diff --git a/xscreensaver-5.45-0004-update_screen_layout-fix-CVE-2021-34557.patch b/xscreensaver-5.45-0004-update_screen_layout-fix-CVE-2021-34557.patch new file mode 100644 index 0000000..05ce49f --- /dev/null +++ b/xscreensaver-5.45-0004-update_screen_layout-fix-CVE-2021-34557.patch @@ -0,0 +1,44 @@ +From d0baf2d0a8fb389f28af26f0ec572f1e69edf13f Mon Sep 17 00:00:00 2001 +From: Mamoru TASAKA +Date: Tue, 10 Aug 2021 10:32:14 +0900 +Subject: [PATCH] update_screen_layout: fix CVE-2021-34557 + +In update_screen_layout(), si->screens array created with good_count elements. +Later, si->screens is scaned up to count elements, which can cause buffer overflow. + +The latter change was introduced on xscreensaver 5.45, which seems unnecessary, +actually this part code is removed on xscreensaver 6.00. +--- + driver/screens.c | 16 ---------------- + 1 file changed, 16 deletions(-) + +diff --git a/driver/screens.c b/driver/screens.c +index 5aeb55d..527da7f 100644 +--- a/driver/screens.c ++++ b/driver/screens.c +@@ -1089,22 +1089,6 @@ update_screen_layout (saver_info *si) + j++; + } + +- for (; j < count; j++) +- { +- saver_screen_info *ssi = &si->screens[j]; +- if (!ssi->screensaver_window) +- continue; +- fprintf (stderr, "%s: %d: screen now unused, disabling.\n", +- blurb(), j); +- /* Undo store_saver_id() so that xscreensaver-command doesn't attempt +- to communicate with us through this window. It might make more +- sense to destroy the window, but I'm not 100% sure that there are +- no outstanding grabs on it that have yet been transferred. +- */ +- XDeleteProperty (si->dpy, ssi->screensaver_window, +- XA_SCREENSAVER_VERSION); +- } +- + si->default_screen = &si->screens[0]; + return True; + } +-- +2.31.1 + diff --git a/xscreensaver-5.45-0005-xscreensaver_systemd_loop-avoid-use-after-free-on-fo.patch b/xscreensaver-5.45-0005-xscreensaver_systemd_loop-avoid-use-after-free-on-fo.patch new file mode 100644 index 0000000..35eb037 --- /dev/null +++ b/xscreensaver-5.45-0005-xscreensaver_systemd_loop-avoid-use-after-free-on-fo.patch @@ -0,0 +1,55 @@ +From aeb13338752386a6f3e2b2a5bd22bfe61d4ccd98 Mon Sep 17 00:00:00 2001 +From: Mamoru TASAKA +Date: Mon, 18 Oct 2021 15:25:41 +0900 +Subject: [PATCH] xscreensaver_systemd_loop: avoid use-after-free on for_each + loop + +Backport use-after-free fix on xscreensaver-systemd as well on +xscreensaver 5.45 +--- + driver/xscreensaver-systemd.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/driver/xscreensaver-systemd.c b/driver/xscreensaver-systemd.c +index 2da99de..30d62d3 100644 +--- a/driver/xscreensaver-systemd.c ++++ b/driver/xscreensaver-systemd.c +@@ -601,7 +601,7 @@ xscreensaver_method_uninhibit (sd_bus_message *m, void *arg, + { + struct handler_ctx *ctx = arg; + uint32_t cookie; +- struct inhibit_entry *entry; ++ struct inhibit_entry *entry, *entry_next; + int found = 0; + + int rc = sd_bus_message_read (m, "u", &cookie); +@@ -611,7 +611,7 @@ xscreensaver_method_uninhibit (sd_bus_message *m, void *arg, + return rc; + } + +- SLIST_FOREACH(entry, &inhibit_head, entries) { ++ SLIST_FOREACH_SAFE(entry, &inhibit_head, entries, entry_next) { + if (entry->cookie == cookie) { + if (verbose_p) + fprintf (stderr, "%s: uninhibited by \"%s\" with cookie %08X\n", +@@ -757,7 +757,7 @@ xscreensaver_systemd_loop (void) + while (1) { + struct pollfd fds[2]; + uint64_t poll_timeout, system_timeout, user_timeout; +- struct inhibit_entry *entry; ++ struct inhibit_entry *entry, *entry_next; + + /* We MUST call sd_bus_process() on each bus at least once before calling + sd_bus_get_events(), so just always start the event loop by processing +@@ -806,7 +806,7 @@ xscreensaver_systemd_loop (void) + That would have left us inhibited forever, even if the inhibiting + program was re-launched, since the new instance won't have the + same cookie. */ +- SLIST_FOREACH (entry, &inhibit_head, entries) { ++ SLIST_FOREACH_SAFE (entry, &inhibit_head, entries, entry_next) { + if (entry->pid && /* Might not know this entry's pid, sigh... */ + pid_dead (entry->pid)) { + if (verbose_p) +-- +2.33.1 + diff --git a/xscreensaver.spec b/xscreensaver.spec index e95a45f..dbb28ca 100644 --- a/xscreensaver.spec +++ b/xscreensaver.spec @@ -10,7 +10,7 @@ %define split_getimage 1 %endif -%define fedora_rel 1 +%define fedora_rel 3 %global use_clang_as_cc 0 %global use_clang_analyze 0 @@ -99,6 +99,10 @@ Patch4501: xscreensaver-5.45-1001-test-password.c-add-skel-definition-for-c Patch4502: xscreensaver-5.45-0002-asm6502.c-immediate-readd-free-call-accidentally-rem.patch # beats/draw_beats: avoid integer overflow by multiplication Patch4503: xscreensaver-5.45-0003-beats-draw_beats-avoid-integer-overflow-by-multiplic.patch +# update_screen_layout: fix CVE-2021-34557 +Patch4504: xscreensaver-5.45-0004-update_screen_layout-fix-CVE-2021-34557.patch +# xscreensaver_systemd_loop: avoid use-after-free on for_each loop +Patch4505: xscreensaver-5.45-0005-xscreensaver_systemd_loop-avoid-use-after-free-on-fo.patch # # gcc warning cleanup # Some cppcheck cleanup @@ -375,6 +379,8 @@ find . -name \*.c -exec chmod ugo-x {} \; %__cat %PATCH4501 | %__git am %__cat %PATCH4502 | %__git am %__cat %PATCH4503 | %__git am +%__cat %PATCH4504 | %__git am +%__cat %PATCH4505 | %__git am #%%__cat %PATCH13501 | %%__git am @@ -1112,6 +1118,12 @@ exit 0 %endif %changelog +* Mon Oct 18 2021 Mamoru TASAKA - 1:5.45-3 +- xscreensaver_systemd_loop: avoid use-after-free on for_each loop + +* Tue Aug 10 2021 Mamoru TASAKA - 1:5.45-2 +- update_screen_layout: fix CVE-2021-34557 (bug 1974194) + * Thu Dec 10 2020 Mamoru TASAKA - 1:5.45-1 - Update to 5.45 - asm6502.c/immediate: readd free() call accidentally removed during gcc warnings fix