[gentoo-commits] gentoo-x86 commit in x11-base/xorg-server/files: 1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch 1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch

[Donnie Berkholz (dberkholz)]

dberkholz    08/02/01 21:47:20

  Added:               
                        1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch
                        1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch
  Log:
  (#208343) Another security bump, with two fixes. CVE-2007-6429: The old fix for the MIT_SHM patch failed to check for the security issue in all cases. CVE-2007-3920: The second fix is primarily for compiz users. There was a patch in compiz for this but it was again an incomplete fix, because it assumed the problem could only be caused by a specifically named executable.
  (Portage version: 2.1.4)

Revision  Changes    Path
1.1                  x11-base/xorg-server/files/1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch?rev=1.1&content-type=text/plain

Index: 1.4-0009-Don-t-break-grab-and-focus-state-for-a-window-when-r.patch
===================================================================
From a6a7fadbb03ee99312dfb15ac478ab3c414c1c0b Mon Sep 17 00:00:00 2001
From: =?utf-8?q?Kristian=20H=C3=B8gsberg?= <krh@××××××.com>
Date: Wed, 16 Jan 2008 20:24:11 -0500
Subject: [PATCH] Don't break grab and focus state for a window when redirecting it.

Composite uses an unmap/map cycle to trigger backing pixmap allocation
and cliprect recomputation when a window is redirected or unredirected.
To avoid protocol visible side effects, map and unmap events are
disabled temporarily.  However, when a window is unmapped it is also
removed from grabs and loses focus, but these state changes are not
disabled.

This change supresses the unmap side effects during the composite
unmap/map cycle and fixes this bug:

  http://bugzilla.gnome.org/show_bug.cgi?id=488264

where compiz would cause gnome-screensaver to lose its grab when
compiz unredirects the fullscreen lock window.
---
 dix/window.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/dix/window.c b/dix/window.c
index 33cf76b..1ccf126 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -2993,7 +2993,8 @@ UnrealizeTree(
 	    } 
 #endif
 	    (* Unrealize)(pChild);
-	    DeleteWindowFromAnyEvents(pChild, FALSE);
+	    if (MapUnmapEventsEnabled(pWin))
+		DeleteWindowFromAnyEvents(pChild, FALSE);
 	    if (pChild->viewable)
 	    {
 #ifdef DO_SAVE_UNDERS
-- 
1.5.3.8




1.1                  x11-base/xorg-server/files/1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch

file : http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo-x86/x11-base/xorg-server/files/1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch?rev=1.1&content-type=text/plain

Index: 1.4-0008-CVE-2007-6429-Always-test-for-size-offset-wrapping.patch
===================================================================
From be6c17fcf9efebc0bbcc3d9a25f8c5a2450c2161 Mon Sep 17 00:00:00 2001
From: Matthias Hopf <mhopf@××××.de>
Date: Mon, 21 Jan 2008 16:13:21 +0100
Subject: [PATCH] CVE-2007-6429: Always test for size+offset wrapping.

---
 Xext/shm.c |   12 ++++++------
 1 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/Xext/shm.c b/Xext/shm.c
index e46f6fc..a7a1ecf 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -799,10 +799,10 @@ CreatePmap:
     if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
         if (size < width * height)
             return BadAlloc;
-        /* thankfully, offset is unsigned */
-        if (stuff->offset + size < size)
-            return BadAlloc;
     }
+    /* thankfully, offset is unsigned */
+    if (stuff->offset + size < size)
+	return BadAlloc;
 
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
 
@@ -1144,10 +1144,10 @@ CreatePmap:
     if (sizeof(size) == 4 && BitsPerPixel(depth) > 8) {
 	if (size < width * height)
 	    return BadAlloc;
-	/* thankfully, offset is unsigned */
-	if (stuff->offset + size < size)
-	    return BadAlloc;
     }
+    /* thankfully, offset is unsigned */
+    if (stuff->offset + size < size)
+	return BadAlloc;
 
     VERIFY_SHMSIZE(shmdesc, stuff->offset, size, client);
     pMap = (*shmFuncs[pDraw->pScreen->myNum]->CreatePixmap)(
-- 
1.5.3.8




-- 
gentoo-commits@l.g.o mailing list