05/09: gnu: libxrandr: Update to 1.5.1.

[Leo Famulari]

lfam pushed a commit to branch core-updates
in repository guix.

commit 2e81b0b5bf47cab7f096ceedd2c450935f3e5a1f
Author: Leo Famulari <address@hidden>
Date:   Wed Oct 5 19:25:51 2016 -0400

    gnu: libxrandr: Update to 1.5.1.
    
    * gnu/packages/xorg.scm (libxrandr): Update to 1.5.1.
    [replacement]: Remove field.
    (libxrandr/fixed): Remove variable.
    * gnu/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch: Delete 
file.
    * gnu/local.mk (dist_patch_DATA): Remove it.
---
 gnu/local.mk                                       |    1 -
 .../libxrandr-CVE-2016-7947-CVE-2016-7948.patch    |  447 --------------------
 gnu/packages/xorg.scm                              |   13 +-
 3 files changed, 2 insertions(+), 459 deletions(-)

diff --git a/gnu/local.mk b/gnu/local.mk
index 116c9ab..5745bf9 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -668,7 +668,6 @@ dist_patch_DATA =                                           
\
   %D%/packages/patches/libwmf-CVE-2015-0848+CVE-2015-4588.patch        \
   %D%/packages/patches/libwmf-CVE-2015-4695.patch              \
   %D%/packages/patches/libwmf-CVE-2015-4696.patch              \
-  %D%/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch     \
   %D%/packages/patches/libxrender-CVE-2016-7949.patch          \
   %D%/packages/patches/libxrender-CVE-2016-7950.patch          \
   %D%/packages/patches/libxtst-CVE-2016-7951-CVE-2016-7952.patch       \
diff --git a/gnu/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch 
b/gnu/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch
deleted file mode 100644
index ece8b18..0000000
--- a/gnu/packages/patches/libxrandr-CVE-2016-7947-CVE-2016-7948.patch
+++ /dev/null
@@ -1,447 +0,0 @@
-Fix CVE-2016-7947 and CVE-2016-7948.
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7947
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7948
-
-Patch copied from upstream source repository:
-
-https://cgit.freedesktop.org/xorg/lib/libXrandr/commit/?id=a0df3e1c7728205e5c7650b2e6dce684139254a6
-
-From a0df3e1c7728205e5c7650b2e6dce684139254a6 Mon Sep 17 00:00:00 2001
-From: Tobias Stoeckmann <address@hidden>
-Date: Sun, 25 Sep 2016 22:21:40 +0200
-Subject: [PATCH] Avoid out of boundary accesses on illegal responses
-
-The responses of the connected X server have to be properly checked
-to avoid out of boundary accesses that could otherwise be triggered
-by a malicious server.
-
-Signed-off-by: Tobias Stoeckmann <address@hidden>
-Reviewed-by: Matthieu Herrb <address@hidden>
----
- src/XrrConfig.c   | 32 +++++++++++++--------
- src/XrrCrtc.c     | 83 ++++++++++++++++++++++++++++++++++++++++++-------------
- src/XrrMonitor.c  | 18 ++++++++++++
- src/XrrOutput.c   | 11 ++++++++
- src/XrrProvider.c | 28 ++++++++++++++++---
- src/XrrScreen.c   | 52 ++++++++++++++++++++++------------
- 6 files changed, 172 insertions(+), 52 deletions(-)
-
-diff --git a/src/XrrConfig.c b/src/XrrConfig.c
-index 2f0282b..e68c45a 100644
---- a/src/XrrConfig.c
-+++ b/src/XrrConfig.c
-@@ -29,6 +29,7 @@
- #include <config.h>
- #endif
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <X11/Xlib.h>
- /* we need to be able to manipulate the Display structure on events */
-@@ -272,23 +273,30 @@ static XRRScreenConfiguration *_XRRGetScreenInfo 
(Display *dpy,
-       rep.rate = 0;
-       rep.nrateEnts = 0;
-     }
-+    if (rep.length < INT_MAX >> 2) {
-+      nbytes = (long) rep.length << 2;
- 
--    nbytes = (long) rep.length << 2;
-+      nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) +
-+                          ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF(CARD16) */);
- 
--    nbytesRead = (long) (rep.nSizes * SIZEOF (xScreenSizes) +
--                       ((rep.nrateEnts + 1)& ~1) * 2 /* SIZEOF (CARD16) */);
-+      /*
-+       * first we must compute how much space to allocate for
-+       * randr library's use; we'll allocate the structures in a single
-+       * allocation, on cleanlyness grounds.
-+       */
- 
--    /*
--     * first we must compute how much space to allocate for
--     * randr library's use; we'll allocate the structures in a single
--     * allocation, on cleanlyness grounds.
--     */
-+      rbytes = sizeof (XRRScreenConfiguration) +
-+        (rep.nSizes * sizeof (XRRScreenSize) +
-+         rep.nrateEnts * sizeof (int));
- 
--    rbytes = sizeof (XRRScreenConfiguration) +
--      (rep.nSizes * sizeof (XRRScreenSize) +
--       rep.nrateEnts * sizeof (int));
-+      scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes);
-+    } else {
-+      nbytes = 0;
-+      nbytesRead = 0;
-+      rbytes = 0;
-+      scp = NULL;
-+    }
- 
--    scp = (struct _XRRScreenConfiguration *) Xmalloc(rbytes);
-     if (scp == NULL) {
-       _XEatData (dpy, (unsigned long) nbytes);
-       return NULL;
-diff --git a/src/XrrCrtc.c b/src/XrrCrtc.c
-index 5ae35c5..6665092 100644
---- a/src/XrrCrtc.c
-+++ b/src/XrrCrtc.c
-@@ -24,6 +24,7 @@
- #include <config.h>
- #endif
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <X11/Xlib.h>
- /* we need to be able to manipulate the Display structure on events */
-@@ -57,22 +58,33 @@ XRRGetCrtcInfo (Display *dpy, XRRScreenResources 
*resources, RRCrtc crtc)
-       return NULL;
-     }
- 
--    nbytes = (long) rep.length << 2;
-+    if (rep.length < INT_MAX >> 2)
-+    {
-+      nbytes = (long) rep.length << 2;
- 
--    nbytesRead = (long) (rep.nOutput * 4 +
--                       rep.nPossibleOutput * 4);
-+      nbytesRead = (long) (rep.nOutput * 4 +
-+                           rep.nPossibleOutput * 4);
- 
--    /*
--     * first we must compute how much space to allocate for
--     * randr library's use; we'll allocate the structures in a single
--     * allocation, on cleanlyness grounds.
--     */
-+      /*
-+       * first we must compute how much space to allocate for
-+       * randr library's use; we'll allocate the structures in a single
-+       * allocation, on cleanlyness grounds.
-+       */
- 
--    rbytes = (sizeof (XRRCrtcInfo) +
--            rep.nOutput * sizeof (RROutput) +
--            rep.nPossibleOutput * sizeof (RROutput));
-+      rbytes = (sizeof (XRRCrtcInfo) +
-+                rep.nOutput * sizeof (RROutput) +
-+                rep.nPossibleOutput * sizeof (RROutput));
-+
-+      xci = (XRRCrtcInfo *) Xmalloc(rbytes);
-+    }
-+    else
-+    {
-+      nbytes = 0;
-+      nbytesRead = 0;
-+      rbytes = 0;
-+      xci = NULL;
-+    }
- 
--    xci = (XRRCrtcInfo *) Xmalloc(rbytes);
-     if (xci == NULL) {
-       _XEatDataWords (dpy, rep.length);
-       UnlockDisplay (dpy);
-@@ -194,12 +206,21 @@ XRRGetCrtcGamma (Display *dpy, RRCrtc crtc)
-     if (!_XReply (dpy, (xReply *) &rep, 0, xFalse))
-       goto out;
- 
--    nbytes = (long) rep.length << 2;
-+    if (rep.length < INT_MAX >> 2)
-+    {
-+      nbytes = (long) rep.length << 2;
- 
--    /* three channels of CARD16 data */
--    nbytesRead = (rep.size * 2 * 3);
-+      /* three channels of CARD16 data */
-+      nbytesRead = (rep.size * 2 * 3);
- 
--    crtc_gamma = XRRAllocGamma (rep.size);
-+      crtc_gamma = XRRAllocGamma (rep.size);
-+    }
-+    else
-+    {
-+      nbytes = 0;
-+      nbytesRead = 0;
-+      crtc_gamma = NULL;
-+    }
- 
-     if (!crtc_gamma)
-     {
-@@ -357,7 +378,7 @@ XRRGetCrtcTransform (Display       *dpy,
-     xRRGetCrtcTransformReq    *req;
-     int                               major_version, minor_version;
-     XRRCrtcTransformAttributes        *attr;
--    char                      *extra = NULL, *e;
-+    char                      *extra = NULL, *end = NULL, *e;
-     int                               p;
- 
-     *attributes = NULL;
-@@ -395,9 +416,17 @@ XRRGetCrtcTransform (Display      *dpy,
-       else
-       {
-           int extraBytes = rep.length * 4 - CrtcTransformExtra;
--          extra = Xmalloc (extraBytes);
-+          if (rep.length < INT_MAX / 4 &&
-+              rep.length * 4 >= CrtcTransformExtra) {
-+              extra = Xmalloc (extraBytes);
-+              end = extra + extraBytes;
-+          } else
-+              extra = NULL;
-           if (!extra) {
--              _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 2));
-+              if (rep.length > (CrtcTransformExtra >> 2))
-+                  _XEatDataWords (dpy, rep.length - (CrtcTransformExtra >> 
2));
-+              else
-+                  _XEatDataWords (dpy, rep.length);
-               UnlockDisplay (dpy);
-               SyncHandle ();
-               return False;
-@@ -429,22 +458,38 @@ XRRGetCrtcTransform (Display     *dpy,
- 
-     e = extra;
- 
-+    if (e + rep.pendingNbytesFilter > end) {
-+      XFree (extra);
-+      return False;
-+    }
-     memcpy (attr->pendingFilter, e, rep.pendingNbytesFilter);
-     attr->pendingFilter[rep.pendingNbytesFilter] = '\0';
-     e += (rep.pendingNbytesFilter + 3) & ~3;
-     for (p = 0; p < rep.pendingNparamsFilter; p++) {
-       INT32   f;
-+      if (e + 4 > end) {
-+          XFree (extra);
-+          return False;
-+      }
-       memcpy (&f, e, 4);
-       e += 4;
-       attr->pendingParams[p] = (XFixed) f;
-     }
-     attr->pendingNparams = rep.pendingNparamsFilter;
- 
-+    if (e + rep.currentNbytesFilter > end) {
-+      XFree (extra);
-+      return False;
-+    }
-     memcpy (attr->currentFilter, e, rep.currentNbytesFilter);
-     attr->currentFilter[rep.currentNbytesFilter] = '\0';
-     e += (rep.currentNbytesFilter + 3) & ~3;
-     for (p = 0; p < rep.currentNparamsFilter; p++) {
-       INT32   f;
-+      if (e + 4 > end) {
-+          XFree (extra);
-+          return False;
-+      }
-       memcpy (&f, e, 4);
-       e += 4;
-       attr->currentParams[p] = (XFixed) f;
-diff --git a/src/XrrMonitor.c b/src/XrrMonitor.c
-index a9eaa7b..adc5330 100644
---- a/src/XrrMonitor.c
-+++ b/src/XrrMonitor.c
-@@ -24,6 +24,7 @@
- #include <config.h>
- #endif
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <X11/Xlib.h>
- /* we need to be able to manipulate the Display structure on events */
-@@ -65,6 +66,15 @@ XRRGetMonitors(Display *dpy, Window window, Bool 
get_active, int *nmonitors)
-       return NULL;
-     }
- 
-+    if (rep.length > INT_MAX >> 2 ||
-+      rep.nmonitors > INT_MAX / SIZEOF(xRRMonitorInfo) ||
-+      rep.noutputs > INT_MAX / 4 ||
-+      rep.nmonitors * SIZEOF(xRRMonitorInfo) > INT_MAX - rep.noutputs * 4) {
-+      _XEatData (dpy, rep.length);
-+      UnlockDisplay (dpy);
-+      SyncHandle ();
-+      return NULL;
-+    }
-     nbytes = (long) rep.length << 2;
-     nmon = rep.nmonitors;
-     noutput = rep.noutputs;
-@@ -111,6 +121,14 @@ XRRGetMonitors(Display *dpy, Window window, Bool 
get_active, int *nmonitors)
-           mon[m].outputs = output;
-           buf += SIZEOF (xRRMonitorInfo);
-           xoutput = (CARD32 *) buf;
-+          if (xmon->noutput > rep.noutputs) {
-+              Xfree(buf);
-+              Xfree(mon);
-+              UnlockDisplay (dpy);
-+              SyncHandle ();
-+              return NULL;
-+          }
-+          rep.noutputs -= xmon->noutput;
-           for (o = 0; o < xmon->noutput; o++)
-               output[o] = xoutput[o];
-           output += xmon->noutput;
-diff --git a/src/XrrOutput.c b/src/XrrOutput.c
-index 85f0b6e..30f3d40 100644
---- a/src/XrrOutput.c
-+++ b/src/XrrOutput.c
-@@ -25,6 +25,7 @@
- #include <config.h>
- #endif
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <X11/Xlib.h>
- /* we need to be able to manipulate the Display structure on events */
-@@ -60,6 +61,16 @@ XRRGetOutputInfo (Display *dpy, XRRScreenResources 
*resources, RROutput output)
-       return NULL;
-     }
- 
-+    if (rep.length > INT_MAX >> 2 || rep.length < (OutputInfoExtra >> 2))
-+    {
-+        if (rep.length > (OutputInfoExtra >> 2))
-+          _XEatDataWords (dpy, rep.length - (OutputInfoExtra >> 2));
-+      else
-+          _XEatDataWords (dpy, rep.length);
-+      UnlockDisplay (dpy);
-+      SyncHandle ();
-+      return NULL;
-+    }
-     nbytes = ((long) (rep.length) << 2) - OutputInfoExtra;
- 
-     nbytesRead = (long) (rep.nCrtcs * 4 +
-diff --git a/src/XrrProvider.c b/src/XrrProvider.c
-index 9e620c7..d796cd0 100644
---- a/src/XrrProvider.c
-+++ b/src/XrrProvider.c
-@@ -25,6 +25,7 @@
- #include <config.h>
- #endif
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <X11/Xlib.h>
- /* we need to be able to manipulate the Display structure on events */
-@@ -59,12 +60,20 @@ XRRGetProviderResources(Display *dpy, Window window)
-       return NULL;
-     }
- 
--    nbytes = (long) rep.length << 2;
-+    if (rep.length < INT_MAX >> 2) {
-+      nbytes = (long) rep.length << 2;
- 
--    nbytesRead = (long) (rep.nProviders * 4);
-+      nbytesRead = (long) (rep.nProviders * 4);
- 
--    rbytes = (sizeof(XRRProviderResources) + rep.nProviders * 
sizeof(RRProvider));
--    xrpr = (XRRProviderResources *) Xmalloc(rbytes);
-+      rbytes = (sizeof(XRRProviderResources) + rep.nProviders *
-+                sizeof(RRProvider));
-+      xrpr = (XRRProviderResources *) Xmalloc(rbytes);
-+    } else {
-+      nbytes = 0;
-+      nbytesRead = 0;
-+      rbytes = 0;
-+      xrpr = NULL;
-+    }
- 
-     if (xrpr == NULL) {
-        _XEatDataWords (dpy, rep.length);
-@@ -121,6 +130,17 @@ XRRGetProviderInfo(Display *dpy, XRRScreenResources 
*resources, RRProvider provi
-       return NULL;
-     }
- 
-+    if (rep.length > INT_MAX >> 2 || rep.length < ProviderInfoExtra >> 2)
-+    {
-+      if (rep.length < ProviderInfoExtra >> 2)
-+          _XEatDataWords (dpy, rep.length);
-+      else
-+          _XEatDataWords (dpy, rep.length - (ProviderInfoExtra >> 2));
-+      UnlockDisplay (dpy);
-+      SyncHandle ();
-+      return NULL;
-+    }
-+
-     nbytes = ((long) rep.length << 2) - ProviderInfoExtra;
- 
-     nbytesRead = (long)(rep.nCrtcs * 4 +
-diff --git a/src/XrrScreen.c b/src/XrrScreen.c
-index b8ce7e5..1f7ffe6 100644
---- a/src/XrrScreen.c
-+++ b/src/XrrScreen.c
-@@ -24,6 +24,7 @@
- #include <config.h>
- #endif
- 
-+#include <limits.h>
- #include <stdio.h>
- #include <X11/Xlib.h>
- /* we need to be able to manipulate the Display structure on events */
-@@ -105,27 +106,36 @@ doGetScreenResources (Display *dpy, Window window, int 
poll)
-       xrri->has_rates = _XRRHasRates (xrri->minor_version, 
xrri->major_version);
-     }
- 
--    nbytes = (long) rep.length << 2;
-+    if (rep.length < INT_MAX >> 2) {
-+      nbytes = (long) rep.length << 2;
- 
--    nbytesRead = (long) (rep.nCrtcs * 4 +
--                       rep.nOutputs * 4 +
--                       rep.nModes * SIZEOF (xRRModeInfo) +
--                       ((rep.nbytesNames + 3) & ~3));
-+      nbytesRead = (long) (rep.nCrtcs * 4 +
-+                           rep.nOutputs * 4 +
-+                           rep.nModes * SIZEOF (xRRModeInfo) +
-+                           ((rep.nbytesNames + 3) & ~3));
- 
--    /*
--     * first we must compute how much space to allocate for
--     * randr library's use; we'll allocate the structures in a single
--     * allocation, on cleanlyness grounds.
--     */
-+      /*
-+       * first we must compute how much space to allocate for
-+       * randr library's use; we'll allocate the structures in a single
-+       * allocation, on cleanlyness grounds.
-+       */
-+
-+      rbytes = (sizeof (XRRScreenResources) +
-+                rep.nCrtcs * sizeof (RRCrtc) +
-+                rep.nOutputs * sizeof (RROutput) +
-+                rep.nModes * sizeof (XRRModeInfo) +
-+                rep.nbytesNames + rep.nModes);    /* '\0' terminate names */
- 
--    rbytes = (sizeof (XRRScreenResources) +
--            rep.nCrtcs * sizeof (RRCrtc) +
--            rep.nOutputs * sizeof (RROutput) +
--            rep.nModes * sizeof (XRRModeInfo) +
--            rep.nbytesNames + rep.nModes);    /* '\0' terminate names */
-+      xrsr = (XRRScreenResources *) Xmalloc(rbytes);
-+      wire_names = (char *) Xmalloc (rep.nbytesNames);
-+    } else {
-+      nbytes = 0;
-+      nbytesRead = 0;
-+      rbytes = 0;
-+      xrsr = NULL;
-+      wire_names = NULL;
-+    }
- 
--    xrsr = (XRRScreenResources *) Xmalloc(rbytes);
--    wire_names = (char *) Xmalloc (rep.nbytesNames);
-     if (xrsr == NULL || wire_names == NULL) {
-       Xfree (xrsr);
-       Xfree (wire_names);
-@@ -174,6 +184,14 @@ doGetScreenResources (Display *dpy, Window window, int 
poll)
-     wire_name = wire_names;
-     for (i = 0; i < rep.nModes; i++)  {
-       xrsr->modes[i].name = names;
-+      if (xrsr->modes[i].nameLength > rep.nbytesNames) {
-+          Xfree (xrsr);
-+          Xfree (wire_names);
-+          UnlockDisplay (dpy);
-+          SyncHandle ();
-+          return NULL;
-+      }
-+      rep.nbytesNames -= xrsr->modes[i].nameLength;
-       memcpy (names, wire_name, xrsr->modes[i].nameLength);
-       names[xrsr->modes[i].nameLength] = '\0';
-       names += xrsr->modes[i].nameLength + 1;
--- 
-2.10.1
-
diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index a4472f1..85bd916 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -4941,8 +4941,7 @@ new API's in libXft, or the legacy API's in libX11.")
 (define-public libxrandr
   (package
     (name "libxrandr")
-    (replacement libxrandr/fixed)
-    (version "1.5.0")
+    (version "1.5.1")
     (source
       (origin
         (method url-fetch)
@@ -4952,7 +4951,7 @@ new API's in libXft, or the legacy API's in libX11.")
                ".tar.bz2"))
         (sha256
           (base32
-            "0n6ycs1arf4wb1cal9il6v7vbxbf21qhs9sbfl8xndgwnxclk1kg"))))
+            "06pmphx8lp3iywqnh88fvbfb0d8xgkx0qpvan49akpja1vxfgy8z"))))
     (build-system gnu-build-system)
     (propagated-inputs
       ;; In accordance with xrandr.pc.
@@ -4969,14 +4968,6 @@ new API's in libXft, or the legacy API's in libX11.")
      "Library for the Resize and Rotate Extension to the X11 protocol.")
     (license license:x11)))
 
-(define libxrandr/fixed
-  (package
-    (inherit libxrandr)
-    (source (origin
-              (inherit (package-source libxrandr))
-              (patches (search-patches
-                         "libxrandr-CVE-2016-7947-CVE-2016-7948.patch"))))))
-
 (define-public libxvmc
   (package
     (name "libxvmc")