!63 [sync] PR-60: Fix CVE-2023-43785, CVE-2023-43786, CVE-2023-43787

From: @openeuler-sync-bot Reviewed-by: @weigangli Signed-off-by: @weigangli
Fix CVE-2023-43785, CVE-2023-43786, CVE-2023-43787
2023-10-07 09:26:05 +00:00 · 2023-10-07 17:08:58 +08:00 · 2023-06-19 09:46:37 +00:00 · 2023-06-19 16:21:21 +08:00 · 2022-10-24 12:21:21 +00:00 · 2022-10-24 19:54:44 +08:00
12 changed files with 815 additions and 1 deletions
--- a/CVE-2020-14363.patch
+++ b/CVE-2020-14363.patch
@ -0,0 +1,28 @@
+From acdaaadcb3d85c61fd43669fc5dddf0f8c3f911d Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Thu, 13 Aug 2020 18:02:58 +0200
+Subject: [PATCH] Fix an integer overflow in init_om()
+CVE-2020-14363
+This can lead to a double free later, as reported by Jayden Rivers.
+https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/acdaaadcb3d85c61fd43669fc5dddf0f8c3f911d
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+---
+ modules/om/generic/omGeneric.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/modules/om/generic/omGeneric.c b/modules/om/generic/omGeneric.c
+index c44acb88..406cec93 100644
+--- a/modules/om/generic/omGeneric.c
+++ b/modules/om/generic/omGeneric.c
+@@ -1908,7 +1908,8 @@ init_om(
+     char **required_list;
+     XOrientation *orientation;
+     char **value, buf[BUFSIZ], *bufptr;
+-    int count = 0, num = 0, length = 0;
+    int count = 0, num = 0;
+    unsigned int length = 0;
+ 
+     _XlcGetResource(lcd, "XLC_FONTSET", "on_demand_loading", &value, &count);
+     if (count > 0 && _XlcCompareISOLatin1(*value, "True") == 0)
+-- 
+GitLab
+
--- a/CVE-2021-31535.patch
+++ b/CVE-2021-31535.patch
@ -0,0 +1,273 @@
+diff -uNr libX11-1.6.9.orig/src/Font.c libX11-1.6.9/src/Font.c
+--- libX11-1.6.9.orig/src/Font.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/Font.c	2021-06-11 13:48:47.678388017 +0800
+@@ -102,6 +102,8 @@
+     XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
+ #endif
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return NULL;
+     if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
+       return font_result;
+     LockDisplay(dpy);
+@@ -663,7 +665,7 @@
+     if (!name)
+ 	return 0;
+     l = strlen(name);
+-    if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
+    if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
+ 	return 0;
+     charset = NULL;
+     /* next three lines stolen from _XkbGetCharset() */
+diff -uNr libX11-1.6.9.orig/src/FontInfo.c libX11-1.6.9/src/FontInfo.c
+--- libX11-1.6.9.orig/src/FontInfo.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/FontInfo.c	2021-06-11 13:49:17.654338074 +0800
+@@ -58,6 +58,9 @@
+     register xListFontsReq *req;
+     int j;
+ 
+    if (strlen(pattern) >= USHRT_MAX)
+        return NULL;
+
+     LockDisplay(dpy);
+     GetReq(ListFontsWithInfo, req);
+     req->maxNames = maxNames;
+diff -uNr libX11-1.6.9.orig/src/FontNames.c libX11-1.6.9/src/FontNames.c
+--- libX11-1.6.9.orig/src/FontNames.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/FontNames.c	2021-06-11 13:49:54.374276759 +0800
+@@ -51,6 +51,9 @@
+     register xListFontsReq *req;
+     unsigned long rlen = 0;
+ 
+    if (strlen(pattern) >= USHRT_MAX)
+        return NULL;
+
+     LockDisplay(dpy);
+     GetReq(ListFonts, req);
+     req->maxNames = maxNames;
+diff -uNr libX11-1.6.9.orig/src/GetColor.c libX11-1.6.9/src/GetColor.c
+--- libX11-1.6.9.orig/src/GetColor.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/GetColor.c	2021-06-11 13:50:43.042195263 +0800
+@@ -27,6 +27,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -48,6 +49,9 @@
+     XcmsColor cmsColor_exact;
+     Status ret;
+ 
+    if (strlen(colorname) >= USHRT_MAX)
+        return (0);
+
+ #ifdef XCMS
+     /*
+      * Let's Attempt to use Xcms and i18n approach to Parse Color
+diff -uNr libX11-1.6.9.orig/src/LoadFont.c libX11-1.6.9/src/LoadFont.c
+--- libX11-1.6.9.orig/src/LoadFont.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/LoadFont.c	2021-06-11 13:51:27.886119964 +0800
+@@ -27,6 +27,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include "Xlibint.h"
+ 
+ Font
+@@ -38,6 +39,9 @@
+     Font fid;
+     register xOpenFontReq *req;
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return (0);
+
+     if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
+       return fid;
+ 
+diff -uNr libX11-1.6.9.orig/src/LookupCol.c libX11-1.6.9/src/LookupCol.c
+--- libX11-1.6.9.orig/src/LookupCol.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/LookupCol.c	2021-06-11 13:52:42.389994467 +0800
+@@ -27,6 +27,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,9 @@
+ 	XcmsCCC ccc;
+ 	XcmsColor cmsColor_exact;
+ 
+	n = (int) strlen (spec);
+	if (n >= USHRT_MAX)
+            return 0;
+ #ifdef XCMS
+ 	/*
+ 	 * Let's Attempt to use Xcms and i18n approach to Parse Color
+@@ -77,8 +81,6 @@
+ 	 * Xcms and i18n methods failed, so lets pass it to the server
+ 	 * for parsing.
+ 	 */
+-
+-	n = strlen (spec);
+ 	LockDisplay(dpy);
+ 	GetReq (LookupColor, req);
+ 	req->cmap = cmap;
+diff -uNr libX11-1.6.9.orig/src/ParseCol.c libX11-1.6.9/src/ParseCol.c
+--- libX11-1.6.9.orig/src/ParseCol.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/ParseCol.c	2021-06-11 13:53:23.693914489 +0800
+@@ -27,6 +27,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -47,6 +48,8 @@
+ 
+         if (!spec) return(0);
+ 	n = strlen (spec);
+	if (n >= USHRT_MAX)
+            return(0);
+ 	if (*spec == '#') {
+ 	    /*
+ 	     * RGB
+diff -uNr libX11-1.6.9.orig/src/QuExt.c libX11-1.6.9/src/QuExt.c
+--- libX11-1.6.9.orig/src/QuExt.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/QuExt.c	2021-06-11 13:54:52.001642044 +0800
+@@ -27,6 +27,8 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+#include <stdbool.h>
+ #include "Xlibint.h"
+ 
+ Bool
+@@ -40,6 +42,9 @@
+     xQueryExtensionReply rep;
+     register xQueryExtensionReq *req;
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return false;
+
+     LockDisplay(dpy);
+     GetReq(QueryExtension, req);
+     req->nbytes = name ? strlen(name) : 0;
+diff -uNr libX11-1.6.9.orig/src/SetFPath.c libX11-1.6.9/src/SetFPath.c
+--- libX11-1.6.9.orig/src/SetFPath.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/SetFPath.c	2021-06-11 13:55:33.509519589 +0800
+@@ -26,6 +26,7 @@
+ 
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+#include <limits.h>
+ #endif
+ #include "Xlibint.h"
+ 
+@@ -49,6 +50,11 @@
+ 	req->nFonts = ndirs;
+ 	for (i = 0; i < ndirs; i++) {
+ 		n += safestrlen (directories[i]) + 1;
+		if (n >= USHRT_MAX) {
+			UnlockDisplay(dpy);
+			SyncHandle();
+			return 0;
+		}
+ 	}
+ 	nbytes = (n + 3) & ~3;
+ 	req->length += nbytes >> 2;
+diff -uNr libX11-1.6.9.orig/src/SetHints.c libX11-1.6.9/src/SetHints.c
+--- libX11-1.6.9.orig/src/SetHints.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/SetHints.c	2021-06-11 13:56:58.105279661 +0800
+@@ -49,6 +49,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xutil.h>
+ #include "Xatomtype.h"
+@@ -214,6 +215,8 @@
+ 	register char *buf, *bp;
+ 	for (i = 0, nbytes = 0; i < argc; i++) {
+ 		nbytes += safestrlen(argv[i]) + 1;
+		if (nbytes >= USHRT_MAX)
+                    return 1;
+ 	}
+ 	if ((bp = buf = Xmalloc(nbytes))) {
+ 	    /* copy arguments into single buffer */
+@@ -256,6 +259,8 @@
+ 
+ 	if (name != NULL) XStoreName (dpy, w, name);
+ 
+        if (safestrlen(icon_string) >= USHRT_MAX)
+            return 1;
+ 	if (icon_string != NULL) {
+ 	    XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+                              PropModeReplace,
+@@ -298,6 +303,8 @@
+ 
+ 	len_nm = safestrlen(classhint->res_name);
+ 	len_cl = safestrlen(classhint->res_class);
+        if (len_nm + len_cl >= USHRT_MAX)
+            return 1;
+ 	if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
+ 	    if (len_nm) {
+ 		strcpy(s, classhint->res_name);
+diff -uNr libX11-1.6.9.orig/src/StName.c libX11-1.6.9/src/StName.c
+--- libX11-1.6.9.orig/src/StName.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/StName.c	2021-06-11 13:58:50.124979044 +0800
+@@ -27,6 +27,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <X11/Xlibint.h>
+ #include <X11/Xatom.h>
+ 
+@@ -36,7 +37,9 @@
+     Window w,
+     _Xconst char *name)
+ {
+-    return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
+    if (strlen(name) >= USHRT_MAX)
+        return 0;
+    return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /*  */
+ 			   8, PropModeReplace, (_Xconst unsigned char *)name,
+ 			   name ? strlen(name) : 0);
+ }
+@@ -47,6 +50,8 @@
+     Window w,
+     _Xconst char *icon_name)
+ {
+    if (strlen(icon_name) >= USHRT_MAX)
+        return 0;
+     return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
+                            PropModeReplace, (_Xconst unsigned char *)icon_name,
+ 			   icon_name ? strlen(icon_name) : 0);
+diff -uNr libX11-1.6.9.orig/src/StNColor.c libX11-1.6.9/src/StNColor.c
+--- libX11-1.6.9.orig/src/StNColor.c	2019-10-10 01:43:00.000000000 +0800
+++ libX11-1.6.9/src/StNColor.c	2021-06-11 13:57:38.745168537 +0800
+@@ -27,6 +27,7 @@
+ #ifdef HAVE_CONFIG_H
+ #include <config.h>
+ #endif
+#include <limits.h>
+ #include <stdio.h>
+ #include "Xlibint.h"
+ #include "Xcmsint.h"
+@@ -46,6 +47,8 @@
+     XcmsColor cmsColor_exact;
+     XColor scr_def;
+ 
+    if (strlen(name) >= USHRT_MAX)
+        return 0;
+ #ifdef XCMS
+     /*
+      * Let's Attempt to use Xcms approach to Parse Color
--- a/backport-0001-CVE-2022-3555.patch
+++ b/backport-0001-CVE-2022-3555.patch
@ -0,0 +1,37 @@
+From 8a368d808fec166b5fb3dfe6312aab22c7ee20af Mon Sep 17 00:00:00 2001
+From: Hodong <hodong@yozmos.com>
+Date: Thu, 20 Jan 2022 00:57:41 +0900
+Subject: [PATCH] Fix two memory leaks in _XFreeX11XCBStructure()
+
+Even when XCloseDisplay() was called, some memory was leaked.
+
+XCloseDisplay() calls _XFreeDisplayStructure(), which calls
+_XFreeX11XCBStructure().
+
+However, _XFreeX11XCBStructure() did not destroy the condition variables,
+resulting in the leaking of some 40 bytes.
+
+Signed-off-by: Hodong <hodong@yozmos.com>
+
+Conflict:NA
+Reference:https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=8a368d808fec166b5fb3dfe6312aab22c7ee20af
+---
+ src/xcb_disp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/xcb_disp.c b/src/xcb_disp.c
+index 70a602f4..e9becee3 100644
+--- a/src/xcb_disp.c
+++ b/src/xcb_disp.c
+@@ -102,6 +102,8 @@ void _XFreeX11XCBStructure(Display *dpy)
+ 		dpy->xcb->pending_requests = tmp->next;
+ 		free(tmp);
+ 	}
+	xcondition_clear(dpy->xcb->event_notify);
+	xcondition_clear(dpy->xcb->reply_notify);
+ 	xcondition_free(dpy->xcb->event_notify);
+ 	xcondition_free(dpy->xcb->reply_notify);
+ 	Xfree(dpy->xcb);
+-- 
+2.27.0
+
--- a/backport-0001-CVE-2023-43786.patch
+++ b/backport-0001-CVE-2023-43786.patch
@ -0,0 +1,37 @@
+From 204c3393c4c90a29ed6bef64e43849536e863a86 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Thu, 7 Sep 2023 15:54:30 -0700
+Subject: [PATCH] CVE-2023-43786: stack exhaustion from infinite recursion in
+ PutSubImage()
+
+When splitting a single line of pixels into chunks to send to the
+X server, be sure to take into account the number of bits per pixel,
+so we don't just loop forever trying to send more pixels than fit in
+the given request size and not breaking them down into a small enough
+chunk to fix.
+
+Fixes: "almost complete rewrite" (Dec. 12, 1987) from X11R2
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/PutImage.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/PutImage.c b/src/PutImage.c
+index 857ee916..a6db7b42 100644
+--- a/src/PutImage.c
+++ b/src/PutImage.c
+@@ -914,8 +914,9 @@ PutSubImage (
+ 		    req_width, req_height - SubImageHeight,
+ 		    dest_bits_per_pixel, dest_scanline_pad);
+     } else {
+-	int SubImageWidth = (((Available << 3) / dest_scanline_pad)
+-				* dest_scanline_pad) - left_pad;
+	int SubImageWidth = ((((Available << 3) / dest_scanline_pad)
+                              * dest_scanline_pad) - left_pad)
+                              / dest_bits_per_pixel;
+ 
+ 	PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
+ 		    (unsigned int) SubImageWidth, 1,
+-- 
+GitLab
+
--- a/backport-0002-CVE-2022-3555.patch
+++ b/backport-0002-CVE-2022-3555.patch
@ -0,0 +1,37 @@
+From 76d1cc3c1ce943c6ff81dc8c62a1d1b30fabf02e Mon Sep 17 00:00:00 2001
+From: Simon McVittie <smcv@debian.org>
+Date: Sun, 3 Apr 2022 14:23:36 +0100
+Subject: Don't try to destroy NULL condition variables
+
+This avoids a segfault during error-unwinding if an invalid display name
+is passed to XOpenDisplay().
+
+Fixes: 8a368d80 "Fix two memory leaks in _XFreeX11XCBStructure()"
+Resolves: #155
+Signed-off-by: Simon McVittie <smcv@debian.org>
+
+Conflict:NA
+Reference:https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=76d1cc3c1ce943c6ff81dc8c62a1d1b30fabf02e
+---
+ src/xcb_disp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/xcb_disp.c b/src/xcb_disp.c
+index e9becee3..63e344af 100644
+--- a/src/xcb_disp.c
+++ b/src/xcb_disp.c
+@@ -102,8 +102,10 @@ void _XFreeX11XCBStructure(Display *dpy)
+ 		dpy->xcb->pending_requests = tmp->next;
+ 		free(tmp);
+ 	}
+-	xcondition_clear(dpy->xcb->event_notify);
+-	xcondition_clear(dpy->xcb->reply_notify);
+	if (dpy->xcb->event_notify)
+		xcondition_clear(dpy->xcb->event_notify);
+	if (dpy->xcb->reply_notify)
+		xcondition_clear(dpy->xcb->reply_notify);
+ 	xcondition_free(dpy->xcb->event_notify);
+ 	xcondition_free(dpy->xcb->reply_notify);
+ 	Xfree(dpy->xcb);
+-- 
+cgit v1.2.1
--- a/backport-0002-CVE-2023-43786.patch
+++ b/backport-0002-CVE-2023-43786.patch
@ -0,0 +1,41 @@
+From 73a37d5f2fcadd6540159b432a70d80f442ddf4a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Thu, 7 Sep 2023 15:55:04 -0700
+Subject: [PATCH] XPutImage: clip images to maximum height & width allowed by
+ protocol
+
+The PutImage request specifies height & width of the image as CARD16
+(unsigned 16-bit integer), same as the maximum dimensions of an X11
+Drawable, which the image is being copied to.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/PutImage.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/PutImage.c b/src/PutImage.c
+index a6db7b42..ba411e36 100644
+--- a/src/PutImage.c
+++ b/src/PutImage.c
+@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
+ #include "Xlibint.h"
+ #include "Xutil.h"
+ #include <stdio.h>
+#include <limits.h>
+ #include "Cr.h"
+ #include "ImUtil.h"
+ #include "reallocarray.h"
+@@ -962,6 +963,10 @@ XPutImage (
+ 	height = image->height - req_yoffset;
+     if ((width <= 0) || (height <= 0))
+ 	return 0;
+    if (width > USHRT_MAX)
+        width = USHRT_MAX;
+    if (height > USHRT_MAX)
+        height = USHRT_MAX;
+ 
+     if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) {
+ 	dest_bits_per_pixel = 1;
+-- 
+GitLab
+
--- a/backport-0003-CVE-2023-43786.patch
+++ b/backport-0003-CVE-2023-43786.patch
@ -0,0 +1,47 @@
+From b4031fc023816aca07fbd592ed97010b9b48784b Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Thu, 7 Sep 2023 16:12:27 -0700
+Subject: [PATCH] XCreatePixmap: trigger BadValue error for out-of-range
+ dimensions
+
+The CreatePixmap request specifies height & width of the image as CARD16
+(unsigned 16-bit integer), so if either is larger than that, set it to 0
+so the X server returns a BadValue error as the protocol requires.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/CrPixmap.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/src/CrPixmap.c b/src/CrPixmap.c
+index cdf31207..3cb2ca6d 100644
+--- a/src/CrPixmap.c
+++ b/src/CrPixmap.c
+@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
+ #include <config.h>
+ #endif
+ #include "Xlibint.h"
+#include <limits.h>
+ 
+ #ifdef USE_DYNAMIC_XCURSOR
+ void
+@@ -47,6 +48,16 @@ Pixmap XCreatePixmap (
+     Pixmap pid;
+     register xCreatePixmapReq *req;
+ 
+    /*
+     * Force a BadValue X Error if the requested dimensions are larger
+     * than the X11 protocol has room for, since that's how callers expect
+     * to get notified of errors.
+     */
+    if (width > USHRT_MAX)
+        width = 0;
+    if (height > USHRT_MAX)
+        height = 0;
+
+     LockDisplay(dpy);
+     GetReq(CreatePixmap, req);
+     req->drawable = d;
+-- 
+GitLab
+
--- a/backport-CVE-2022-3554.patch
+++ b/backport-CVE-2022-3554.patch
@ -0,0 +1,56 @@
+From 1d11822601fd24a396b354fa616b04ed3df8b4ef Mon Sep 17 00:00:00 2001
+From: "Thomas E. Dickey" <dickey@invisible-island.net>
+Date: Tue, 4 Oct 2022 18:26:17 -0400
+Subject: [PATCH] fix a memory leak in XRegisterIMInstantiateCallback
+
+Analysis:
+
+    _XimRegisterIMInstantiateCallback() opens an XIM and closes it using
+    the internal function pointers, but the internal close function does
+    not free the pointer to the XIM (this would be done in XCloseIM()).
+
+Report/patch:
+
+    Date: Mon, 03 Oct 2022 18:47:32 +0800
+    From: Po Lu <luangruo@yahoo.com>
+    To: xorg-devel@lists.x.org
+    Subject: Re: Yet another leak in Xlib
+
+    For reference, here's how I'm calling XRegisterIMInstantiateCallback:
+
+    XSetLocaleModifiers ("");
+    XRegisterIMInstantiateCallback (compositor.display,
+                                    XrmGetDatabase (compositor.display),
+                                    (char *) compositor.resource_name,
+                                    (char *) compositor.app_name,
+                                    IMInstantiateCallback, NULL);
+
+    and XMODIFIERS is:
+
+        @im=ibus
+
+Signed-off-by: Thomas E. Dickey <dickey@invisible-island.net>
+
+Conflict:NA
+Reference:https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=1d11822601fd24a396b354fa616b04ed3df8b4ef
+---
+ modules/im/ximcp/imInsClbk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/modules/im/ximcp/imInsClbk.c b/modules/im/ximcp/imInsClbk.c
+index 95b379cb..c10e347f 100644
+--- a/modules/im/ximcp/imInsClbk.c
+++ b/modules/im/ximcp/imInsClbk.c
+@@ -212,6 +212,9 @@ _XimRegisterIMInstantiateCallback(
+     if( xim ) {
+ 	lock = True;
+ 	xim->methods->close( (XIM)xim );
+	/* XIMs must be freed manually after being opened; close just
+	   does the protocol to deinitialize the IM.  */
+	XFree( xim );
+ 	lock = False;
+ 	icb->call = True;
+ 	callback( display, client_data, NULL );
+-- 
+2.27.0
+
--- a/backport-CVE-2023-3138.patch
+++ b/backport-CVE-2023-3138.patch
@ -0,0 +1,108 @@
+From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 10 Jun 2023 16:30:07 -0700
+Subject: [PATCH] InitExt.c: Add bounds checks for extension request, event, &
+ error codes
+
+Fixes CVE-2023-3138: X servers could return values from XQueryExtension
+that would cause Xlib to write entries out-of-bounds of the arrays to
+store them, though this would only overwrite other parts of the Display
+struct, not outside the bounds allocated for that structure.
+
+Reported-by: Gregory James DUCK <gjduck@gmail.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+diff --git a/src/InitExt.c b/src/InitExt.c
+index 4de46f15..afc00a6b 100644
+--- a/src/InitExt.c
+++ b/src/InitExt.c
+@@ -33,6 +33,18 @@ from The Open Group.
+ #include <X11/Xos.h>
+ #include <stdio.h>
+ 
+/* The X11 protocol spec reserves events 64 through 127 for extensions */
+#ifndef LastExtensionEvent
+#define LastExtensionEvent 127
+#endif
+
+/* The X11 protocol spec reserves requests 128 through 255 for extensions */
+#ifndef LastExtensionRequest
+#define FirstExtensionRequest 128
+#define LastExtensionRequest 255
+#endif
+
+
+ /*
+  * This routine is used to link a extension in so it will be called
+  * at appropriate times.
+@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent(
+ 	WireToEventType proc)	/* routine to call when converting event */
+ {
+ 	register WireToEventType oldproc;
+	if (event_number < 0 ||
+	    event_number > LastExtensionEvent) {
+	    fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
+		    event_number);
+	    return (WireToEventType)_XUnknownWireEvent;
+	}
+ 	if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent;
+ 	LockDisplay (dpy);
+ 	oldproc = dpy->event_vec[event_number];
+@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie(
+     )
+ {
+ 	WireToEventCookieType oldproc;
+	if (extension < FirstExtensionRequest ||
+	    extension > LastExtensionRequest) {
+	    fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
+		    extension);
+	    return (WireToEventCookieType)_XUnknownWireEventCookie;
+	}
+ 	if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie;
+ 	LockDisplay (dpy);
+ 	oldproc = dpy->generic_event_vec[extension & 0x7F];
+@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie(
+     )
+ {
+ 	CopyEventCookieType oldproc;
+	if (extension < FirstExtensionRequest ||
+	    extension > LastExtensionRequest) {
+	    fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
+		    extension);
+	    return (CopyEventCookieType)_XUnknownCopyEventCookie;
+	}
+ 	if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie;
+ 	LockDisplay (dpy);
+ 	oldproc = dpy->generic_event_copy_vec[extension & 0x7F];
+@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire(
+ 	EventToWireType proc)	/* routine to call when converting event */
+ {
+ 	register EventToWireType oldproc;
+	if (event_number < 0 ||
+	    event_number > LastExtensionEvent) {
+	    fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
+		    event_number);
+	    return (EventToWireType)_XUnknownNativeEvent;
+	}
+ 	if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent;
+ 	LockDisplay (dpy);
+ 	oldproc = dpy->wire_vec[event_number];
+@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError(
+ 	WireToErrorType proc)	/* routine to call when converting error */
+ {
+ 	register WireToErrorType oldproc = NULL;
+	if (error_number < 0 ||
+	    error_number > LastExtensionError) {
+	   fprintf(stderr, "Xlib: ignoring invalid extension error %d\n",
+		    error_number);
+	   return (WireToErrorType)_XDefaultWireError;
+	}
+ 	if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError;
+ 	LockDisplay (dpy);
+ 	if (!dpy->error_vec) {
+-- 
+GitLab
+
--- a/backport-CVE-2023-43785.patch
+++ b/backport-CVE-2023-43785.patch
@ -0,0 +1,58 @@
+From 6858d468d9ca55fb4c5fd70b223dbc78a3358a7f Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 17 Sep 2023 14:19:40 -0700
+Subject: [PATCH] CVE-2023-43785: out-of-bounds memory access in
+ _XkbReadKeySyms()
+
+Make sure we allocate enough memory in the first place, and
+also handle error returns from _XkbReadBufferCopyKeySyms() when
+it detects out-of-bounds issues.
+
+Reported-by: Gregory James DUCK <gjduck@gmail.com>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/xkb/XKBGetMap.c | 14 +++++++++-----
+ 1 file changed, 9 insertions(+), 5 deletions(-)
+
+diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
+index 2891d21e..31199e4a 100644
+--- a/src/xkb/XKBGetMap.c
+++ b/src/xkb/XKBGetMap.c
+@@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
+             if (offset + newMap->nSyms >= map->size_syms) {
+                 register int sz;
+ 
+-                sz = map->size_syms + 128;
+                sz = offset + newMap->nSyms;
+                sz = ((sz + (unsigned) 128) / 128) * 128;
+                 _XkbResizeArray(map->syms, map->size_syms, sz, KeySym);
+                 if (map->syms == NULL) {
+                     map->size_syms = 0;
+@@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
+                 map->size_syms = sz;
+             }
+             if (newMap->nSyms > 0) {
+-                _XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
+-                                          newMap->nSyms);
+                if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
+                                              newMap->nSyms) == 0)
+                    return BadLength;
+                 offset += newMap->nSyms;
+             }
+             else {
+@@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
+             newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp);
+             if (newSyms == NULL)
+                 return BadAlloc;
+-            if (newMap->nSyms > 0)
+-                _XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms);
+            if (newMap->nSyms > 0) {
+                if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0)
+                    return BadLength;
+            }
+             else
+                 newSyms[0] = NoSymbol;
+             oldMap->kt_index[0] = newMap->ktIndex[0];
+-- 
+GitLab
+
--- a/backport-CVE-2023-43787.patch
+++ b/backport-CVE-2023-43787.patch
@ -0,0 +1,59 @@
+From 7916869d16bdd115ac5be30a67c3749907aea6a0 Mon Sep 17 00:00:00 2001
+From: Yair Mizrahi <yairm@jfrog.com>
+Date: Thu, 7 Sep 2023 16:15:32 -0700
+Subject: [PATCH] CVE-2023-43787: Integer overflow in XCreateImage() leading to
+ a heap overflow
+
+When the format is `Pixmap` it calculates the size of the image data as:
+    ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
+There is no validation on the `width` of the image, and so this
+calculation exceeds the capacity of a 4-byte integer, causing an overflow.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+---
+ src/ImUtil.c | 20 +++++++++++++++-----
+ 1 file changed, 15 insertions(+), 5 deletions(-)
+
+diff --git a/src/ImUtil.c b/src/ImUtil.c
+index 36f08a03..fbfad33e 100644
+--- a/src/ImUtil.c
+++ b/src/ImUtil.c
+@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
+ #include <X11/Xlibint.h>
+ #include <X11/Xutil.h>
+ #include <stdio.h>
+#include <limits.h>
+ #include "ImUtil.h"
+ 
+ static int _XDestroyImage(XImage *);
+@@ -361,13 +362,22 @@ XImage *XCreateImage (
+ 	/*
+ 	 * compute per line accelerator.
+ 	 */
+-	{
+-	if (format == ZPixmap)
+	if (format == ZPixmap) {
+	    if ((INT_MAX / bits_per_pixel) < width) {
+		Xfree(image);
+		return NULL;
+	    }
+
+ 	    min_bytes_per_line =
+-	       ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
+-	else
+		ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
+	} else {
+	    if ((INT_MAX - offset) < width) {
+		Xfree(image);
+		return NULL;
+	    }
+
+ 	    min_bytes_per_line =
+-	        ROUNDUP((width + offset), image->bitmap_pad);
+		ROUNDUP((width + offset), image->bitmap_pad);
+ 	}
+ 	if (image_bytes_per_line == 0) {
+ 	    image->bytes_per_line = min_bytes_per_line;
+-- 
+GitLab
+
--- a/libX11.spec
+++ b/libX11.spec
@ -1,6 +1,6 @@
 Name:		libX11
 Version:	1.6.9
-Release:	3
+Release:	8
 Summary:	Core X11 protocol client library
 License:	MIT
 URL:		http://www.x.org
@ -8,6 +8,18 @@ Source0:	https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.

 Patch1:         dont-forward-keycode-0.patch
 Patch2:         CVE-2020-14344.patch
+Patch3:         CVE-2020-14363.patch
+Patch4:         CVE-2021-31535.patch
+Patch6001:	backport-CVE-2022-3554.patch
+Patch6002:	backport-0001-CVE-2022-3555.patch
+Patch6003:	backport-0002-CVE-2022-3555.patch
+Patch6004:	backport-CVE-2023-3138.patch
+Patch6005:	backport-CVE-2023-43785.patch
+Patch6006:	backport-0001-CVE-2023-43786.patch
+Patch6007:	backport-0002-CVE-2023-43786.patch
+Patch6008:	backport-0003-CVE-2023-43786.patch
+Patch6009:	backport-CVE-2023-43787.patch
+
 BuildRequires:	xorg-x11-util-macros >= 1.11 xorg-x11-proto-devel perl-Pod-Usage libXau-devel
 BuildRequires:  libxcb-devel >= 1.2 libXdmcp-devel xorg-x11-xtrans-devel >= 1.0.3-4

@ -73,6 +85,27 @@ make %{?_smp_mflags} check
 %{_mandir}/*/*

 %changelog
+* Wed Oct 04 2023 Funda Wang <fundawang@yeah.net> - 1.6.9-8
+- Fix CVE-2023-43785, CVE-2023-43786, CVE-2023-43787
+
+* Mon Jun 19 2023 liweigang <liweiganga@uniontech.com> - 1.6.9-7
+- fix CVE-2023-3138
+
+* Mon Oct 24 2022 zhouwenpei <zhouwenpei1@h-partners.com> - 1.6.9-6
+- fix CVE-2022-3554,CVE-2022-3555
+
+* Fri Jun 11 2021 zhanglin <lin.zhang@turbolinux.com.cn> - 1.6.9-5
+- Type:bugfix
+- Id:NA
+- SUG:NA
+- DESC:fix CVE-2021-31535
+
+* Fri Sep 30 2020 chengguipeng<chenguipeng1@huawei.com> - 1.6.9-4
+- Type:bugfix
+- Id:NA
+- SUG:NA
+- DESC:fix CVE-2020-14363
+
 * Thu Sep 17 2020 jinzhimin <jinzhimin2@huawei.com> - 1.6.9-3
 - Type:bugfix
 - Id:NA
Author	SHA1	Message	Date
openeuler-ci-bot	7d3558beac	!63 [sync] PR-60: Fix CVE-2023-43785, CVE-2023-43786, CVE-2023-43787 From: @openeuler-sync-bot Reviewed-by: @weigangli Signed-off-by: @weigangli	2023-10-07 09:26:05 +00:00
root	f7947f9e1c	Fix CVE-2023-43785, CVE-2023-43786, CVE-2023-43787 (cherry picked from commit 20fbd7807b4f770303389b79d43362456e1b82d1)	2023-10-07 17:08:58 +08:00
openeuler-ci-bot	f8dea4b866	!47 fix CVE-2023-3138 From: @leeffo Reviewed-by: @weidongkl Signed-off-by: @weidongkl	2023-06-19 09:46:37 +00:00
leeffo	9b7800d488	fix CVE-2023-3138	2023-06-19 16:21:21 +08:00
openeuler-ci-bot	8e8f2e2489	!34 [sync] PR-32: fix CVE-2022-3554,CVE-2022-3555 From: @openeuler-sync-bot Reviewed-by: @t_feng Signed-off-by: @t_feng	2022-10-24 12:21:21 +00:00
zhouwenpei	b4fa1f1db8	fix CVE-2022-3554,CVE-2022-3555 (cherry picked from commit dbfb5bc7eb17fcf215000a0c45f6e14520ab4a51)	2022-10-24 19:54:44 +08:00
openeuler-ci-bot	580726085b	!14 bugfix CVE-2021-31535 From: @zhang__3125 Reviewed-by: @dwl301 Signed-off-by: @dwl301	2021-06-11 06:22:59 +00:00
linz	9fee15c0e8	bugfix CVE-2021-31535	2021-06-11 14:09:36 +08:00
linz	f96cc0fe88	bugfix CVE-2021-31535	2021-06-11 14:03:07 +08:00
openeuler-ci-bot	df236c6689	!10 fix CVE-2020-14363 From: @chengguipeng_xian Reviewed-by: @orange-snn Signed-off-by: @orange-snn	2020-09-30 16:09:02 +08:00
chengguipeng	c907aca76c	libX11: Fix CVE-2020-14363 Signed-off-by: chengguipeng <chengguipeng1@huawei.com>	2020-09-30 15:27:57 +08:00