xscreensaver_systemd_loop: avoid use-after-free on for_each loop

xscreensaver-5.45-0004-update_screen_layout-fix-CVE-2021-34557.patch

@@ -0,0 +1,44 @@
+From d0baf2d0a8fb389f28af26f0ec572f1e69edf13f Mon Sep 17 00:00:00 2001
+From: Mamoru TASAKA <mtasaka@fedoraproject.org>
+Date: Tue, 10 Aug 2021 10:32:14 +0900
+Subject: [PATCH] update_screen_layout: fix CVE-2021-34557
+
+In update_screen_layout(), si->screens array created with good_count elements.
+Later, si->screens is scaned up to count elements, which can cause buffer overflow.
+
+The latter change was introduced on xscreensaver 5.45, which seems unnecessary,
+actually this part code is removed on xscreensaver 6.00.
+---
+ driver/screens.c | 16 ----------------
+ 1 file changed, 16 deletions(-)
+
+diff --git a/driver/screens.c b/driver/screens.c
+index 5aeb55d..527da7f 100644
+--- a/driver/screens.c
++++ b/driver/screens.c
+@@ -1089,22 +1089,6 @@ update_screen_layout (saver_info *si)
+       j++;
+     }
+ 
+-  for (; j < count; j++)
+-    {
+-      saver_screen_info *ssi = &si->screens[j];
+-      if (!ssi->screensaver_window)
+-        continue;
+-      fprintf (stderr, "%s: %d: screen now unused, disabling.\n",
+-               blurb(), j);
+-      /* Undo store_saver_id() so that xscreensaver-command doesn't attempt
+-         to communicate with us through this window. It might make more
+-         sense to destroy the window, but I'm not 100% sure that there are
+-         no outstanding grabs on it that have yet been transferred.
+-       */
+-      XDeleteProperty (si->dpy, ssi->screensaver_window,
+-                       XA_SCREENSAVER_VERSION);
+-    }
+-
+   si->default_screen = &si->screens[0];
+   return True;
+ }
+-- 
+2.31.1
+

xscreensaver-5.45-0005-xscreensaver_systemd_loop-avoid-use-after-free-on-fo.patch

@@ -0,0 +1,55 @@
+From aeb13338752386a6f3e2b2a5bd22bfe61d4ccd98 Mon Sep 17 00:00:00 2001
+From: Mamoru TASAKA <mtasaka@fedoraproject.org>
+Date: Mon, 18 Oct 2021 15:25:41 +0900
+Subject: [PATCH] xscreensaver_systemd_loop: avoid use-after-free on for_each
+ loop
+
+Backport use-after-free fix on xscreensaver-systemd as well on
+xscreensaver 5.45
+---
+ driver/xscreensaver-systemd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/driver/xscreensaver-systemd.c b/driver/xscreensaver-systemd.c
+index 2da99de..30d62d3 100644
+--- a/driver/xscreensaver-systemd.c
++++ b/driver/xscreensaver-systemd.c
+@@ -601,7 +601,7 @@ xscreensaver_method_uninhibit (sd_bus_message *m, void *arg,
+ {
+   struct handler_ctx *ctx = arg;
+   uint32_t cookie;
+-  struct inhibit_entry *entry;
++  struct inhibit_entry *entry, *entry_next;
+   int found = 0;
+ 
+   int rc = sd_bus_message_read (m, "u", &cookie);
+@@ -611,7 +611,7 @@ xscreensaver_method_uninhibit (sd_bus_message *m, void *arg,
+     return rc;
+   }
+ 
+-  SLIST_FOREACH(entry, &inhibit_head, entries) {
++  SLIST_FOREACH_SAFE(entry, &inhibit_head, entries, entry_next) {
+     if (entry->cookie == cookie) {
+       if (verbose_p)
+         fprintf (stderr, "%s: uninhibited by \"%s\" with cookie %08X\n",
+@@ -757,7 +757,7 @@ xscreensaver_systemd_loop (void)
+   while (1) {
+     struct pollfd fds[2];
+     uint64_t poll_timeout, system_timeout, user_timeout;
+-    struct inhibit_entry *entry;
++    struct inhibit_entry *entry, *entry_next;
+ 
+     /* We MUST call sd_bus_process() on each bus at least once before calling
+        sd_bus_get_events(), so just always start the event loop by processing
+@@ -806,7 +806,7 @@ xscreensaver_systemd_loop (void)
+        That would have left us inhibited forever, even if the inhibiting
+        program was re-launched, since the new instance won't have the
+        same cookie. */
+-    SLIST_FOREACH (entry, &inhibit_head, entries) {
++    SLIST_FOREACH_SAFE (entry, &inhibit_head, entries, entry_next) {
+       if (entry->pid &&   /* Might not know this entry's pid, sigh... */
+           pid_dead (entry->pid)) {
+         if (verbose_p)
+-- 
+2.33.1
+

xscreensaver.spec

@@ -10,7 +10,7 @@
 %define split_getimage   1
 %endif
 
-%define fedora_rel    1
+%define fedora_rel    3
 
 %global use_clang_as_cc 0
 %global use_clang_analyze 0
@@ -99,6 +99,10 @@ Patch4501:      xscreensaver-5.45-1001-test-password.c-add-skel-definition-for-c
 Patch4502:      xscreensaver-5.45-0002-asm6502.c-immediate-readd-free-call-accidentally-rem.patch
 # beats/draw_beats: avoid integer overflow by multiplication
 Patch4503:      xscreensaver-5.45-0003-beats-draw_beats-avoid-integer-overflow-by-multiplic.patch
+# update_screen_layout: fix CVE-2021-34557
+Patch4504:      xscreensaver-5.45-0004-update_screen_layout-fix-CVE-2021-34557.patch
+# xscreensaver_systemd_loop: avoid use-after-free on for_each loop
+Patch4505:      xscreensaver-5.45-0005-xscreensaver_systemd_loop-avoid-use-after-free-on-fo.patch
 #
 # gcc warning cleanup
 # Some cppcheck cleanup
@@ -375,6 +379,8 @@ find . -name \*.c -exec chmod ugo-x {} \;
 %__cat %PATCH4501 | %__git am
 %__cat %PATCH4502 | %__git am
 %__cat %PATCH4503 | %__git am
+%__cat %PATCH4504 | %__git am
+%__cat %PATCH4505 | %__git am
 
 #%%__cat %PATCH13501 | %%__git am
 
@@ -1112,6 +1118,12 @@ exit 0
 %endif
 
 %changelog
+* Mon Oct 18 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:5.45-3
+- xscreensaver_systemd_loop: avoid use-after-free on for_each loop
+
+* Tue Aug 10 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:5.45-2
+- update_screen_layout: fix CVE-2021-34557 (bug 1974194)
+
 * Thu Dec 10 2020 Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:5.45-1
 - Update to 5.45
 - asm6502.c/immediate: readd free() call accidentally removed during gcc warnings fix