From d461c2c5e7a79ac0be59bbe892835c8ea7c6126c Mon Sep 17 00:00:00 2001 From: "Owen W. Taylor" Date: Thu, 1 Jun 2017 23:05:54 -0400 Subject: [PATCH 1/2] Add a patch fixing a build error with newer versions of graphviz https://lists.freedesktop.org/archives/wayland-devel/2017-June/034218.html --- ...phviz-files-to-use-HTML-style-labels.patch | 104 ++++++++++++++++++ wayland.spec | 8 +- 2 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 Switch-graphviz-files-to-use-HTML-style-labels.patch diff --git a/Switch-graphviz-files-to-use-HTML-style-labels.patch b/Switch-graphviz-files-to-use-HTML-style-labels.patch new file mode 100644 index 0000000..4371258 --- /dev/null +++ b/Switch-graphviz-files-to-use-HTML-style-labels.patch @@ -0,0 +1,104 @@ +From b0d9d7fae7752f3d5f15b15d08986a8e602c832f Mon Sep 17 00:00:00 2001 +From: "Owen W. Taylor" +Date: Thu, 1 Jun 2017 18:03:28 -0400 +Subject: [PATCH] Switch graphviz files to use HTML-style labels + +With recent versions of graphviz, generation of the diagrams in the documentation +fails with: + + /usr/bin/dot -Tpng -oxml/x-architecture.png dot/x-architecture.gv + Warning: flat edge between adjacent nodes one of which has a record shape - replace records with HTML-like labels + Edge xserver -> comp + Error: getsplinepoints: no spline points available for edge (xserver,comp) + Error: lost xserver comp edge + Error: lost xserver comp edge + Error: lost comp xserver edge + Error: lost comp xserver edge + +http://www.graphviz.org/content/i-havent-been-able-render-these-files-graphviz-226 indicates +that the error message basically means that the authors of graphviz consider record-style +labels to be deprecated and are no longer fixing errors with them. This patch changes +the labels to be in the HTML style, which seems to require duplicating style between all +the nodes, but it's not like these files are often edited. + +The result is not exactly the same but is quite similar. +--- + doc/doxygen/dot/wayland-architecture.gv | 13 +++++-------- + doc/doxygen/dot/x-architecture.gv | 17 ++++++++--------- + 2 files changed, 13 insertions(+), 17 deletions(-) + +diff --git a/doc/doxygen/dot/wayland-architecture.gv b/doc/doxygen/dot/wayland-architecture.gv +index 2d5db84..f2c3507 100644 +--- a/doc/doxygen/dot/wayland-architecture.gv ++++ b/doc/doxygen/dot/wayland-architecture.gv +@@ -9,21 +9,18 @@ digraph arch_wayland { + ] + + node[ +- shape="Mrecord", + color=none, +- fillcolor="#ffbc00", +- style="filled", ++ margin=0, + fontname="DejaVu Sans", + fontsize="18", + ] + +- c1 [label="Wayland Client", URL="#c1"] +- c2 [label="Wayland Client", URL="#c2"] ++ c1 [label=<
Wayland Client
>, URL="#c1"] ++ c2 [label=<
Wayland Client
>, URL="#c2"] + +- comp [tooltip="Wayland Compositor", label="|{|Wayland\nCompositor|}|", URL="#comp"] +- +- impl [tooltip="KMS evdev Kernel", label="|{{KMS|evdev}|Kernel}|", URL="#impl"] ++ comp [tooltip="Wayland Compositor", label=<

Wayland
Compositor

>, URL="#comp"] + ++ impl [tooltip="KMS evdev Kernel", label=<
KMSevdev
Kernel
>, URL="#impl"] + + c1 -> comp [taillabel="③", labeldistance=2.5, URL="#step_3"]; + c2 -> comp; +diff --git a/doc/doxygen/dot/x-architecture.gv b/doc/doxygen/dot/x-architecture.gv +index 4ea49bf..b223d1d 100644 +--- a/doc/doxygen/dot/x-architecture.gv ++++ b/doc/doxygen/dot/x-architecture.gv +@@ -9,28 +9,27 @@ digraph arch_x { + ] + + node[ +- shape="Mrecord", ++ shape="none", + color=none, +- fillcolor="#ffbc00", +- style="filled", ++ margin=0, + fontname="DejaVu Sans", + fontsize="18", + ] + + { + rank=same; +- c1 [label="X Client", URL="#c1"] +- c3 [label="X Client", URL="#c3"] ++ c1 [label=<
X Client
>, URL="#c1"] ++ c3 [label=<
X Client
>, URL="#c3"] + } +- c2 [label="X Client", URL="#c2"] ++ c2 [label=<
X Client
>, URL="#c2"] + + { + rank=same; +- xserver [tooltip="X Server", label="|{|X Server|}|", URL="#xserver"] +- comp [tooltip="Compositor", label="|{|Compositor|}|", URL="#comp"] ++ xserver [tooltip="X Server", label=<

X Server

>, URL="#xserver"] ++ comp [tooltip="Compositor", label=<

Compositor

>, URL="#comp"] + } + +- impl [tooltip="KMS evdev Kernel", label="|{{KMS|evdev}|Kernel}|", URL="#impl"] ++ impl [tooltip="KMS evdev Kernel", label=<
KMSevdev
Kernel
>, URL="#impl"] + + c1 -> xserver [taillabel="③", labeldistance=2, URL="#step_3"]; + c2 -> xserver; +-- +2.13.0 + diff --git a/wayland.spec b/wayland.spec index acf3c81..81852c6 100644 --- a/wayland.spec +++ b/wayland.spec @@ -1,6 +1,6 @@ Name: wayland Version: 1.13.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Wayland Compositor Infrastructure License: MIT @@ -8,6 +8,8 @@ URL: http://wayland.freedesktop.org/ Source0: http://wayland.freedesktop.org/releases/%{name}-%{version}.tar.xz # Fix the tests to pass on ppc64 Patch0: tests-Fix-new-ID-type-handling-in-argument_from_va_list-test.patch +# https://lists.freedesktop.org/archives/wayland-devel/2017-June/034218.html +Patch1: Switch-graphviz-files-to-use-HTML-style-labels.patch BuildRequires: chrpath BuildRequires: docbook-style-xsl @@ -70,6 +72,7 @@ Wayland server library %prep %setup -q %patch0 -p1 +%patch1 -p1 %build @@ -130,6 +133,9 @@ XDG_RUNTIME_DIR=$PWD/tests/run make check || \ %{_libdir}/libwayland-server.so.0* %changelog +* Thu Jun 1 2017 Owen Taylor otaylor@redhat.com> - 1.13.0-2 +- Add a patch fixing a build error with newer versions of graphviz + * Wed Feb 22 2017 Kalev Lember - 1.13.0-1 - Update to 1.13.0 From 54d6deb4cb4ae4fdc46b78d372cbe70802a72c77 Mon Sep 17 00:00:00 2001 From: Kalev Lember Date: Tue, 12 Dec 2017 16:03:36 +0100 Subject: [PATCH 2/2] cursor: Fix heap overflows when parsing malicious files https://bugzilla.redhat.com/show_bug.cgi?id=1522638 --- ...overflows-when-parsing-malicious-fil.patch | 52 +++++++++++++++++++ wayland.spec | 9 +++- 2 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 0001-cursor-Fix-heap-overflows-when-parsing-malicious-fil.patch diff --git a/0001-cursor-Fix-heap-overflows-when-parsing-malicious-fil.patch b/0001-cursor-Fix-heap-overflows-when-parsing-malicious-fil.patch new file mode 100644 index 0000000..e03e3f3 --- /dev/null +++ b/0001-cursor-Fix-heap-overflows-when-parsing-malicious-fil.patch @@ -0,0 +1,52 @@ +From 5d201df72f3d4f4cb8b8f75f980169b03507da38 Mon Sep 17 00:00:00 2001 +From: Tobias Stoeckmann +Date: Tue, 28 Nov 2017 21:38:07 +0100 +Subject: [PATCH] cursor: Fix heap overflows when parsing malicious files. + +It is possible to trigger heap overflows due to an integer overflow +while parsing images. + +The integer overflow occurs because the chosen limit 0x10000 for +dimensions is too large for 32 bit systems, because each pixel takes +4 bytes. Properly chosen values allow an overflow which in turn will +lead to less allocated memory than needed for subsequent reads. + +See also: https://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=4794b5dd34688158fb51a2943032569d3780c4b8 +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=103961 + +Signed-off-by: Tobias Stoeckmann +[Pekka: add link to the corresponding libXcursor commit] +Signed-off-by: Pekka Paalanen +--- + cursor/xcursor.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/cursor/xcursor.c b/cursor/xcursor.c +index ca41c4ac611f..689c7026729d 100644 +--- a/cursor/xcursor.c ++++ b/cursor/xcursor.c +@@ -202,6 +202,11 @@ XcursorImageCreate (int width, int height) + { + XcursorImage *image; + ++ if (width < 0 || height < 0) ++ return NULL; ++ if (width > XCURSOR_IMAGE_MAX_SIZE || height > XCURSOR_IMAGE_MAX_SIZE) ++ return NULL; ++ + image = malloc (sizeof (XcursorImage) + + width * height * sizeof (XcursorPixel)); + if (!image) +@@ -482,7 +487,8 @@ _XcursorReadImage (XcursorFile *file, + if (!_XcursorReadUInt (file, &head.delay)) + return NULL; + /* sanity check data */ +- if (head.width >= 0x10000 || head.height > 0x10000) ++ if (head.width > XCURSOR_IMAGE_MAX_SIZE || ++ head.height > XCURSOR_IMAGE_MAX_SIZE) + return NULL; + if (head.width == 0 || head.height == 0) + return NULL; +-- +2.14.3 + diff --git a/wayland.spec b/wayland.spec index 81852c6..d1769f9 100644 --- a/wayland.spec +++ b/wayland.spec @@ -1,6 +1,6 @@ Name: wayland Version: 1.13.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Wayland Compositor Infrastructure License: MIT @@ -10,6 +10,9 @@ Source0: http://wayland.freedesktop.org/releases/%{name}-%{version}.tar.x Patch0: tests-Fix-new-ID-type-handling-in-argument_from_va_list-test.patch # https://lists.freedesktop.org/archives/wayland-devel/2017-June/034218.html Patch1: Switch-graphviz-files-to-use-HTML-style-labels.patch +# https://lists.freedesktop.org/archives/wayland-devel/2017-November/035979.html +# Backported from upstream +Patch2: 0001-cursor-Fix-heap-overflows-when-parsing-malicious-fil.patch BuildRequires: chrpath BuildRequires: docbook-style-xsl @@ -73,6 +76,7 @@ Wayland server library %setup -q %patch0 -p1 %patch1 -p1 +%patch2 -p1 %build @@ -133,6 +137,9 @@ XDG_RUNTIME_DIR=$PWD/tests/run make check || \ %{_libdir}/libwayland-server.so.0* %changelog +* Tue Dec 12 2017 Kalev Lember - 1.13.0-3 +- cursor: Fix heap overflows when parsing malicious files (#1522638) + * Thu Jun 1 2017 Owen Taylor otaylor@redhat.com> - 1.13.0-2 - Add a patch fixing a build error with newer versions of graphviz