SecBSD/xenocara
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix several input validation errors in libX11 and libXpm. CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 CVE-2023-43788 CVE-2023-43789

Browse source
This commit is contained in:
purplerain 2023-10-04 03:57:45 +00:00
parent 21df3bcb54
commit e1ec829e63
Signed by: purplerain
GPG key ID: F42C07F07E2E35B7
11 changed files with 153 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

28
lib/libXpm/src/CrPFrBuf.c
View file

@ -46,7 +46,7 @@ XpmCreatePixmapFromBuffer(
Pixmap *shapemask_return,
XpmAttributes *attributes)
{
XImage *ximage, *shapeimage;
XImage *ximage = NULL, *shapeimage = NULL;
int ErrorStatus;
/* initialize return values */
@ -63,16 +63,34 @@ XpmCreatePixmapFromBuffer(
attributes);
if (ErrorStatus < 0) /* fatal error */
return (ErrorStatus);
goto cleanup;
/* create the pixmaps and destroy images */
if (pixmap_return && ximage) {
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
XDestroyImage(ximage);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
if (ErrorStatus < 0) /* fatal error */
goto cleanup;
}
if (shapemask_return && shapeimage) {
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
}
cleanup:
if (ximage != NULL)
XDestroyImage(ximage);
if (shapeimage != NULL)
XDestroyImage(shapeimage);
if (ErrorStatus < 0) {
if (pixmap_return && *pixmap_return) {
XFreePixmap(display, *pixmap_return);
*pixmap_return = 0;
}
if (shapemask_return && *shapemask_return) {
XFreePixmap(display, *shapemask_return);
*shapemask_return = 0;
}
}
return (ErrorStatus);
}

31
lib/libXpm/src/CrPFrDat.c
View file

@ -46,7 +46,7 @@ XpmCreatePixmapFromData(
Pixmap *shapemask_return,
XpmAttributes *attributes)
{
XImage *ximage, *shapeimage;
XImage *ximage = NULL, *shapeimage = NULL;
int ErrorStatus;
/* initialize return values */
@ -63,19 +63,34 @@ XpmCreatePixmapFromData(
attributes);
if (ErrorStatus != XpmSuccess)
return (ErrorStatus);
if (ErrorStatus < 0) /* fatal error */
return (ErrorStatus);
goto cleanup;
/* create the pixmaps and destroy images */
if (pixmap_return && ximage) {
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
XDestroyImage(ximage);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
if (ErrorStatus < 0) /* fatal error */
goto cleanup;
}
if (shapemask_return && shapeimage) {
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
}
cleanup:
if (ximage != NULL)
XDestroyImage(ximage);
if (shapeimage != NULL)
XDestroyImage(shapeimage);
if (ErrorStatus < 0) {
if (pixmap_return && *pixmap_return) {
XFreePixmap(display, *pixmap_return);
*pixmap_return = 0;
}
if (shapemask_return && *shapemask_return) {
XFreePixmap(display, *shapemask_return);
*shapemask_return = 0;
}
}
return (ErrorStatus);
}

10
lib/libXpm/src/CrPFrI.c
View file

@ -36,8 +36,9 @@
#include <config.h>
#endif
#include "XpmI.h"
#include <stdint.h>
void
int
xpmCreatePixmapFromImage(
Display *display,
Drawable d,
@ -47,6 +48,11 @@ xpmCreatePixmapFromImage(
GC gc;
XGCValues values;
/* X Pixmaps are limited to unsigned 16-bit height/width */
if ((ximage->width > UINT16_MAX) || (ximage->height > UINT16_MAX)) {
return XpmNoMemory;
}
*pixmap_return = XCreatePixmap(display, d, ximage->width,
ximage->height, ximage->depth);
/* set fg and bg in case we have an XYBitmap */
@ -59,4 +65,6 @@ xpmCreatePixmapFromImage(
ximage->width, ximage->height);
XFreeGC(display, gc);
return XpmSuccess;
}

28
lib/libXpm/src/RdFToP.c
View file

@ -46,7 +46,7 @@ XpmReadFileToPixmap(
Pixmap *shapemask_return,
XpmAttributes *attributes)
{
XImage *ximage, *shapeimage;
XImage *ximage = NULL, *shapeimage = NULL;
int ErrorStatus;
/* initialize return values */
@ -62,16 +62,34 @@ XpmReadFileToPixmap(
attributes);
if (ErrorStatus < 0) /* fatal error */
return (ErrorStatus);
goto cleanup;
/* create the pixmaps and destroy images */
if (pixmap_return && ximage) {
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
XDestroyImage(ximage);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
if (ErrorStatus < 0) /* fatal error */
goto cleanup;
}
if (shapemask_return && shapeimage) {
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
}
cleanup:
if (ximage != NULL)
XDestroyImage(ximage);
if (shapeimage != NULL)
XDestroyImage(shapeimage);
if (ErrorStatus < 0) {
if (pixmap_return && *pixmap_return) {
XFreePixmap(display, *pixmap_return);
*pixmap_return = 0;
}
if (shapemask_return && *shapemask_return) {
XFreePixmap(display, *shapemask_return);
*shapemask_return = 0;
}
}
return (ErrorStatus);
}

2
lib/libXpm/src/XpmI.h
View file

@ -188,7 +188,7 @@ FUNC(xpmSetAttributes, void, (XpmAttributes *attributes, XpmImage *image,
XpmInfo *info));
#if !defined(FOR_MSW) && !defined(AMIGA)
FUNC(xpmCreatePixmapFromImage, void, (Display *display, Drawable d,
FUNC(xpmCreatePixmapFromImage, int, (Display *display, Drawable d,
XImage *ximage, Pixmap *pixmap_return));
FUNC(xpmCreateImageFromPixmap, void, (Display *display, Pixmap pixmap,

33
lib/libXpm/src/create.c
View file

@ -997,6 +997,11 @@ CreateXImage(
*image_return = NULL;
return XpmNoMemory;
}
if (width != 0 && (*image_return)->bits_per_pixel >= INT_MAX / width) {
XDestroyImage(*image_return);
*image_return = NULL;
return XpmNoMemory;
}
/* now that bytes_per_line must have been set properly alloc data */
if((*image_return)->bytes_per_line == 0 || height == 0) {
XDestroyImage(*image_return);
@ -1652,7 +1657,7 @@ XpmCreatePixmapFromXpmImage(
Pixmap *shapemask_return,
XpmAttributes *attributes)
{
XImage *ximage, *shapeimage;
XImage *ximage = NULL, *shapeimage = NULL;
int ErrorStatus;
/* initialize return values */
@ -1668,16 +1673,34 @@ XpmCreatePixmapFromXpmImage(
&shapeimage : NULL),
attributes);
if (ErrorStatus < 0)
return (ErrorStatus);
goto cleanup;
/* create the pixmaps and destroy images */
if (pixmap_return && ximage) {
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
XDestroyImage(ximage);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, ximage, pixmap_return);
if (ErrorStatus < 0) /* fatal error */
goto cleanup;
}
if (shapemask_return && shapeimage) {
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
ErrorStatus =
xpmCreatePixmapFromImage(display, d, shapeimage, shapemask_return);
}
cleanup:
if (ximage != NULL)
XDestroyImage(ximage);
if (shapeimage != NULL)
XDestroyImage(shapeimage);
if (ErrorStatus < 0) {
if (pixmap_return && *pixmap_return) {
XFreePixmap(display, *pixmap_return);
*pixmap_return = 0;
}
if (shapemask_return && *shapemask_return) {
XFreePixmap(display, *shapemask_return);
*shapemask_return = 0;
}
}
return (ErrorStatus);
}

6
lib/libXpm/src/data.c
View file

@ -108,7 +108,7 @@ ParseComment(xpmData *data)
n++;
s2++;
} while (c == *s2 && *s2 != '\0' && c);
if (*s2 == '\0') {
if (*s2 == '\0' || c == '\0') {
/* this is the end of the comment */
notend = 0;
data->cptr--;
@ -259,13 +259,13 @@ xpmNextWord(
int c;
if (!data->type || data->type == XPMBUFFER) {
while (isspace(c = *data->cptr) && c != data->Eos)
while ((c = *data->cptr) && isspace(c) && (c != data->Eos))
data->cptr++;
do {
c = *data->cptr++;
*buf++ = c;
n++;
} while (!isspace(c) && c != data->Eos && n < buflen);
} while (c && !isspace(c) && (c != data->Eos) && (n < buflen));
n--;
data->cptr--;
} else {