<html>
<head>
</head>
<body>Hello Mike,<br>
<br>
when I look at nx-libs it seems that nomachine once copied a lot of xorg packages added the nx part and afterwards the xorg libraries were never updated.<br>
<br>
In the last year a lot of security relevant errors were discovered and fixed in the x-server code. What is the policy of the x2go project? Do you want to rebase the nx-libs package on current xorg code? Do you plan to support Wayland which will be replacing x11?<br>
<br>
Best regards<br>
<br>
Heinrich Schuchardt<br>
<br>
<a href="http://www.xypron.de">http://www.xypron.de</a><br><br><div class="gmail_quote"><br>
<br>
Mike Gabriel <mike.gabriel@das-netzwerkteam.de>schrieb:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hi Heinrich,<br/>
<br/>
On Fr 30 Jan 2015 20:29:51 CET, Heinrich Schuchardt wrote:<br/>
<br/>
> package: nx-libs<br/>
> version: head<br/>
><br/>
><br/>
> In nx-libs/nx-X11/extras/Mesa/src/glx/x11/glxextensions.c<br/>
> the length of the zeroed memory is the length of the pointer (4 bytes in<br/>
> case of a 32bit system) not the length of the data the pointer points to<br/>
> (8 byte).<br/>
><br/>
> static void<br/>
> __glXProcessServerString( const struct extension_info * ext,<br/>
> const char * server_string,<br/>
> unsigned char * server_support )<br/>
> {<br/>
> unsigned base;<br/>
> unsigned len;<br/>
><br/>
> (void) memset( server_support, 0, sizeof( server_support ) );<br/>
><br/>
> Furthermore the length of the memory area pointed to by server_support<br/>
> is defined in varying ways in the coding:<br/>
><br/>
> #define __GL_EXT_BYTES ((__NUM_GL_EXTS + 7) / 8)<br/>
><br/>
><br/>
> unsigned char server_support[ __GL_EXT_BYTES ];<br/>
> unsigned char server_support[8];<br/>
><br/>
> Currently __NUM_GL_EXTS = 123, so __GL_EXT_BYTES = 8.<br/>
><br/>
> What is expected to happen if __GL_EXT_BYTES > 8 after defining six more<br/>
> values in the unamed (sic!) enum with the different bits?<br/>
><br/>
> This questionable code was identified with cppcheck.<br/>
><a href="http://cppcheck.sourceforge.net/" target="_blank"> http://cppcheck.sourceforge.net/</a><br/>
><br/>
> Best regards<br/>
><br/>
> Heinrich Schuchardt<br/>
<br/>
Now that you have analyzed it, do you see a chance for coming up with patch?<br/>
<br/>
THANKS+GREETS,<br/>
Mike<br/>
<br/>
<br/>
--<br/>
<br/>
DAS-NETZWERKTEAM<br/>
mike gabriel, herweg 7, 24357 fleckeby<br/>
fon: +49 (1520) 1976 148<br/>
<br/>
GnuPG Key ID 0x25771B31<br/>
mail: mike.gabriel@das-netzwerkteam.de,<a href="http://das-netzwerkteam.de" target="_blank"> http://das-netzwerkteam.de</a><br/>
<br/>
freeBusy:<br/>
<a href="https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb" target="_blank">https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb</a><br/>
</blockquote></div></body>
</html>