1. 15 Jan, 2021 8 commits
  2. 30 Dec, 2020 1 commit
  3. 10 Dec, 2020 1 commit
    • Mike Gabriel's avatar
      CVE-2020-14360: Check SetMap request length carefully. · d5a3b440
      Mike Gabriel authored
        Backported from X.org:
      
        From 446ff2d3177087b8173fa779fa5b77a2a128988b Mon Sep 17 00:00:00 2001
        From: Matthieu Herrb <matthieu@herrb.eu>
        Date: Thu, 12 Nov 2020 19:15:07 +0100
        Subject: [PATCH] Check SetMap request length carefully.
      
        Avoid out of bounds memory accesses on too short request.
      
        ZDI-CAN 11572 /  CVE-2020-14360
      
        This vulnerability was discovered by:
        Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
      
        Fixes ArcticaProject/nx-libs#972.
      d5a3b440
  4. 03 Dec, 2020 1 commit
  5. 04 Nov, 2020 6 commits
  6. 03 Nov, 2020 22 commits
    • Ulrich Sibiller's avatar
      Clipboard.c: fix bug in special optimization for nested settings · b07b6c53
      Ulrich Sibiller authored
      Fixes ArcticaProject/nx-libs#941
      b07b6c53
    • Ulrich Sibiller's avatar
      compext/Png.c: fix shadowing · 522eea6f
      Ulrich Sibiller authored
      Png.c: In function ‘PngWriteData’:
      Png.c:603:38: warning: declaration of ‘png_ptr’ shadows a global declaration [-Wshadow]
        603 | static void PngWriteData(png_structp png_ptr, png_bytep data, png_size_t length)
            |                          ~~~~~~~~~~~~^~~~~~~
      Png.c:77:13: note: shadowed declaration is here
         77 | png_structp png_ptr;
            |             ^~~~~~~
      Png.c: In function ‘PngFlushData’:
      Png.c:610:38: warning: declaration of ‘png_ptr’ shadows a global declaration [-Wshadow]
        610 | static void PngFlushData(png_structp png_ptr)
            |                          ~~~~~~~~~~~~^~~~~~~
      Png.c:77:13: note: shadowed declaration is here
         77 | png_structp png_ptr;
            |             ^~~~~~~
      522eea6f
    • Ulrich Sibiller's avatar
    • Ulrich Sibiller's avatar
      Atoms.c: fix FIXME comment · f1e543b0
      Ulrich Sibiller authored
      f1e543b0
    • Ulrich Sibiller's avatar
      Atoms.c: improve debug output · 4460183a
      Ulrich Sibiller authored
      4460183a
    • Ulrich Sibiller's avatar
      Events.c: scope improvement · 8b0bb28e
      Ulrich Sibiller authored
      8b0bb28e
    • Ulrich Sibiller's avatar
      Log.h: fix some shadow warnings · e66d2c86
      Ulrich Sibiller authored
      "warning: declaration of '<something>' shadows a member of 'this'
      
      This shows up in gcc 4.8.5 and has been fixed in gcc 5.0, see
      https://gcc.gnu.org/bugzilla/show_bug.cgi?id=57709
      
      Change the variable names anyway to be on the safe side.
      
      Fixes ArcticaProject/nx-libs#958
      e66d2c86
    • Ulrich Sibiller's avatar
      Channel.h: rename variable to prevent shadowing · 2c66355c
      Ulrich Sibiller authored
      In file included from Proxy.h:39:0,
                       from ServerProxy.h:32,
                       from ServerProxy.cpp:36:
      Channel.h: In member function 'int Channel::handleEncodeIdentity(EncodeBuffer&, ChannelCache*, MessageStore*, const unsigned char*, unsigned int, int)':
      Channel.h:369:3: warning: declaration of 'bigEndian' shadows a member of 'this' [-Wshadow]
         {
         ^
      Channel.h: In member function 'int Channel::handleDecodeIdentity(DecodeBuffer&, ChannelCache*, MessageStore*, unsigned char*&, unsigned int&, int, WriteBuffer*)':
      Channel.h:378:3: warning: declaration of 'bigEndian' shadows a member of 'this' [-Wshadow]
         {
         ^
      
      RHEL7's g++ 4.8.5 reports this while Debian's g++ 10.2.0-15 does
      not. This is described in
      https://gcc.gnu.org/bugzilla/show_bug.cgi?id=57709 and fixed in gcc
      5.0.
      
      Rename the variables anyway to be on the safe side.
      
      Fixes ArcticaProject/nx-libs#956
      2c66355c
    • Ulrich Sibiller's avatar
      nx-libs.spec: Set python shebang to python3 on fedora and rhel8 · 5bd72aec
      Ulrich Sibiller authored
      *** ERROR: ambiguous python shebang in /usr/bin/nxdialog: #!/usr/bin/env
      python. Change it to python3 (or python2) explicitly.
      
      Fedora offers a pythfix.py but I could not test with that so I simply
      used sed...
      
      Fixes ArcticaProject/nx-libs#955
      5bd72aec
    • Ulrich Sibiller's avatar
      1701a4a4
    • Ulrich Sibiller's avatar
      Clipboard.c: add missing ifdefs · ebee6af0
      Ulrich Sibiller authored
      ebee6af0
    • Ulrich Sibiller's avatar
      Compext.c: scope improvements · 06173efd
      Ulrich Sibiller authored
      06173efd
    • Ulrich Sibiller's avatar
      GCs.h: fix typo · ee379d3a
      Ulrich Sibiller authored
      ee379d3a
    • Ulrich Sibiller's avatar
      Atoms.c: drop double include · 8bfe760d
      Ulrich Sibiller authored
      8bfe760d
    • Ulrich Sibiller's avatar
      Compext.c: use SAFE_free macro · 447ee157
      Ulrich Sibiller authored
      447ee157
    • Ulrich Sibiller's avatar
      Clipboard.c: fix missing ) · edb5a918
      Ulrich Sibiller authored
      edb5a918
    • Mike Gabriel's avatar
    • Mike Gabriel's avatar
    • Mike Gabriel's avatar
      ced973e3
    • Ulrich Sibiller's avatar
      NXdixfonts.c: fix memory leak · db45683a
      Ulrich Sibiller authored
      ==15332== 2,500 (96 direct, 2,404 indirect) bytes in 6 blocks are definitely lost in loss record 324 of 342
      ==15332==    at 0x4C2DB8F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==15332==    by 0x5748B9E: FontFileStartListFonts (in /usr/lib/x86_64-linux-gnu/libXfont.so.1.4.1)
      ==15332==    by 0x5748C4A: FontFileStartListFontsAndAliases (in /usr/lib/x86_64-linux-gnu/libXfont.so.1.4.1)
      ==15332==    by 0x42859A: nxdoListFontsAndAliases (NXdixfonts.c:1163)
      ==15332==    by 0x42C0E0: nxOpenFont (NXdixfonts.c:1541)
      ==15332==    by 0x43392E: ProcOpenFont (NXdispatch.c:902)
      ==15332==    by 0x434585: Dispatch (NXdispatch.c:482)
      ==15332==    by 0x40EF77: main (main.c:355)
      
      FontFileStartListFonts[AndAliases]() allocates some private data. This
      data is used by subsequent calls of FontFileListNextFontOrAlias() in a
      loop. (Only) the last call to that function will free() the private
      data and return with BadFontName.  FontFileListNextFontOrAlias() is
      the only libXfont function that free()s the private data.
      
      In nxagent the loop is exited as soon as a font exists both locally
      and remote. Therefore the private data would never be free()d.
      
      Solution: do not break the loop but store the first matching result
      and let the loop run to the end, ignoring all following results.
      
      Disadvantage: this can mean hundreds of extra iterations for
      nothing. I have done no investigation of the time penalty this might
      cause.
      
      Unfortunately this is the only clean way I have found so far.
      
      An unclean solution has also been implemented. It can be activated by
      defining BREAK_XFONT_LOOP. In that case the private data is handled in
      nxagent by taking assumptions about its structure (taken from the
      libXfont source). That will break if libXfont changes its internal
      handling of the private. Therefore it is discouraged.
      
      An third alternative would be to drop using libXfont from the
      system. Instead fork libXfont to the nx-libs tree, add some patches
      link to that library statically.
      
      Fixes ArcticaProject/nx-libs#586
      db45683a
    • Mike Gabriel's avatar
      14df32cd
    • Ulrich Sibiller's avatar
      yConnDis.c: fix memory leak · 12b22e97
      Ulrich Sibiller authored
       Direct leak of 3 byte(s) in 1 object(s) allocated from:
       #0 0xb79e85d4 in __interceptor_malloc (/lib/i386-linux-gnu/libasan.so.5+0xeb5d4)
       #1 0xb770b635 in copystring /home/uli/work/nx/nx-libs/nx-X11/lib/src/ConnDis.c:96
       #2 0xb770ba56 in _X11TransConnectDisplay /home/uli/work/nx/nx-libs/nx-X11/lib/src/ConnDis.c:229
       #3 0xb776b4fd in XOpenDisplay /home/uli/work/nx/nx-libs/nx-X11/lib/src/OpenDis.c:215
       #4 0x63e2fd in nxagentInternalOpenDisplay /home/uli/work/nx/nx-libs/nx-X11/programs/Xserver/hw/nxagent/Display.c:608
       #5 0x63fa03 in nxagentOpenDisplay /home/uli/work/nx/nx-libs/nx-X11/programs/Xserver/hw/nxagent/Display.c:1140
       #6 0x694b5a in InitOutput /home/uli/work/nx/nx-libs/nx-X11/programs/Xserver/hw/nxagent/Init.c:305
       #7 0x5f7b11 in main /home/uli/work/nx/nx-libs/nx-X11/programs/Xserver/dix/main.c:278
       #8 0xb6f04b40 in __libc_start_main ../csu/libc-start.c:308
      
      I have not investigated the exact location where an XFree() was missing but added multiple
      Xfree() calls whereever appropriate.
      
      Fixes ArcticaProject/nx-libs#951
      12b22e97
  7. 02 Nov, 2020 1 commit