05ed5123d1
X Font Service Protocol & Font metadata file handling issues in libXfont
May 13, 2014
- CVE-2014-0209: integer overflow of allocations in font metadata file parsing
When a local user who is already authenticated to the X server adds
a new directory to the font path, the X server calls libXfont to open
the fonts.dir and fonts.alias files in that directory and add entries
to the font tables for every line in it. A large file (~2-4 gb) could
cause the allocations to overflow, and allow the remaining data read
from the file to overwrite other memory in the heap.
Affected functions: FontFileAddEntry(), lexAlias()
- CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies
When parsing replies received from the font server, these calls do not
check that the lengths and/or indexes returned by the font server are
within the size of the reply or the bounds of the memory allocated to
store the data, so could write past the bounds of allocated memory when
storing the returned data.
Affected functions: _fs_recv_conn_setup(), fs_read_open_font(),
fs_read_query_info(), fs_read_extent_info(), fs_read_glyphs(),
fs_read_list(), fs_read_list_info()
- CVE-2014-0211: integer overflows calculating memory needs for xfs replies
These calls do not check that their calculations for how much memory
is needed to handle the returned data have not overflowed, so can
result in allocating too little memory and then writing the returned
data past the end of the allocated buffer.
Affected functions: fs_get_reply(), fs_alloc_glyphs(),
fs_read_extent_info()
Reported by Ilja van Sprundel of IOActive
Fixes by Alan Coopersmith of Oracle
|
||
|---|---|---|
| .. | ||
| doc | ||
| include/X11/fonts | ||
| src | ||
| aclocal.m4 | ||
| AUTHORS | ||
| ChangeLog | ||
| compile | ||
| config.guess | ||
| config.h.in | ||
| config.sub | ||
| configure | ||
| configure.ac | ||
| COPYING | ||
| depcomp | ||
| devbook.am | ||
| INSTALL | ||
| install-sh | ||
| ltmain.sh | ||
| Makefile.am | ||
| Makefile.bsd-wrapper | ||
| Makefile.in | ||
| missing | ||
| README | ||
| xfont.pc.in | ||
libXfont provides the core of the legacy X11 font system, handling the index files (fonts.dir, fonts.alias, fonts.scale), the various font file formats, and rasterizing them. It is used by the X servers, the X Font Server (xfs), and some font utilities (bdftopcf for instance), but should not be used by normal X11 clients. X11 clients access fonts via either the new API's in libXft, or the legacy API's in libX11. Please submit bugs & patches to the Xorg bugzilla: https://bugs.freedesktop.org/enter_bug.cgi?product=xorg All questions regarding this software should be directed at the Xorg mailing list: http://lists.freedesktop.org/mailman/listinfo/xorg The master development code repository can be found at: git://anongit.freedesktop.org/git/xorg/lib/libXfont http://cgit.freedesktop.org/xorg/lib/libXfont For more information on the git code manager, see: http://wiki.x.org/wiki/GitPage