From dcee38345553b71b3f70b1b9d40e1d9b7915e187 Mon Sep 17 00:00:00 2001 From: maxice8 Date: Mon, 7 Jan 2019 02:21:23 -0200 Subject: [PATCH] libvncserver: update to 0.9.12. --- .../libvncserver/patches/CVE-2018-7225.patch | 61 ------------------- srcpkgs/libvncserver/template | 18 ++---- 2 files changed, 6 insertions(+), 73 deletions(-) delete mode 100644 srcpkgs/libvncserver/patches/CVE-2018-7225.patch diff --git a/srcpkgs/libvncserver/patches/CVE-2018-7225.patch b/srcpkgs/libvncserver/patches/CVE-2018-7225.patch deleted file mode 100644 index 1903ed7295d..00000000000 --- a/srcpkgs/libvncserver/patches/CVE-2018-7225.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 28afb6c537dc82ba04d5f245b15ca7205c6dbb9c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= -Date: Mon, 26 Feb 2018 13:48:00 +0100 -Subject: [PATCH] Limit client cut text length to 1 MB - -This patch constrains a client cut text length to 1 MB. Otherwise -a client could make server allocate 2 GB of memory and that seems to -be to much to classify it as a denial of service. - -The limit also prevents from an integer overflow followed by copying -an uninitilized memory when processing msg.cct.length value larger -than SIZE_MAX or INT_MAX - sz_rfbClientCutTextMsg. - -This patch also corrects accepting length value of zero (malloc(0) is -interpreted on differnet systems differently). - -CVE-2018-7225 - ---- - libvncserver/rfbserver.c | 20 +++++++++++++++++++- - 1 file changed, 19 insertions(+), 1 deletion(-) - -diff --git a/libvncserver/rfbserver.c b/libvncserver/rfbserver.c -index 116c4889..4fc4d9d5 100644 ---- libvncserver/rfbserver.c -+++ libvncserver/rfbserver.c -@@ -88,6 +88,8 @@ - #include - /* strftime() */ - #include -+/* PRIu32 */ -+#include - - #ifdef LIBVNCSERVER_WITH_WEBSOCKETS - #include "rfbssl.h" -@@ -2575,7 +2577,23 @@ rfbProcessClientNormalMessage(rfbClientPtr cl) - - msg.cct.length = Swap32IfLE(msg.cct.length); - -- str = (char *)malloc(msg.cct.length); -+ /* uint32_t input is passed to malloc()'s size_t argument, -+ * to rfbReadExact()'s int argument, to rfbStatRecordMessageRcvd()'s int -+ * argument increased of sz_rfbClientCutTextMsg, and to setXCutText()'s int -+ * argument. Here we impose a limit of 1 MB so that the value fits -+ * into all of the types to prevent from misinterpretation and thus -+ * from accessing uninitialized memory (CVE-2018-7225) and also to -+ * prevent from a denial-of-service by allocating to much memory in -+ * the server. */ -+ if (msg.cct.length > 1<<20) { -+ rfbLog("rfbClientCutText: too big cut text length requested: %" PRIu32 "\n", -+ msg.cct.length); -+ rfbCloseClient(cl); -+ return; -+ } -+ -+ /* Allow zero-length client cut text. */ -+ str = (char *)calloc(msg.cct.length ? msg.cct.length : 1, 1); - if (str == NULL) { - rfbLogPerror("rfbProcessClientNormalMessage: not enough memory"); - rfbCloseClient(cl); - diff --git a/srcpkgs/libvncserver/template b/srcpkgs/libvncserver/template index 68d173ecd7b..1fa785c5dd3 100644 --- a/srcpkgs/libvncserver/template +++ b/srcpkgs/libvncserver/template @@ -1,30 +1,24 @@ # Template file for 'libvncserver' pkgname=libvncserver -version=0.9.11 -revision=6 +version=0.9.12 +revision=1 wrksrc="libvncserver-LibVNCServer-${version}" -build_style=gnu-configure -hostmakedepends="automake libtool pkg-config" +build_style=cmake +hostmakedepends="pkg-config" makedepends="zlib-devel libjpeg-turbo-devel libpng-devel libressl-devel gnutls-devel" short_desc="C libraries to easily implement VNC server or client functionality" maintainer="Juan RP " license="GPL-2.0-or-later" homepage="https://libvnc.github.io/" distfiles="https://github.com/LibVNC/libvncserver/archive/LibVNCServer-${version}.tar.gz" -checksum=193d630372722a532136fd25c5326b2ca1a636cbb8bf9bb115ef869c804d2894 - -pre_configure() { - autoreconf -fi -} +checksum=33cbbb4e15bb390f723c311b323cef4a43bcf781984f92d92adda3243a116136 libvncserver-devel_package() { depends="${makedepends} ${sourcepkg}-${version}_${revision}" short_desc+=" - development files" pkg_install() { - vmove usr/bin/libvncserver-config vmove usr/include - vmove usr/lib/*.a - vmove usr/lib/*.so + vmove "usr/lib/*.so" vmove usr/lib/pkgconfig } }