Commit Graph

59 Commits

Author SHA1 Message Date
matthieu
3e22cb884a Update to libXfont 1.5.2 2016-09-02 11:00:05 +00:00
dcoppa
04fa58073a Bump following freetype update.
Suggested by sthen@

ok sthen@, naddy@, matthieu@
2016-05-29 11:59:59 +00:00
okan
27f67406f3 Remove support vax and XENOCARA_HAVE_SHARED_LIBS scaffolding.
ok matthieu@
2016-03-11 13:09:42 +00:00
matthieu
9b9b8ffe5b Update to libXfont 1.5.1.
Contains fixes for following issues:
CVE-2015-1802: bdfReadProperties: property count needs range check
CVE-2015-1803: bdfReadCharacters: bailout if a char's bitmap cannot be read
CVE-2015-1804: bdfReadCharacters: ensure metrics fit into xCharInfo struct
2015-03-17 20:42:25 +00:00
matthieu
e4c13334f7 Missed file in libXfont 1.5.0 update 2014-09-27 17:43:02 +00:00
matthieu
e4967fc3e9 Update to libXfont 1.5.0
Tested together with xserver 1.16.1 by naddy@, jsg@ & kettenis@
2014-09-27 17:42:14 +00:00
matthieu
4bd039500e Update to libXfont 1.4.8 2014-05-18 12:13:54 +00:00
matthieu
05ed5123d1 Security fixes from X.Org Advisory:
X Font Service Protocol & Font metadata file handling issues in libXfont
May 13, 2014

- CVE-2014-0209: integer overflow of allocations in font metadata file parsing

    When a local user who is already authenticated to the X server adds
    a new directory to the font path, the X server calls libXfont to open
    the fonts.dir and fonts.alias files in that directory and add entries
    to the font tables for every line in it.  A large file (~2-4 gb) could
    cause the allocations to overflow, and allow the remaining data read
    from the file to overwrite other memory in the heap.

    Affected functions: FontFileAddEntry(), lexAlias()

- CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies

    When parsing replies received from the font server, these calls do not
    check that the lengths and/or indexes returned by the font server are
    within the size of the reply or the bounds of the memory allocated to
    store the data, so could write past the bounds of allocated memory when
    storing the returned data.

    Affected functions: _fs_recv_conn_setup(), fs_read_open_font(),
    fs_read_query_info(), fs_read_extent_info(), fs_read_glyphs(),
    fs_read_list(), fs_read_list_info()

- CVE-2014-0211: integer overflows calculating memory needs for xfs replies

    These calls do not check that their calculations for how much memory
    is needed to handle the returned data have not overflowed, so can
    result in allocating too little memory and then writing the returned
    data past the end of the allocated buffer.

    Affected functions: fs_get_reply(), fs_alloc_glyphs(),
    fs_read_extent_info()

Reported by Ilja van Sprundel of IOActive
Fixes by Alan Coopersmith of Oracle
2014-05-13 19:09:22 +00:00
matthieu
4d9b427baa Update to libXfont 1.4.7. Include fix for CVE-2013-6462.
unlimited sscanf overflows stack buffer in bdfReadCharacters
2014-01-07 20:42:20 +00:00
matthieu
abfe418ba3 A local change that can go now that vax is gcc 3 and ELF 2013-08-18 10:58:04 +00:00
matthieu
38bd1cf7e1 Reduce diff with upstreams. (white space) 2013-08-18 10:43:33 +00:00
matthieu
16bd5f45e6 Update to libXfont 1.4.6. 2013-08-18 10:36:20 +00:00
guenther
b5bb12998e Bump the major on every single base library. There are a couple
not bumped by this that will be corrected soon.

heavy lifting by todd@
2013-08-13 07:07:07 +00:00
matthieu
f472553514 Update to libXfont 1.4.5 2012-03-04 18:13:46 +00:00
matthieu
9993018eda Update to libXfont 1.4.4 2011-09-10 09:31:51 +00:00
todd
3e2ff7b40f fix from matthieu@ as applied upstream for CVE-2011-2895
ok deraadt@
2011-08-11 15:29:02 +00:00
miod
47b6998e0f Enable weak symbols under OpenBSD on non-ELF platforms, too.
ok matthieu@ todd@
2011-01-20 21:43:47 +00:00
matthieu
654eabe550 Fix weak symbols declarations for gcc 2.95 2010-11-02 07:51:54 +00:00
matthieu
31eafa7442 Update to libXfont 1.4.3. No functional change. 2010-10-31 15:09:45 +00:00
matthieu
f42887fa64 Update to libXfont 1.4.2 2010-09-04 10:37:30 +00:00
matthieu
9b4b09eb28 regen 2010-01-17 20:49:46 +00:00
matthieu
2dda0f8061 Use the new XORG_WITH_XMLTO macro in configure scripts and explicitely
disable it during Xenocara builds. Problem reported by kili@ who also
tested this patch with an earlier version of the macro.
2010-01-17 20:48:49 +00:00
matthieu
ac420781e2 missed files during libXfont 1.4.1 update. 2009-10-31 21:03:28 +00:00
matthieu
c1572e04e6 Update to libXfont 1.4.1 2009-10-31 17:57:11 +00:00
matthieu
4d2e193a43 Use XENOCARA_HAVE_SHARED_LIBS and remove duplicate lines. 2009-06-04 00:40:05 +00:00
matthieu
b6e6f0b4c0 merge libXfont 1.3.2. bump major since some symbols were removed. 2008-05-24 13:29:07 +00:00
matthieu
7830df18ed Regen with autoconf 2.59-p2, with AM_SANITY check zapped. 2008-03-15 18:08:24 +00:00
matthieu
4ca84ce6c5 Fix from X.Org for CVE-2008-0006 - PCF Font parser buffer overflow. 2008-01-17 15:44:49 +00:00
matthieu
4ff8d6b770 Fix build with gcc 2.95. 2007-12-14 07:31:35 +00:00
matthieu
ab927dd41b merge libXfont 1.3.1 2007-11-24 14:38:25 +00:00
matthieu
9a72b78842 libXfont 1.3.1 2007-11-24 14:31:47 +00:00
matthieu
a39960ebe1 Merge libXfont 1.3.0. Tested by naddy@ and mbalmer@. 2007-09-08 16:24:20 +00:00
matthieu
82525649d2 import libXfont 1.3.0 2007-09-08 16:13:41 +00:00
matthieu
8370179c25 regen 2007-07-29 10:50:16 +00:00
matthieu
bd6867077c Disable loadable font modules on static only architectures. 2007-05-08 09:00:45 +00:00
matthieu
930101c636 regen with libtool 1.5.22p10 and metaauto 0.7 2007-04-14 20:44:09 +00:00
matthieu
1330b0c255 libXfont requires -lz and -lm 2007-04-08 21:28:03 +00:00
matthieu
a12195252b No loadable font modules on static only architectures. 2007-04-08 18:16:10 +00:00
matthieu
1cc1a05d6b merge libXfont 1.2.8 2007-04-08 18:14:31 +00:00
matthieu
7b635a2b61 import libXfont 1.2.8 2007-04-08 17:56:34 +00:00
todd
517a55a2c5 bdf CVE-2007-1351
BDFFont Parsing Integer Overflow Vulnerability

The discoverer of this vulnerability wishes to remain anonymous.

from matthieu@
2007-04-04 02:51:57 +00:00
todd
dd8e595ee8 fontdir CVE-2007-1352
fonts.dir File Parsing Integer Overflow Vulnerability

The discoverer of this vulnerability wishes to remain anonymous.

from matthieu@
2007-04-04 02:51:26 +00:00
matthieu
77cb7f251b Revert local debug stuff that wasn't meant to be committed. 2007-03-25 13:22:40 +00:00
matthieu
00a847b3f8 regen with libtool 1.5.22p9 2007-03-25 13:02:54 +00:00
matthieu
6637a9a36e regen with automake 1.9.6p2 2007-03-18 22:29:12 +00:00
matthieu
45c07b00ec regen 2007-03-03 10:17:40 +00:00
matthieu
0516542416 Import libXfont version 1.2.7 2007-03-03 10:09:47 +00:00
matthieu
500e16d1e2 - merge libXfont 1.2.6
- regen generated files
2006-12-16 21:50:27 +00:00
matthieu
8ae8ea3af8 libXfont 1.2.6 2006-12-16 21:44:25 +00:00
matthieu
bdebc31c36 bump major 2006-12-16 18:30:24 +00:00