CVS commit: [netbsd-5-2] xsrc

["SAITOH Masanobu" <msaitoh%netbsd.org@localhost>]

Module Name:    xsrc
Committed By:   msaitoh
Date:           Wed May 14 05:27:33 UTC 2014

Modified Files:
        xsrc/external/mit/libXfont/dist/src/fc [netbsd-5-2]: fsconvert.c
            fserve.c
        xsrc/external/mit/libXfont/dist/src/fontfile [netbsd-5-2]: dirfile.c
        xsrc/xfree/xc/lib/font/fc [netbsd-5-2]: fsconvert.c fserve.c
        xsrc/xfree/xc/lib/font/fontfile [netbsd-5-2]: dirfile.c

Log Message:
Pull up following revision(s) (requested by maxv in ticket #1905):
        src/sys/compat/linux/common/linux_exec_elf32.c  1.91 via patch

A specially-crafted binary could easily control a kernel array index.
Add some checks to ensure that nothing will be read outside the allocated
area. Rewrite the code so that we don't need to allocate the whole section.

Spotted by several developers, patch from chs@/enami@


To generate a diff of this commit:
cvs rdiff -u -r1.1.1.1.2.1 -r1.1.1.1.2.1.4.1 \
    xsrc/external/mit/libXfont/dist/src/fc/fsconvert.c \
    xsrc/external/mit/libXfont/dist/src/fc/fserve.c
cvs rdiff -u -r1.1.1.1.2.1 -r1.1.1.1.2.1.4.1 \
    xsrc/external/mit/libXfont/dist/src/fontfile/dirfile.c
cvs rdiff -u -r1.4 -r1.4.30.1 xsrc/xfree/xc/lib/font/fc/fsconvert.c \
    xsrc/xfree/xc/lib/font/fc/fserve.c
cvs rdiff -u -r1.4 -r1.4.18.1 xsrc/xfree/xc/lib/font/fontfile/dirfile.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.