Bug 327854 (CVE-2007-5199)

Jörg,
can you add the affected code snippet please.


The only occurrence I found: 10.2/xorg-x11-libs/libXfont-1.2.3.tar.bz2

include/X11/fonts/fntfil.h:#define MAXFONTFILENAMELEN  1024

in src/fontfile/catalogue.c:
[[[
static int
CatalogueRescan (FontPathElementPtr fpe)
{
[...]
    char                dest[MAXFONTFILENAMELEN];
[...]
        len = readlink(link, dest, sizeof dest);
        if (len < 0)
            continue;

        dest[len] = '\0';
[...]
}
]]]

if the filename read via readlink now is 1024 chars long you set the 1025th byte to \0.

this only affects the 10.3/STABLE package.

Any patch available?

use:
len = readlink(link, dest, sizeof(dest)-1);

Thanks, Thomas. Yesterday I was just to tired to think about it myself. Am I allowed to fix this for 10.3/STABLE right now?

Hm, I am not sure if this is public.

And I wonder wehy I didn't see the mail on the xorg-security list. I'll contact xorg-security@ directly... stay tuned.

catalogue dir support is a new feature, which came *after* openSUSE 10.2. I'll attach against openSUSE 10.3/STABLE.

Created attachment 174792 [details]
libXfont-off_by_one.diff

patch against openSUSE 10.3/STABLE

BTW, this is a security fix for a feature, SUSE currently does not use at all.
It would have been an interesting feature about 10 years ago, when client side font rendering didn't exist yet ...

commit 5bf703700ee4a5d6eae20da07cb7a29369667aef
Author: Matthieu Herrb <matthieu@bluenote.herrb.com>
Date:   Fri Sep 28 08:17:57 2007 +0200

    catalogue.c: prevent a one character overflow
    
    this occurs if readlink writes a result that's exactly the
    size of the buffer that's passed to it. Reported by
    Joerg Sonnenberger.
    
    Re

diff --git a/src/fontfile/catalogue.c b/src/fontfile/catalogue.c
index 33d4434..c0d90f8 100644
--- a/src/fontfile/catalogue.c
+++ b/src/fontfile/catalogue.c
@@ -156,7 +156,7 @@ CatalogueRescan (FontPathElementPtr fpe)
     while (entry = readdir(dir), entry != NULL)
     {
        snprintf(link, sizeof link, "%s/%s", path, entry->d_name);
-       len = readlink(link, dest, sizeof dest);
+       len = readlink(link, dest, sizeof dest - 1);
        if (len < 0)
            continue;
 

Only 10.3 and STABLE is affected by this and I'm not aware of any configuration tool, which currently generate such catalogue lines to xorg.conf. Should we provide an update for 10.3 at all or would it be enough
to apply the patch for STABLE?

Let's do it for 10.3 too it won't hurt.

Ok. I submitted xorg-x11-libs package now for 10.3 and STABLE. Could you provide a SWAMPID?

MaintenanceTracker-13588

- bug is still NOT PBLIC
- requested a CVE-ID

Thanks. Patchinfo file submitted.

--> /work/src/done/PATCHINFO/xorg-x11-libs.patchinfo

(In reply to comment #11 from Stefan Dirsch)
> Only 10.3 and STABLE is affected by this and I'm not aware of any configuration
> tool, which currently generate such catalogue lines to xorg.conf.

It is my understanding that a user can trigger this using xset +fp.

Joerg

(In reply to comment #16 from Thomas Biege)
> - bug is still NOT PBLIC
It's already in git (see comment #10), so it is just public.

CVE-2007-5199

released

https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=5bf703700ee4a5d6eae20da07cb7a29369667aef