1. 22 Oct, 2018 1 commit
  2. 25 Aug, 2017 1 commit
  3. 01 Mar, 2017 1 commit
  4. 08 Feb, 2017 1 commit
  5. 19 Oct, 2016 6 commits
  6. 12 Oct, 2016 1 commit
    • Alan Coopersmith's avatar
      Integer overflows in stringSectionSize() cause buffer overflow in… · 0349af11
      Alan Coopersmith authored
      Integer overflows in stringSectionSize() cause buffer overflow in ReadColornameDB() [CVE-2013-1981 6/13]
      
      LoadColornameDB() calls stringSectionSize() to do a first pass over the
      file (which may be provided by the user via XCMSDB environment variable)
      to determine how much memory needs to be allocated to read in the file,
      then allocates the returned sizes and calls ReadColornameDB() to load the
      data from the file into that newly allocated memory.
      
      If stringSectionSize() overflows the signed ints used to calculate the
      file size (say if you have an xcmsdb with ~4 billion lines in or a
      combined string length of ~4 gig - which while it may have been
      inconceivable when Xlib was written, is quite possible today), then
      LoadColornameDB() may allocate a memory buffer much smaller than the
      amount of data ReadColornameDB() will write to it.
      
      The total size is left limited to an int, because if your xcmsdb file
      is larger than 2gb, you're doing it wrong.
      Reported-by: 's avatarIlja Van Sprundel <ivansprundel@ioactive.com>
      Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com>
      Reviewed-by: 's avatarMatthieu Herrb <matthieu.herrb@laas.fr>
      Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org>
      Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
      0349af11
  7. 10 Oct, 2016 1 commit
  8. 05 Jul, 2016 1 commit
  9. 28 Dec, 2015 1 commit
    • Mike Gabriel's avatar
      Clear header file namespace separation (<X11/...> vs. <nx-X11/...>). · 433d8186
      Mike Gabriel authored
       In the process of building nxagent against more and more system-wide installed
       X.org libraries, we come to the limit of including structs from this (bundled
       nx-X11) and that (system-wide X.Org) library.
      
       This commit introduces a clear namespace separation of headers provided by
       nx-X11 and headers provided by X.Org. This approach is only temporary as we
       want to drop all nx-X11 bundled libraries from nx-libs.
      
       However, for a while we need to make this separation clear and also ship
       some reduced fake X.Org headers that avoid pulling in libX* and libNX_X*
       symbols at the same time.
      
       This patch has been tested on Debian jessie and unstable and requires no
       overall testing on various distros and distro versions, as we finally will
       drop all libNX_X* libraries and build against X.org's client libs.
      
       For now, this hack eases our development / cleanup process.
      433d8186
  10. 10 Oct, 2011 1 commit