via xorg_security, spotted by msrb

From: Michal Srb <msrb@suse.com>

If a pattern contains '?' character, any character in the string is skipped,
even if it is '\0'. The rest of the matching then reads invalid memory.
---
This may not even be considered security issue, but I am sending here first to
make sure.

It can be triggered with ProcOpenFont with long pattern consisting only of
question marks up to 255 characters long: "?????????????...??"

The invalid read is visible in valgrind:

==31824== Invalid read of size 1
==31824==    at 0x5A847BE: PatternMatch.part.0 (fontdir.c:406)
==31824==    by 0x5A84DFA: PatternMatch (fontdir.c:453)
==31824==    by 0x5A84DFA: FontFileFindNameInScalableDir (fontdir.c:458)
==31824==    by 0x5A86845: FontFileOpenFont.part.1 (fontfile.c:289)
==31824==    by 0x5024ED: doOpenFont (dixfonts.c:276)
==31824==    by 0x5029F1: OpenFont (dixfonts.c:442)
==31824==    by 0x5007BD: Dispatch (dispatch.c:430)
==31824==    by 0x5044FA: dix_main (main.c:300)
==31824==    by 0x66646E4: (below main) (libc-start.c:289)
==31824==  Address 0xbe97f5f is 17 bytes before a block of size 59 alloc'd
==31824==    at 0x4C29160: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==31824==    by 0x5A84BFB: FontFileAddEntry (fontdir.c:194)
==31824==    by 0x5A852E9: FontFileAddFontFile (fontdir.c:688)
==31824==    by 0x5A83D52: FontFileReadDirectory (dirfile.c:138)
==31824==    by 0x5A859D5: FontFileInitFPE (fontfile.c:94)
==31824==    by 0x5021B1: SetFontPathElements (dixfonts.c:1636)
==31824==    by 0x503ADC: SetDefaultFontPath (dixfonts.c:1748)
==31824==    by 0x50440B: dix_main (main.c:236)
==31824==    by 0x66646E4: (below main) (libc-start.c:289)


It could in theory crash X Server, but in my case it never did.


 src/fontfile/fontdir.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/fontfile/fontdir.c b/src/fontfile/fontdir.c
index 4ce2473..cc3e2a6 100644
--- a/src/fontfile/fontdir.c
+++ b/src/fontfile/fontdir.c
@@ -400,8 +400,12 @@ PatternMatch(char *pat, int patdashes, char *string, int stringdashes)
                }
            }
        case '?':
-           if (*string++ == XK_minus)
+           if ((t = *string++) == XK_minus) {
                stringdashes--;
+            } else {
+              if (!t)
+                  return 0;
+            }
            break;
        case '\0':
            return (*string == '\0');
-- 
2.12.3