Re: lib/48170

[riz%NetBSD.org@localhost]

The following reply was made to PR lib/48170; it has been noted by GNATS.

From: riz%NetBSD.org@localhost
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: lib/48170
Date: Tue, 17 Sep 2013 08:56:16 -0700

 (trying again from a real editor)
 
 I was able to duplicate this with the openoffice3 binary package
 at ftp.netbsd.org, and a clean install of 6.1.1.  After some
 test building with help from mrg@, I narrowed it down to two files:
 
 xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c
 xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c
 
 
 If I rolled back these files to what they were in 6.1, or rolled forward to
 -current, things worked for me.  Try this patch:
 
 
 Index: xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c
 diff -u xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c:1.1.1.4.6.1 
xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c:1.1.1.5
 --- xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c:1.1.1.4.6.1       Thu Jun 
 6 03:50:17 2013
 +++ xsrc/external/mit/libX11/dist/src/xkb/XKBNames.c   Thu May 30 23:04:42 2013
 @@ -180,7 +180,7 @@
            nKeys= xkb->max_key_code+1;
            names->keys= _XkbTypedCalloc(nKeys,XkbKeyNameRec);
        }
 -      else if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code)
 +      if ( ((int)rep->firstKey + rep->nKeys) > xkb->max_key_code + 1)
            goto BAILOUT;
        if (names->keys!=NULL) {
            if (!_XkbCopyFromReadBuffer(&buf,
 @@ -496,38 +496,10 @@
      if (which&XkbGroupNamesMask)
        _XkbCopyAtoms(dpy,names->groups,groups,XkbNumKbdGroups);
      if (which&XkbKeyNamesMask) {
 -#ifdef WORD64
 -      char *tmp;
 -      register int i;
 -      BufAlloc(char *,tmp,nKeys*XkbKeyNameLength);
 -      for (i=0;i<nKeys;i++,tmp+= XkbKeyNameLength) {
 -          tmp[0]= names->keys[firstKey+i].name[0];
 -          tmp[1]= names->keys[firstKey+i].name[1];
 -          tmp[2]= names->keys[firstKey+i].name[2];
 -          tmp[3]= names->keys[firstKey+i].name[3];
 -      }
 -#else
        Data(dpy,(char *)&names->keys[firstKey],nKeys*XkbKeyNameLength);
 -#endif
      }
      if (which&XkbKeyAliasesMask) {
 -#ifdef WORD64
 -      char *tmp;
 -      register int i;
 -      BufAlloc(char *,tmp,nKA*XkbKeyNameLength*2);
 -      for (i=0;i<nKeys;i++,tmp+= 2*XkbKeyNameLength) {
 -          tmp[0]= names->key_aliases[i].real[0];
 -          tmp[1]= names->key_aliases[i].real[1];
 -          tmp[2]= names->key_aliases[i].real[2];
 -          tmp[3]= names->key_aliases[i].real[3];
 -          tmp[4]= names->key_aliases[i].alias[0];
 -          tmp[5]= names->key_aliases[i].alias[1];
 -          tmp[6]= names->key_aliases[i].alias[2];
 -          tmp[7]= names->key_aliases[i].alias[3];
 -      }
 -#else
        Data(dpy,(char *)names->key_aliases,nKA*XkbKeyNameLength*2);
 -#endif
      }
      if (which&XkbRGNamesMask) {
        Data32(dpy,(long *)names->radio_groups,nRG*4);
 @@ -752,38 +724,10 @@
      if (which&XkbGroupNamesMask)
        _XkbCopyAtoms(dpy,names->groups,groups,XkbNumKbdGroups);
      if (which&XkbKeyNamesMask) {
 -#ifdef WORD64
 -      char *tmp;
 -      register int i;
 -      BufAlloc(char *,tmp,nKeys*4);
 -      for (i=0;i<nKeys;i++,tmp+= 4) {
 -          tmp[0]= names->keys[firstKey+i].name[0];
 -          tmp[1]= names->keys[firstKey+i].name[1];
 -          tmp[2]= names->keys[firstKey+i].name[2];
 -          tmp[3]= names->keys[firstKey+i].name[3];
 -      }
 -#else
        Data(dpy,(char *)&names->keys[firstKey],nKeys*XkbKeyNameLength);
 -#endif
      }
      if (which&XkbKeyAliasesMask) {
 -#ifdef WORD64
 -      char *tmp;
 -      register int i;
 -      BufAlloc(char *,tmp,nKA*XkbKeyNameLength*2);
 -      for (i=0;i<nKeys;i++,tmp+= 2*XkbKeyNameLength) {
 -          tmp[0]= names->key_aliases[i].real[0];
 -          tmp[1]= names->key_aliases[i].real[1];
 -          tmp[2]= names->key_aliases[i].real[2];
 -          tmp[3]= names->key_aliases[i].real[3];
 -          tmp[4]= names->key_aliases[i].alias[0];
 -          tmp[5]= names->key_aliases[i].alias[1];
 -          tmp[6]= names->key_aliases[i].alias[2];
 -          tmp[7]= names->key_aliases[i].alias[3];
 -      }
 -#else
        Data(dpy,(char *)names->key_aliases,nKA*XkbKeyNameLength*2);
 -#endif
      }
      if (which&XkbRGNamesMask) {
        Data32(dpy,(long *)names->radio_groups,nRG*4);
 Index: xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c
 diff -u xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c:1.1.1.4.6.1 
xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c:1.1.1.5
 --- xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c:1.1.1.4.6.1      Thu Jun 
 6 03:50:17 2013
 +++ xsrc/external/mit/libX11/dist/src/xkb/XKBGetMap.c  Thu May 30 23:04:42 2013
 @@ -426,7 +426,7 @@
  
      if ( rep->totalVModMapKeys>0 ) {
        if (((int) rep->firstVModMapKey + rep->nVModMapKeys)
 -           > xkb->max_key_code)
 +           > xkb->max_key_code + 1)
            return BadLength;
        if (((xkb->server==NULL)||(xkb->server->vmodmap==NULL))&&
            (XkbAllocServerMap(xkb,XkbVirtualModMapMask,0)!=Success)) {
 @@ -484,6 +484,8 @@
  
      if ( xkb->device_spec == XkbUseCoreKbd )
        xkb->device_spec= rep->deviceID;
 +    if ( rep->maxKeyCode < rep->minKeyCode )
 +      return BadImplementation;
      xkb->min_key_code = rep->minKeyCode;
      xkb->max_key_code = rep->maxKeyCode;