Bugzilla Bug 130979

Bart Massey, a X.Org user reported that "When running rendertest from
XCB xcb/xcb-demo, the Xorg X server crashes partway through.  100%
reproducible on a wide variety of graphics architectures".

Analyzing the bug Eric Anholt found out that a typo in render/mitri.c
causes the X render extension to mis-calculate the size of a
buffer, leading to an overflow, which can problably be exploited by 
clients of the X server on most systems.

This is Freedesktop.org bugzilla #6642. It has been marked confidential, 
  after the security implications of the problem were identified.

X.Org releases 6.8.0 and later are affected by this bug. Previous 
versions (and XFree86 versions) are not affected.

Created an attachment (id=85279) [details]
xrender-mitri.diff

Upstream patch.

Donnie please advise on severity and attach an updated ebuild to this bug. We
will call Arch Security Liaisons to test. Do NOT commit anything yet.

For severity, you can just read the description. Buffer overflow, probably
exploitable by X clients (any X-using program).

I'll be pushing out a new 6.8.2-r7, 6.9-r1 and xorg-server 1.0.2 and
1.0.99.901-r2. Ah, the joys of so many parallel ebuilds.

Testers will probably want to test either 6.8.2 or 1.0.2, current stable and
~arch. Ebuilds coming today or tomorrow.

Thx Donnie, just remember don't commit the updates to Portage just yet:-)

You didn't need to tell me the first time, let alone a second. I don't really
appreciate being treated like I'm clueless.

To be on the safe side I'd rather say it too often. This was obviously too
often. I was just not sure after reading your comment #3, OTOH you've handled
stuff like this before and I should have remembered. Sorry about that.

Created an attachment (id=85322) [details]
modular patch

Created an attachment (id=85323) [details]
monolith patch

Created an attachment (id=85325) [details]
xorg-x11-6.8.2-r7.ebuild

Created an attachment (id=85326) [details]
xorg-x11-6.9.0-r1.ebuild

Created an attachment (id=85327) [details]
xorg-server-1.0.2-r4.ebuild

Created an attachment (id=85328) [details]
xorg-server-1.0.99.901-r2.ebuild

Thx Donnie.

Arch Security Liaisons please test and report back on this bug.

I've confirmed the fix no longer crashes the server. Although the rendertest
client crashes now, that's a separate issue.

(In reply to comment #14)
> I've confirmed the fix no longer crashes the server. Although the rendertest
> client crashes now, that's a separate issue.

I'm running xorg-x11-6.8.2-r6 on amd64 and I'd like to be able to confirm this.
I tried checking out xcb-demo from cvs because it appears that xcb-demo isn't
in portage. The cvs version fails on ./configure, it says:

    checking for XCB... configure: error: Package requirements (xcb) 
        were not met: No package 'xcb' found

and I have x11-misc/xcb-2.4 installed. Any hints?

http://webcvs.freedesktop.org/xcb/xcb-demo/
cvs -d :pserver:anoncvs@cvs.freedesktop.org:/cvs/xcb co xcb-demo

I have compile tested xorg-x11-6.8.2-r7 and xorg-server-1.0.2-r4 on PPC64 now.

they compile just fine, but unfortunately I don't have access to the bug on
fd.o bugzilla, so I don't know how to trigger this bug. Is there a testcase?

(In reply to comment #15)
> (In reply to comment #14)
> > I've confirmed the fix no longer crashes the server. Although the rendertest
> > client crashes now, that's a separate issue.
> 
> I'm running xorg-x11-6.8.2-r6 on amd64 and I'd like to be able to confirm this.
> I tried checking out xcb-demo from cvs because it appears that xcb-demo isn't
> in portage. The cvs version fails on ./configure, it says:
> 
>     checking for XCB... configure: error: Package requirements (xcb) 
>         were not met: No package 'xcb' found
> 
> and I have x11-misc/xcb-2.4 installed. Any hints?

X Cut Buffers != X C Bindings

XCB is no longer maintained in CVS, it's in git. You'll need to install stuff
in roughly this order: xcb-proto, xcb, xcb-util, xcb-demo.

Created an attachment (id=85366) [details]
xcb-build.diff

This hacky patch fixes the build of xcb-util and xcb-demos.

(In reply to comment #16)
> I have compile tested xorg-x11-6.8.2-r7 and xorg-server-1.0.2-r4 on PPC64 now.
> 
> they compile just fine, but unfortunately I don't have access to the bug on
> fd.o bugzilla, so I don't know how to trigger this bug. Is there a testcase?

As mentioned in comment #0, rendertest from xcb/xcb-demo is the testcase.
http://xcb.freedesktop.org/wiki/ has all the info.

Adding Ferris since he's our xorg man in the sparc team.

Um, for me, repoman hates -r6.

There's no -r6 anywhere on this bug, so it's a little unclear what you're
talking about.

Seems fine to me. (x86)

Seems fine to me. (amd64) 

Looks good on hppa

Looks good on sparc 2.6/ati-pci.

sparc with 2.6 kernel/sunffb video driver builds and seems fine when using
xorg-server-1.0.99.901-r2 + the modular patch.

Still missing test reports from alpha, ppc and ppc64 teams

cc'ign ferdy on behalf of alpha.

Looks ok on Alpha.

6.8.2-r7 looks good on ppc

ppc64 please test and report back, disclosure date is tomorrow. 

sorry for being late. looks good on ppc64.

Thx Markus.

Security please review draft GLSA so we can release on time.

Opening since it is public now.

Donnie/someone with commit rights please commit the ebuilds, GLSA is ready.

Ebuilds committed.

Thx Joshua.

This one is ready for GLSA. Let's give the mirrors a chance to sync before
sending the GLSA.

Thx everyone.

GLSA 200605-02