server, this may > allow privilege escalation when exploited > --- > nx-X11/lib/font/fontfile/decompress.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/nx-X11/lib/font/fontfile/decompress.c b/nx-X11/lib/font/fontfile/decompress.c > index a4c5468..553b315 100644 > --- a/nx-X11/lib/font/fontfile/decompress.c > +++ b/nx-X11/lib/font/fontfile/decompress.c > @@ -261,6 +261,8 @@ BufCompressedFill (BufFilePtr f) > */ > while ( code >= 256 ) > { > + if (stackp - de_stack >= STACK_SIZE - 1) > + return BUFFILEEOF; Personally, I would have written that as if ((stackp - de_stack) >= (STACK_SIZE - 1)) But that's my personal style and I like to over-parenthesis.

2 5

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 19/52: CVE-2014-0210: unvalidated length in _fs_recv_conn_setup() from xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 94c6de0649cd295044b1e4ff7265949c9c787519 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 21:03:33 2015 -0500 > > CVE-2014-0210: unvalidated length in _fs_recv_conn_setup() from xorg/lib/libXfont commit 891e084b26837162b12f841060086a105edde86d > > The connection setup reply from the font server can include a list > of alternate servers to contact if this font server stops working. > > The reply specifies a total size of all the font server names, and > then provides a list of names. _fs_recv_conn_setup() allocated the > specified total size for copying the names to, but didn't check to > make sure it wasn't copying more data to that buffer than the size > it had allocated. > --- > nx-X11/lib/font/fc/fserve.c | 21 ++++++++++++++++++--- > 1 file changed, 18 insertions(+), 3 deletions(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index bac0b8e..0fdcc1d 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2782,7 +2782,7 @@ _fs_recv_conn_setup (FSFpePtr conn) > int ret; > fsConnSetup *setup; > FSFpeAltPtr alts; > - int i, alt_len; > + unsigned int i, alt_len; > int setup_len; > char *alt_save, *alt_names; > > @@ -2809,9 +2809,9 @@ _fs_recv_conn_setup (FSFpePtr conn) > } > if (setup->num_alternates) > { > + size_t alt_name_len = setup->alternate_len << 2; > alts = (FSFpeAltPtr) xalloc (setup->num_alternates * > - sizeof (FSFpeAltRec) + > - (setup->alternate_len << 2)); > + sizeof (FSFpeAltRec) + alt_name_len); > if (alts) > { > alt_names = (char *) (setup + 1); > @@ -2820,10 +2820,25 @@ _fs_recv_conn_setup (FSFpePtr conn) > { > alts[i].subset = alt_names[0]; > alt_len = alt_names[1]; > + if (alt_len >= alt_name_len) { > + /* > + * Length is longer than setup->alternate_len > + * told us to allocate room for, assume entire > + * alternate list is corrupted. > + */ > +#ifdef DEBUG > + fprintf (stderr, > + "invalid alt list (length %lx >= %lx)\n", > + (long) alt_len, (long) alt_name_len); > +#endif > + free(alts); Shouldn't this be xfree(alts) if using xalloc previously?

2 3

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 23/52: CVE-2014-0210: unvalidated length fields in fs_read_query_info() from xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit c6aebf9284855a0e24ad9c5ffdd36aa65e16bec7 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:08:09 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_query_info() from xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f > > fs_read_query_info() parses a reply from the font server. The reply > contains embedded length fields, none of which are validated. This > can cause out of bound reads in either fs_read_query_info() or in > _fs_convert_props() which it calls to parse the fsPropInfo in the reply. > --- > nx-X11/lib/font/fc/fsconvert.c | 19 ++++++++++++++----- > nx-X11/lib/font/fc/fserve.c | 40 ++++++++++++++++++++++++++++++++++++++-- > 2 files changed, 52 insertions(+), 7 deletions(-) > > [...] > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 7762653..2a6f6c9 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -865,6 +865,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSFpePtr conn = (FSFpePtr) fpe->private; > fsQueryXInfoReply *rep; > char *buf; > + long bufleft; /* length of reply left to use */ Please initialize variables. Even if they are re-set later on. long bufleft = 0; > fsPropInfo *pi; > fsPropOffset *po; > pointer pd; > @@ -895,7 +896,10 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > > buf = (char *) rep; > buf += SIZEOF(fsQueryXInfoReply); > - > + > + bufleft = rep->length << 2; > + bufleft -= SIZEOF(fsQueryXInfoReply); > + > /* move the data over */ > fsUnpack_XFontInfoHeader(rep, pInfo); > > @@ -903,19 +907,51 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > _fs_init_fontinfo(conn, pInfo); > > /* Compute offsets into the reply */ > + if (bufleft < SIZEOF(fsPropInfo)) > + { > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, "fsQueryXInfo: bufleft (%ld) < SIZEOF(fsPropInfo)\n", > + bufleft); > +#endif > + goto bail; > + } > pi = (fsPropInfo *) buf; > buf += SIZEOF (fsPropInfo); > + bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); This looks wrong. You probably meant to use: bufleft -= SIZEOF (fsPropInfo); > + if (bufleft < pi->data_len) This looks wrong, too. Check: https://git.centos.org/blob/rpms!libXfont.git/cf1e18c13a5ba2054e36a6f0b044c… You probably meant to use: if ((bufleft / SIZEOF(fsPropOffset)) < pi->num_offsets) or if (bufleft < (SIZEOF(fsPropOffset) * pi->num_offsets)) and > + { > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, > + "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", > + bufleft, pi->data_len); here either: "fsQueryXInfo: (bufleft / SIZEOF(fsPropOffset)) (%ld) < pi->num_offsets (%d)\n", bufleft / SIZEOF(fsPropOffset), pi->num_offsets); or "fsQueryXInfo: bufleft (%ld) < (SIZEOF(fsPropOffset) * pi->num_offsets) (%d)\n", bufleft, SIZEOF(fsPropOffset) * pi->num_offsets); depending on what you used before. > +#endif > + goto bail; > + } > po = (fsPropOffset *) buf; > buf += pi->num_offsets * SIZEOF(fsPropOffset); > + bufleft -= pi->data_len; Same problem here. Should be: bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); > + { This block will ALWAYS be executed and ALWAYS *FAIL*! You're missing (*before* the curly brace): if (bufleft < pi->data_len) > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, > + "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", > + bufleft, pi->data_len); > +#endif > + goto bail; > + } > pd = (pointer) buf; > buf += pi->data_len; > + bufleft -= pi->data_len; > > /* convert the properties and step over the reply */ > ret = _fs_convert_props(pi, po, pd, pInfo); > + bail: > _fs_done_read (conn, rep->length << 2); > - > + > if (ret == -1) > { > fs_cleanup_bfont (bfont); This looks OK again.

2 4

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 12/52: Move COPYING.full+lite as COPYING to /
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 902dc519d96be582088e5fe0644cefac7ecc0133 > Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> > Date: Sat Feb 14 15:58:11 2015 +0100 > > Move COPYING.full+lite as COPYING to / > > Adapted packaging scripts: > > debian/roll-tarballs.sh > nx-libs.spec > --- > debian/COPYING.full+lite => COPYING | 0 > debian/roll-tarballs.sh | 1 - > nx-libs.spec | 11 +++++++---- > 3 files changed, 7 insertions(+), 5 deletions(-) > > diff --git a/debian/COPYING.full+lite b/COPYING > similarity index 100% > rename from debian/COPYING.full+lite > rename to COPYING > diff --git a/debian/roll-tarballs.sh b/debian/roll-tarballs.sh > index fcb8367..c7cac5f 100755 > --- a/debian/roll-tarballs.sh > +++ b/debian/roll-tarballs.sh > @@ -96,7 +96,6 @@ else > echo ${file##*/} >> doc/applied-patches/series > done > fi > -cp -v debian/COPYING.full+lite COPYING > > # apply all patches shipped in debian/patches and create a copy of them that we ship with the tarball > if [ -s "doc/applied-patches/series" ]; then > diff --git a/nx-libs.spec b/nx-libs.spec > index 5c1064f..f4084d9 100644 > --- a/nx-libs.spec > +++ b/nx-libs.spec > @@ -768,7 +768,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files > %defattr(-,root,root) > -%doc nx-X11/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nx-X11/README Have you removed LICENSE by accident or was that intended? > %dir %{_libdir}/nx > %dir %{_libdir}/nx/X11 > %dir %{_datadir}/nx > @@ -913,7 +914,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcomp3 > %defattr(-,root,root) > -%doc nxcomp/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nxcomp/README Same here. > %_libdir/libXcomp.so.3* > > %files -n libXcompext-devel > @@ -924,7 +926,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcompext3 > %defattr(-,root,root) > -%doc nxcompext/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nxcompext/README Same here. > %_libdir/libXcompext.so.3* > > %files -n libXcompshad-devel > @@ -944,7 +947,7 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcompshad3 > %defattr(-,root,root) > -%doc nxcompshad/{COPYING,LICENSE} > +%doc COPYING Same here.

3 4

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 32/52: dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit d4c76981f7fddb364166464c571ed8d3de3086cd > Author: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Date: Mon Jan 6 23:30:14 2014 -0800 > > dix: integer overflow in GetHosts() [CVE-2014-8092 2/4] > > GetHosts() iterates over all the hosts it has in memory, and copies > them to a buffer. The buffer length is calculated by iterating over > all the hosts and adding up all of their combined length. There is a > potential integer overflow, if there are lots and lots of hosts (with > a combined length of > ~4 gig). This should be possible by repeatedly > calling ProcChangeHosts() on 64bit machines with enough memory. > > This patch caps the list at 1mb, because multi-megabyte hostname > lists for X access control are insane. > > v2: backport to nx-libs 3.6.x (Mike DePaulo) > Reported-by: Ilja Van Sprundel <ivansprundel(a)ioactive.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Reviewed-by: Peter Hutterer <peter.hutterer(a)who-t.net> > > Conflicts: > os/access.c > --- > nx-X11/programs/Xserver/os/access.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/nx-X11/programs/Xserver/os/access.c b/nx-X11/programs/Xserver/os/access.c > index b6a70a7..0e9d138 100644 > --- a/nx-X11/programs/Xserver/os/access.c > +++ b/nx-X11/programs/Xserver/os/access.c > @@ -1719,6 +1719,10 @@ GetHosts ( > { > nHosts++; > n += (((host->len + 3) >> 2) << 2) + sizeof(xHostEntry); > + /* Could check for INT_MAX, but in reality having more than 1mb of > + hostnames in the access list is ridiculous */ > + if (n >= 1048576) Not an error: I'd change the number "1048576" to "1024*1024", because "1048576" is not easily recognized as 1 MB while the latter is more clear (and the compiler statically optimizes it at compile/preprocessing time anyway.) if (n >= 1024*1024) Everything else looks fine.

1 1

Where can I download the NXagent source code?
by Chernousov Anton 16 Feb '15

16 Feb '15

Hi! I trying to compile from source x2goserver and can't find GIT repository for nxagent. Please tell me where it is. :) Thank you for your assistance. ================ *Chernousov Anton.* E-mail: anton(a)th22.ru Skype: anton10146 Web: http://th22.ru

2 1

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 01/01: Fix FTBFS due to the nxproxy executable already existing under /usr/lib/nx/bin/nx
by Mike Gabriel 16 Feb '15

16 Feb '15

HI Michael, On Sa 14 Feb 2015 23:07:49 CET, git-admin wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.5.0.x > in repository nx-libs. > > commit 7b0c8a2acdb866f23c0569b4ba549e9e8c94428e > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sat Feb 14 17:07:21 2015 -0500 > > Fix FTBFS due to the nxproxy executable already existing under > /usr/lib/nx/bin/nx > --- > debian/Makefile.nx-libs | 2 -- > debian/changelog | 2 ++ > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/debian/Makefile.nx-libs b/debian/Makefile.nx-libs > index 3aeda73..52326fb 100644 > --- a/debian/Makefile.nx-libs > +++ b/debian/Makefile.nx-libs > @@ -62,8 +62,6 @@ install-lite: > $(INSTALL_DIR) $(DESTDIR)$(BINDIR) > for d in nxcomp nxproxy; do \ > $(MAKE) -C $$d install; done > - mkdir -p $(DESTDIR)$(NXLIBDIR)/bin/ > - mv $(DESTDIR)$(BINDIR)/nxproxy $(DESTDIR)$(NXLIBDIR)/bin/ > for f in nxproxy; do \ > $(INSTALL_PROGRAM) bin/$$f $(DESTDIR)$(BINDIR); done > For the record: o this fixes builds for all jobs on jenkins.x2go.org o it fixes the .deb packages o it breaks the .rpm packages (the ELF executable is missing in /usr/lib/nx/bin/nxproxy, whereas /usr/bin/nxproxy is only the wrapper script). /me is taking a deeper look at the different behaviours of debian/rules and nx-libs.spec at build time. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] branch 3.6.x updated (1fd8551 -> 1ea1cd8)
by Mihai Moldovan 16 Feb '15

16 Feb '15

Everything not mentioned looks either fine or rather passes basic sanity and plausibility checks.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev