Author: branden Date: 2004-12-02 08:27:52 -0500 (Thu, 02 Dec 2004) New Revision: 2039
Modified: branches/4.1.0/woody/debian/changelog branches/4.1.0/woody/debian/patches/076_SECURITY_libXpm_vulnerabilities.diff branches/4.1.0/woody/debian/patches/400_hppa_support.diff Log: Apply fixes for CAN-2004-0914 (various Xpm library flaws). * More rigorously declare variables as unsigned integers where appropriate. * Compare user-supplied image data to UINT_MAX, not SIZE_MAX, when the internal corresponding variable used is an unsigned integer. (This is also more correct on LP64 systems.) * Add checks for invalid negative values in user-supplied image data. * Change internal functions WritePixels(), WriteExtensions(), CreatePixels(), and CreateExtensions() to take an additional argument, data_size, to avoid buffer overflows (making the functions less like sprintf and more like snprintf). Update calls to these functions accordingly. * Make macro definitions of compound statements more correct (see Section 3.10.3, "Swallowing the Semicolon", of the GNU C Preprocessor Manual). * Add checks for user-supplied data causing integer overflows when summed together. * Add tons of checks for integer overflows generally; even user-data that is legal can become implausible after internal routines manipualte it; return an out-of-memory condition if an overflow is thus caused. * Use snprintf() instead of sprintf() to avoid buffer overflows. * Don't be fooled by XPM images whose image geometry is absurdly huge. * Initialize static buffers with a null byte to prevent string-copying routines from going haywire if the buffers are never populated. * Change some internal functions to return unsigned ints rather than ints. * Add checks for invalid out-of-bounds values in user-supplied data. * Provide private implementation of popen(), intended to be secure, called s_popen(). If the system does not define NO_ZPIPE (only Win32 systems do define it), this is used; otherwise, the system's popen() call is used. Use fclose() instead of pclose() on the file handle thus created. * Use correct data type for size field of a stat structure, instead of casting it to an int. * Use size_t for variables assigned the return value of strlen, not int. * Do not attempt to open image files that have zero-length filenames, or are directories. * Use initializers with static character arrays so that they begin with a null byte if not later reassigned. * Use strncpy() instead of strcpy() to avoid buffer overflows. * Set the final byte of a static character array to null after copying another string into it with strncpy(). * When opening an image file for writing, do not open a file specification that is zero-length, begins or ends with '/', or has '../' anywhere within it. * Use XDestroyImage() and XpmFree() to deallocate resources when bailing out during certain error conditions. * Add many comments suggesting possibilities for further code review and development. Resync offsets in patch #400. Modified: branches/4.1.0/woody/debian/changelog =================================================================== --- branches/4.1.0/woody/debian/changelog 2004-11-22 11:46:20 UTC (rev 2038) +++ branches/4.1.0/woody/debian/changelog 2004-12-02 13:27:52 UTC (rev 2039) @@ -1,3 +1,12 @@ +xfree86 (4.1.0-16woody5) stable-security; urgency=low + + * Security update release. Resolves the following issue: + + CAN-2004-0914: memory leak, improper use of signed integers, and + overflow corrections in the Xpm library + * Resync offset in patch #400. + + -- Branden Robinson <[EMAIL PROTECTED]> Thu, 2 Dec 2004 00:04:22 -0500 + xfree86 (4.1.0-16woody4) stable-security; urgency=high * Security update release. Resolves the following issues: Modified: branches/4.1.0/woody/debian/patches/076_SECURITY_libXpm_vulnerabilities.diff =================================================================== --- branches/4.1.0/woody/debian/patches/076_SECURITY_libXpm_vulnerabilities.diff 2004-11-22 11:46:20 UTC (rev 2038) +++ branches/4.1.0/woody/debian/patches/076_SECURITY_libXpm_vulnerabilities.diff 2004-12-02 13:27:52 UTC (rev 2039) @@ -1,7 +1,8 @@ $Id$ Fix several security flaws in the Xpm library. Resolves CAN-2004-0687 (libXpm -stack overflows) and CAN-2004-0688 (libXpm integer overflows). +stack overflows), CAN-2004-0688 (libXpm integer overflows), and +CAN-2004-0914 (more integer overflows). The following text is by Chris Evans. @@ -60,12 +61,69 @@ 8192 bytes). The user gets to choose how many bytes to put into this buffer via the "number of bytes per pixel" XPM value. -This patch by Matthieu Herrb. +The discovery of the above flaws prompted a code review of the Xpm library +by Thomas Biege and several more fixes, including: -diff -urN xc/extras/Xpm~/lib/Attrib.c xc/extras/Xpm/lib/Attrib.c ---- xc/extras/Xpm~/lib/Attrib.c 2004-09-18 12:39:38.000000000 -0500 -+++ xc/extras/Xpm/lib/Attrib.c 2004-09-18 12:42:05.000000000 -0500 -@@ -35,7 +35,7 @@ +* More rigorously declare variables as unsigned integers where appropriate. +* Compare user-supplied image data to UINT_MAX, not SIZE_MAX, when the + internal corresponding variable used is an unsigned integer. (This is + also more correct on LP64 systems.) +* Add checks for invalid negative values in user-supplied image data. +* Change internal functions WritePixels(), WriteExtensions(), + CreatePixels(), and CreateExtensions() to take an additional argument, + data_size, to avoid buffer overflows (making the functions less like + sprintf and more like snprintf). Update calls to these functions + accordingly. +* Make macro definitions of compound statements more correct (see Section + 3.10.3, "Swallowing the Semicolon", of the GNU C Preprocessor Manual). +* Add checks for user-supplied data causing integer overflows when summed + together. +* Add tons of checks for integer overflows generally; even user-data that + is legal can become implausible after internal routines manipualte it; + return an out-of-memory condition if an overflow is thus caused. +* Use snprintf() instead of sprintf() to avoid buffer overflows. +* Don't be fooled by XPM images whose image geometry is absurdly huge. +* Initialize static buffers with a null byte to prevent string-copying + routines from going haywire if the buffers are never populated. +* Change some internal functions to return unsigned ints rather than ints. +* Add checks for invalid out-of-bounds values in user-supplied data. +* Provide private implementation of popen(), intended to be secure, called + s_popen(). If the system does not define NO_ZPIPE (only Win32 systems + do define it), this is used; otherwise, the system's popen() call is + used. Use fclose() instead of pclose() on the file handle thus created. +* Use correct data type for size field of a stat structure, instead of + casting it to an int. +* Use size_t for variables assigned the return value of strlen, not int. +* Do not attempt to open image files that have zero-length filenames, or + are directories. +* Use initializers with static character arrays so that they begin with a + null byte if not later reassigned. +* Use strncpy() instead of strcpy() to avoid buffer overflows. +* Set the final byte of a static character array to null after + copying another string into it with strncpy(). +* When opening an image file for writing, do not open a file specification + that is zero-length, begins or ends with '/', or has '../' anywhere + within it. +* Use XDestroyImage() and XpmFree() to deallocate resources when bailing + out during certain error conditions. +* Add many comments suggesting possibilities for further code review and + development. + +Petr Mladek was also responsible for some of the above changes. The +vulnerabilties found during the above-mentioned source code audit are +collectively referred to as CAN-2004-0914. + +This patch by Matthieu Herrb and others. + +diff -urN xc~/extras/Xpm/lib/Attrib.c xc/extras/Xpm/lib/Attrib.c +--- xc~/extras/Xpm/lib/Attrib.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/Attrib.c 2004-12-01 23:18:08.000000000 -0500 +@@ -32,13 +32,15 @@ + * Developed by Arnaud Le Hors * + \*****************************************************************************/ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ #include "XpmI.h" /* 3.2 backward compatibility code */ @@ -73,8 +131,12 @@ +LFUNC(CreateOldColorTable, int, (XpmColor *ct, unsigned int ncolors, XpmColor ***oldct)); - LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors)); -@@ -46,12 +46,15 @@ +-LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, int ncolors)); ++LFUNC(FreeOldColorTable, void, (XpmColor **colorTable, unsigned int ncolors)); + + /* + * Create a colortable compatible with the old style colortable +@@ -46,11 +48,14 @@ static int CreateOldColorTable(ct, ncolors, oldct) XpmColor *ct; @@ -83,42 +145,877 @@ XpmColor ***oldct; { XpmColor **colorTable, **color; - int a; +- int a; ++ unsigned int a; ++ ++ if (ncolors >= UINT_MAX / sizeof(XpmColor *)) ++ return XpmNoMemory; -+ if (ncolors >= SIZE_MAX / sizeof(XpmColor *)) -+ return XpmNoMemory; -+ colorTable = (XpmColor **) XpmMalloc(ncolors * sizeof(XpmColor *)); if (!colorTable) { - *oldct = NULL; -diff -urN xc/extras/Xpm~/lib/CrDatFrI.c xc/extras/Xpm/lib/CrDatFrI.c ---- xc/extras/Xpm~/lib/CrDatFrI.c 2004-09-18 12:39:38.000000000 -0500 -+++ xc/extras/Xpm/lib/CrDatFrI.c 2004-09-18 12:42:05.000000000 -0500 -@@ -123,6 +123,8 @@ +@@ -66,9 +71,9 @@ + static void + FreeOldColorTable(colorTable, ncolors) + XpmColor **colorTable; +- int ncolors; ++ unsigned int ncolors; + { +- int a, b; ++ unsigned int a, b; + XpmColor **color; + char **sptr; + +@@ -119,7 +124,7 @@ + XpmExtension *ext; + char **sptr; + +- if (extensions) { ++ if (extensions && nextensions > 0) { + for (i = 0, ext = extensions; i < nextensions; i++, ext++) { + if (ext->name) + XpmFree(ext->name); +diff -urN xc~/extras/Xpm/lib/CrBufFrI.c xc/extras/Xpm/lib/CrBufFrI.c +--- xc~/extras/Xpm/lib/CrBufFrI.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/CrBufFrI.c 2004-12-01 23:18:43.000000000 -0500 +@@ -32,21 +32,25 @@ + * Developed by Arnaud Le Hors * + \*****************************************************************************/ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + + LFUNC(WriteColors, int, (char **dataptr, unsigned int *data_size, + unsigned int *used_size, XpmColor *colors, + unsigned int ncolors, unsigned int cpp)); + +-LFUNC(WritePixels, void, (char *dataptr, unsigned int *used_size, ++LFUNC(WritePixels, void, (char *dataptr, unsigned int data_size, ++ unsigned int *used_size, + unsigned int width, unsigned int height, + unsigned int cpp, unsigned int *pixels, + XpmColor *colors)); + +-LFUNC(WriteExtensions, void, (char *dataptr, unsigned int *used_size, ++LFUNC(WriteExtensions, void, (char *dataptr, unsigned int data_size, ++ unsigned int *used_size, + XpmExtension *ext, unsigned int num)); + +-LFUNC(ExtensionsSize, int, (XpmExtension *ext, unsigned int num)); ++LFUNC(ExtensionsSize, unsigned int, (XpmExtension *ext, unsigned int num)); + LFUNC(CommentsSize, int, (XpmInfo *info)); + + int +@@ -89,10 +93,11 @@ + + #undef RETURN + #define RETURN(status) \ ++do \ + { \ + ErrorStatus = status; \ + goto error; \ +-} ++}while(0) + + int + XpmCreateBufferFromXpmImage(buffer_return, image, info) +@@ -106,7 +111,7 @@ + unsigned int cmts, extensions, ext_size = 0; + unsigned int l, cmt_size = 0; + char *ptr = NULL, *p; +- unsigned int ptr_size, used_size; ++ unsigned int ptr_size, used_size, tmp; + + *buffer_return = NULL; + +@@ -128,7 +133,13 @@ + #ifdef VOID_SPRINTF + used_size = strlen(buf); + #endif +- ptr_size = used_size + ext_size + cmt_size + 1; ++ ptr_size = used_size + ext_size + cmt_size + 1; /* ptr_size can't be 0 */ ++ if(ptr_size <= used_size || ++ ptr_size <= ext_size || ++ ptr_size <= cmt_size) ++ { ++ return XpmNoMemory; ++ } + ptr = (char *) XpmMalloc(ptr_size); + if (!ptr) + return XpmNoMemory; +@@ -139,7 +150,7 @@ + #ifndef VOID_SPRINTF + used_size += + #endif +- sprintf(ptr + used_size, "/*%s*/\n", info->hints_cmt); ++ snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->hints_cmt); + #ifdef VOID_SPRINTF + used_size += strlen(info->hints_cmt) + 5; + #endif +@@ -157,7 +168,7 @@ + #ifndef VOID_SPRINTF + l += + #endif +- sprintf(buf + l, " %d %d", info->x_hotspot, info->y_hotspot); ++ snprintf(buf + l, sizeof(buf)-l, " %d %d", info->x_hotspot, info->y_hotspot); + #ifdef VOID_SPRINTF + l = strlen(buf); + #endif +@@ -179,6 +190,8 @@ + l = strlen(buf); + #endif + ptr_size += l; ++ if(ptr_size <= l) ++ RETURN(XpmNoMemory); + p = (char *) XpmRealloc(ptr, ptr_size); + if (!p) + RETURN(XpmNoMemory); +@@ -191,7 +204,7 @@ + #ifndef VOID_SPRINTF + used_size += + #endif +- sprintf(ptr + used_size, "/*%s*/\n", info->colors_cmt); ++ snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->colors_cmt); + #ifdef VOID_SPRINTF + used_size += strlen(info->colors_cmt) + 5; + #endif +@@ -207,7 +220,12 @@ + * 4 = 1 (for '"') + 3 (for '",\n') + * 1 = - 2 (because the last line does not end with ',\n') + 3 (for '};\n') */ - header_nlines = 1 + image->ncolors; +- ptr_size += image->height * (image->width * image->cpp + 4) + 1; ++ if(image->width > UINT_MAX / image->cpp || ++ (tmp = image->width * image->cpp + 4) <= 4 || ++ image->height > UINT_MAX / tmp || ++ (tmp = image->height * tmp + 1) <= 1 || ++ (ptr_size += tmp) <= tmp) ++ RETURN(XpmNoMemory); + + p = (char *) XpmRealloc(ptr, ptr_size); + if (!p) +@@ -219,17 +237,17 @@ + #ifndef VOID_SPRINTF + used_size += + #endif +- sprintf(ptr + used_size, "/*%s*/\n", info->pixels_cmt); ++ snprintf(ptr + used_size, ptr_size-used_size, "/*%s*/\n", info->pixels_cmt); + #ifdef VOID_SPRINTF + used_size += strlen(info->pixels_cmt) + 5; + #endif + } +- WritePixels(ptr + used_size, &used_size, image->width, image->height, ++ WritePixels(ptr + used_size, ptr_size - used_size, &used_size, image->width, image->height, + image->cpp, image->data, image->colorTable); + + /* print extensions */ + if (extensions) +- WriteExtensions(ptr + used_size, &used_size, ++ WriteExtensions(ptr + used_size, ptr_size-used_size, &used_size, + info->extensions, info->nextensions); + + /* close the array */ +@@ -246,6 +264,7 @@ + return (ErrorStatus); + } + ++ + static int + WriteColors(dataptr, data_size, used_size, colors, ncolors, cpp) + char **dataptr; +@@ -255,7 +274,7 @@ + unsigned int ncolors; + unsigned int cpp; + { +- char buf[BUFSIZ]; ++ char buf[BUFSIZ] = {0}; + unsigned int a, key, l; + char *s, *s2; + char **defaults; +@@ -265,22 +284,34 @@ + + defaults = (char **) colors; + s = buf + 1; ++ if(cpp > (sizeof(buf) - (s-buf))) ++ return(XpmNoMemory); + strncpy(s, *defaults++, cpp); + s += cpp; + + for (key = 1; key <= NKEYS; key++, defaults++) { +- if (s2 = *defaults) { ++ if ((s2 = *defaults)) { + #ifndef VOID_SPRINTF + s += + #endif +- sprintf(s, "\t%s %s", xpmColorKeys[key - 1], s2); ++ /* assume C99 compliance */ ++ snprintf(s, sizeof(buf) - (s-buf), "\t%s %s", xpmColorKeys[key - 1], s2); + #ifdef VOID_SPRINTF + s += strlen(s); + #endif ++ /* now let's check if s points out-of-bounds */ ++ if((s-buf) > sizeof(buf)) ++ return(XpmNoMemory); + } + } ++ if(sizeof(buf) - (s-buf) < 4) ++ return(XpmNoMemory); + strcpy(s, "\",\n"); + l = s + 3 - buf; ++ if( *data_size >= UINT_MAX-l || ++ *data_size + l <= *used_size || ++ (*data_size + l - *used_size) <= sizeof(buf)) ++ return(XpmNoMemory); + s = (char *) XpmRealloc(*dataptr, *data_size + l); + if (!s) + return (XpmNoMemory); +@@ -293,8 +324,9 @@ + } + + static void +-WritePixels(dataptr, used_size, width, height, cpp, pixels, colors) ++WritePixels(dataptr, data_size, used_size, width, height, cpp, pixels, colors) + char *dataptr; ++ unsigned int data_size; + unsigned int *used_size; + unsigned int width; + unsigned int height; +@@ -305,27 +337,36 @@ + char *s = dataptr; + unsigned int x, y, h; + ++ if(height <= 1) ++ return; ++ + h = height - 1; + for (y = 0; y < h; y++) { + *s++ = '"'; + for (x = 0; x < width; x++, pixels++) { +- strncpy(s, colors[*pixels].string, cpp); ++ if(cpp >= (data_size - (s-dataptr))) ++ return; ++ strncpy(s, colors[*pixels].string, cpp); /* how can we trust *pixels? :-\ */ + s += cpp; + } ++ if((data_size - (s-dataptr)) < 4) ++ return; + strcpy(s, "\",\n"); + s += 3; + } + /* duplicate some code to avoid a test in the loop */ + *s++ = '"'; + for (x = 0; x < width; x++, pixels++) { +- strncpy(s, colors[*pixels].string, cpp); ++ if(cpp >= (data_size - (s-dataptr))) ++ return; ++ strncpy(s, colors[*pixels].string, cpp); /* how can we trust *pixels? */ + s += cpp; + } + *s++ = '"'; + *used_size += s - dataptr; + } + +-static int ++static unsigned int + ExtensionsSize(ext, num) + XpmExtension *ext; + unsigned int num; +@@ -334,21 +375,26 @@ + char **line; + + size = 0; ++ if(num == 0) ++ return(0); /* ok? */ + for (x = 0; x < num; x++, ext++) { + /* 11 = 10 (for ',\n"XPMEXT ') + 1 (for '"') */ + size += strlen(ext->name) + 11; +- a = ext->nlines; ++ a = ext->nlines; /* how can we trust ext->nlines to be not out-of-bounds? */ + for (y = 0, line = ext->lines; y < a; y++, line++) + /* 4 = 3 (for ',\n"') + 1 (for '"') */ + size += strlen(*line) + 4; + } + /* 13 is for ',\n"XPMENDEXT"' */ ++ if(size > UINT_MAX - 13) /* unlikely */ ++ return(0); + return size + 13; + } + + static void +-WriteExtensions(dataptr, used_size, ext, num) ++WriteExtensions(dataptr, data_size, used_size, ext, num) + char *dataptr; ++ unsigned int data_size; + unsigned int *used_size; + XpmExtension *ext; + unsigned int num; +@@ -361,7 +407,7 @@ + #ifndef VOID_SPRINTF + s += + #endif +- sprintf(s, ",\n\"XPMEXT %s\"", ext->name); ++ snprintf(s, data_size - (s-dataptr), ",\n\"XPMEXT %s\"", ext->name); + #ifdef VOID_SPRINTF + s += strlen(ext->name) + 11; + #endif +@@ -370,13 +416,13 @@ + #ifndef VOID_SPRINTF + s += + #endif +- sprintf(s, ",\n\"%s\"", *line); ++ snprintf(s, data_size - (s-dataptr), ",\n\"%s\"", *line); + #ifdef VOID_SPRINTF + s += strlen(*line) + 4; + #endif + } + } +- strcpy(s, ",\n\"XPMENDEXT\""); ++ strncpy(s, ",\n\"XPMENDEXT\"", data_size - (s-dataptr)-1); + *used_size += s - dataptr + 13; + } + +@@ -387,6 +433,7 @@ + int size = 0; + + /* 5 = 2 (for "/_*") + 3 (for "*_/\n") */ ++ /* wrap possible but *very* unlikely */ + if (info->hints_cmt) + size += 5 + strlen(info->hints_cmt); + +diff -urN xc~/extras/Xpm/lib/CrDatFrI.c xc/extras/Xpm/lib/CrDatFrI.c +--- xc~/extras/Xpm/lib/CrDatFrI.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/CrDatFrI.c 2004-12-01 23:19:23.000000000 -0500 +@@ -32,13 +32,16 @@ + * Developed by Arnaud Le Hors * + \*****************************************************************************/ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + + LFUNC(CreateColors, int, (char **dataptr, unsigned int *data_size, + XpmColor *colors, unsigned int ncolors, + unsigned int cpp)); + +-LFUNC(CreatePixels, void, (char **dataptr, unsigned int width, ++LFUNC(CreatePixels, void, (char **dataptr, unsigned int data_size, ++ unsigned int width, + unsigned int height, unsigned int cpp, + unsigned int *pixels, XpmColor *colors)); + +@@ -46,7 +49,8 @@ + unsigned int *ext_size, + unsigned int *ext_nlines)); + +-LFUNC(CreateExtensions, void, (char **dataptr, unsigned int offset, ++LFUNC(CreateExtensions, void, (char **dataptr, unsigned int data_size, ++ unsigned int offset, + XpmExtension *ext, unsigned int num, + unsigned int ext_nlines)); + +@@ -87,10 +91,11 @@ + + #undef RETURN + #define RETURN(status) \ ++do \ + { \ + ErrorStatus = status; \ + goto exit; \ +-} ++} while(0) + + int + XpmCreateDataFromXpmImage(data_return, image, info) +@@ -121,9 +126,17 @@ + * alloc a temporary array of char pointer for the header section which + * is the hints line + the color table lines + */ +- header_nlines = 1 + image->ncolors; ++ header_nlines = 1 + image->ncolors; /* this may wrap and/or become 0 */ ++ ++ /* 2nd check superfluous if we do not need header_nlines any further */ ++ if(header_nlines <= image->ncolors || ++ header_nlines >= UINT_MAX / sizeof(char *)) ++ return(XpmNoMemory); ++ header_size = sizeof(char *) * header_nlines; -+ if (header_size >= SIZE_MAX / sizeof(char *)) +- header = (char **) XpmCalloc(header_size, sizeof(char *)); ++ if (header_size >= UINT_MAX / sizeof(char *)) + return (XpmNoMemory); - header = (char **) XpmCalloc(header_size, sizeof(char *)); ++ header = (char **) XpmCalloc(header_size, sizeof(char *)); /* can we trust image->ncolors */ if (!header) return (XpmNoMemory); -diff -urN xc/extras/Xpm~/lib/WrFFrI.c xc/extras/Xpm/lib/WrFFrI.c ---- xc/extras/Xpm~/lib/WrFFrI.c 2004-09-18 12:39:38.000000000 -0500 -+++ xc/extras/Xpm/lib/WrFFrI.c 2004-09-18 12:42:05.000000000 -0500 -@@ -247,6 +247,8 @@ + +@@ -167,8 +180,22 @@ + + /* now we know the size needed, alloc the data and copy the header lines */ + offset = image->width * image->cpp + 1; +- data_size = header_size + (image->height + ext_nlines) * sizeof(char *) +- + image->height * offset + ext_size; ++ ++ if(offset <= image->width || offset <= image->cpp) ++ RETURN(XpmNoMemory); ++ ++ if( (image->height + ext_nlines) >= UINT_MAX / sizeof(char *)) ++ RETURN(XpmNoMemory); ++ data_size = (image->height + ext_nlines) * sizeof(char *); ++ ++ if (image->height > UINT_MAX / offset || ++ image->height * offset > UINT_MAX - data_size) ++ RETURN(XpmNoMemory); ++ data_size += image->height * offset; ++ ++ if( (header_size + ext_size) >= (UINT_MAX - data_size) ) ++ RETURN(XpmNoMemory); ++ data_size += header_size + ext_size; + + data = (char **) XpmMalloc(data_size); + if (!data) +@@ -176,8 +203,10 @@ + + data_nlines = header_nlines + image->height + ext_nlines; + *data = (char *) (data + data_nlines); ++ ++ /* can header have less elements then n suggests? */ + n = image->ncolors; +- for (l = 0, sptr = data, sptr2 = header; l <= n; l++, sptr++, sptr2++) { ++ for (l = 0, sptr = data, sptr2 = header; l <= n && sptr && sptr2; l++, sptr++, sptr2++) { + strcpy(*sptr, *sptr2); + *(sptr + 1) = *sptr + strlen(*sptr2) + 1; + } +@@ -186,12 +215,13 @@ + data[header_nlines] = (char *) data + header_size + + (image->height + ext_nlines) * sizeof(char *); + +- CreatePixels(data + header_nlines, image->width, image->height, ++ CreatePixels(data + header_nlines, data_size-header_nlines, image->width, image->height, + image->cpp, image->data, image->colorTable); + + /* print extensions */ + if (extensions) +- CreateExtensions(data + header_nlines + image->height - 1, offset, ++ CreateExtensions(data + header_nlines + image->height - 1, ++ data_size - header_nlines - image->height + 1, offset, + info->extensions, info->nextensions, + ext_nlines); + +@@ -222,23 +252,34 @@ + char *s, *s2; + char **defaults; + ++ /* can ncolors be trusted here? */ + for (a = 0; a < ncolors; a++, colors++, dataptr++) { + + defaults = (char **) colors; ++ if(sizeof(buf) <= cpp) ++ return(XpmNoMemory); + strncpy(buf, *defaults++, cpp); + s = buf + cpp; + ++ if(sizeof(buf) <= (s-buf)) ++ return XpmNoMemory; ++ + for (key = 1; key <= NKEYS; key++, defaults++) { +- if (s2 = *defaults) { ++ if ((s2 = *defaults)) { + #ifndef VOID_SPRINTF + s += + #endif +- sprintf(s, "\t%s %s", xpmColorKeys[key - 1], s2); ++ /* assume C99 compliance */ ++ snprintf(s, sizeof(buf)-(s-buf), "\t%s %s", xpmColorKeys[key - 1], s2); + #ifdef VOID_SPRINTF + s += strlen(s); + #endif ++ /* does s point out-of-bounds? */ ++ if(sizeof(buf) < (s-buf)) ++ return XpmNoMemory; + } + } ++ /* what about using strdup()? */ + l = s - buf + 1; + s = (char *) XpmMalloc(l); + if (!s) +@@ -250,8 +291,9 @@ + } + + static void +-CreatePixels(dataptr, width, height, cpp, pixels, colors) ++CreatePixels(dataptr, data_size, width, height, cpp, pixels, colors) + char **dataptr; ++ unsigned int data_size; + unsigned int width; + unsigned int height; + unsigned int cpp; +@@ -261,21 +303,38 @@ + char *s; + unsigned int x, y, h, offset; + ++ if(height <= 1) ++ return; ++ + h = height - 1; ++ + offset = width * cpp + 1; ++ ++ if(offset <= width || offset <= cpp) ++ return; ++ ++ /* why trust h? */ + for (y = 0; y < h; y++, dataptr++) { + s = *dataptr; ++ /* why trust width? */ + for (x = 0; x < width; x++, pixels++) { +- strncpy(s, colors[*pixels].string, cpp); ++ if(cpp > (data_size - (s - *dataptr))) ++ return; ++ strncpy(s, colors[*pixels].string, cpp); /* why trust pixel? */ + s += cpp; + } + *s = '\0'; ++ if(offset > data_size) ++ return; + *(dataptr + 1) = *dataptr + offset; + } + /* duplicate some code to avoid a test in the loop */ + s = *dataptr; ++ /* why trust width? */ + for (x = 0; x < width; x++, pixels++) { +- strncpy(s, colors[*pixels].string, cpp); ++ if(cpp > data_size - (s - *dataptr)) ++ return; ++ strncpy(s, colors[*pixels].string, cpp); /* why should we trust *pixel? */ + s += cpp; + } + *s = '\0'; +@@ -308,8 +367,9 @@ + } + + static void +-CreateExtensions(dataptr, offset, ext, num, ext_nlines) ++CreateExtensions(dataptr, data_size, offset, ext, num, ext_nlines) + char **dataptr; ++ unsigned int data_size; + unsigned int offset; + XpmExtension *ext; + unsigned int num; +@@ -322,12 +382,12 @@ + dataptr++; + a = 0; + for (x = 0; x < num; x++, ext++) { +- sprintf(*dataptr, "XPMEXT %s", ext->name); ++ snprintf(*dataptr, data_size, "XPMEXT %s", ext->name); + a++; + if (a < ext_nlines) + *(dataptr + 1) = *dataptr + strlen(ext->name) + 8; + dataptr++; +- b = ext->nlines; ++ b = ext->nlines; /* can we trust these values? */ + for (y = 0, line = ext->lines; y < b; y++, line++) { + strcpy(*dataptr, *line); + a++; +diff -urN xc~/extras/Xpm/lib/Imakefile xc/extras/Xpm/lib/Imakefile +--- xc~/extras/Xpm/lib/Imakefile 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/Imakefile 2004-12-01 23:13:30.000000000 -0500 +@@ -104,13 +104,15 @@ + CrBufFrI.c CrDatFrP.c CrPFrBuf.c RdFToI.c WrFFrI.c \ + CrBufFrP.c CrIFrBuf.c CrPFrDat.c RdFToP.c WrFFrP.c \ + CrDatFrI.c CrIFrDat.c RdFToDat.c WrFFrDat.c \ +- Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c ++ Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c \ ++ s_popen.c + + OBJS = data.o create.o misc.o rgb.o scan.o parse.o hashtab.o \ + CrBufFrI.o CrDatFrP.o CrPFrBuf.o RdFToI.o WrFFrI.o \ + CrBufFrP.o CrIFrBuf.o CrPFrDat.o RdFToP.o WrFFrP.o \ + CrDatFrI.o CrIFrDat.o RdFToDat.o WrFFrDat.o \ +- Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o ++ Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o \ ++ s_popen.o + + INCLUDES = -I. + LINTLIBS = $(LINTXTOLL) $(LINTXLIB) +diff -urN xc~/extras/Xpm/lib/RdFToBuf.c xc/extras/Xpm/lib/RdFToBuf.c +--- xc~/extras/Xpm/lib/RdFToBuf.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/RdFToBuf.c 2004-12-01 23:13:30.000000000 -0500 +@@ -37,6 +37,8 @@ + * HeDu ([EMAIL PROTECTED]) 4/94 + */ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + #include <sys/stat.h> + #if !defined(FOR_MSW) && !defined(WIN32) +@@ -58,7 +60,8 @@ + char *filename; + char **buffer_return; + { +- int fd, fcheck, len; ++ int fd, fcheck; ++ off_t len; + char *ptr; + struct stat stats; + FILE *fp; +@@ -82,7 +85,7 @@ + close(fd); + return XpmOpenFailed; + } +- len = (int) stats.st_size; ++ len = stats.st_size; + ptr = (char *) XpmMalloc(len + 1); + if (!ptr) { + fclose(fp); +diff -urN xc~/extras/Xpm/lib/RdFToI.c xc/extras/Xpm/lib/RdFToI.c +--- xc~/extras/Xpm/lib/RdFToI.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/RdFToI.c 2004-12-01 23:22:05.000000000 -0500 +@@ -32,6 +32,8 @@ + * Developed by Arnaud Le Hors * + \*****************************************************************************/ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + #include <sys/stat.h> + #if !defined(NO_ZPIPE) && defined(WIN32) +@@ -122,14 +124,21 @@ + /* + * open the given file to be read as an xpmData which is returned. + */ ++#ifndef NO_ZPIPE ++ FILE *s_popen(char *cmd, const char *type); ++#else ++# define s_popen popen ++#endif ++ + static int + OpenReadFile(filename, mdata) + char *filename; + xpmData *mdata; + { + #ifndef NO_ZPIPE +- char *compressfile, buf[BUFSIZ]; ++ char buf[BUFSIZ]; + # ifdef STAT_ZFILE ++ char *compressfile; + struct stat status; + # endif + #endif +@@ -139,17 +148,21 @@ + mdata->type = XPMFILE; + } else { + #ifndef NO_ZPIPE +- int len = strlen(filename); ++ size_t len = strlen(filename); ++ ++ if(len == 0 || ++ filename[len-1] == '/') ++ return(XpmOpenFailed); + if ((len > 2) && !strcmp(".Z", filename + (len - 2))) { + mdata->type = XPMPIPE; +- sprintf(buf, "uncompress -c \"%s\"", filename); +- if (!(mdata->stream.file = popen(buf, "r"))) ++ snprintf(buf, sizeof(buf), "uncompress -c \"%s\"", filename); ++ if (!(mdata->stream.file = s_popen(buf, "r"))) + return (XpmOpenFailed); + + } else if ((len > 3) && !strcmp(".gz", filename + (len - 3))) { + mdata->type = XPMPIPE; +- sprintf(buf, "gunzip -qc \"%s\"", filename); +- if (!(mdata->stream.file = popen(buf, "r"))) ++ snprintf(buf, sizeof(buf), "gunzip -qc \"%s\"", filename); ++ if (!(mdata->stream.file = s_popen(buf, "r"))) + return (XpmOpenFailed); + + } else { +@@ -157,19 +170,19 @@ + if (!(compressfile = (char *) XpmMalloc(len + 4))) + return (XpmNoMemory); + +- sprintf(compressfile, "%s.Z", filename); ++ snprintf(compressfile, len+4, "%s.Z", filename); + if (!stat(compressfile, &status)) { +- sprintf(buf, "uncompress -c \"%s\"", compressfile); +- if (!(mdata->stream.file = popen(buf, "r"))) { ++ snprintf(buf, sizeof(buf), "uncompress -c \"%s\"", compressfile); ++ if (!(mdata->stream.file = s_popen(buf, "r"))) { + XpmFree(compressfile); + return (XpmOpenFailed); + } + mdata->type = XPMPIPE; + } else { +- sprintf(compressfile, "%s.gz", filename); ++ snprintf(compressfile, len+4, "%s.gz", filename); + if (!stat(compressfile, &status)) { +- sprintf(buf, "gunzip -c \"%s\"", compressfile); +- if (!(mdata->stream.file = popen(buf, "r"))) { ++ snprintf(buf, sizeof(buf), "gunzip -c \"%s\"", compressfile); ++ if (!(mdata->stream.file = s_popen(buf, "r"))) { + XpmFree(compressfile); + return (XpmOpenFailed); + } +@@ -215,7 +228,7 @@ + break; + #ifndef NO_ZPIPE + case XPMPIPE: +- pclose(mdata->stream.file); ++ fclose(mdata->stream.file); + break; + #endif + } +diff -urN xc~/extras/Xpm/lib/WrFFrBuf.c xc/extras/Xpm/lib/WrFFrBuf.c +--- xc~/extras/Xpm/lib/WrFFrBuf.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/WrFFrBuf.c 2004-12-01 23:13:30.000000000 -0500 +@@ -32,6 +32,8 @@ + * Developed by Arnaud Le Hors * + \*****************************************************************************/ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + + int +@@ -49,7 +51,7 @@ + fcheck = fwrite(buffer, len, 1, fp); + fclose(fp); + if (fcheck != 1) +- return XpmOpenFailed; ++ return XpmOpenFailed; /* maybe use a better return value */ + + return XpmSuccess; + } +diff -urN xc~/extras/Xpm/lib/WrFFrI.c xc/extras/Xpm/lib/WrFFrI.c +--- xc~/extras/Xpm/lib/WrFFrI.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/WrFFrI.c 2004-12-01 23:23:02.000000000 -0500 +@@ -37,6 +37,8 @@ + * Lorens Younes ([EMAIL PROTECTED]) 4/96 + */ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + #if !defined(NO_ZPIPE) && defined(WIN32) + # define popen _popen +@@ -97,7 +99,7 @@ + XpmInfo *info; + { + xpmData mdata; +- char *name, *dot, *s, new_name[BUFSIZ]; ++ char *name, *dot, *s, new_name[BUFSIZ] = {0}; + int ErrorStatus; + + /* open file to write */ +@@ -119,23 +121,25 @@ + name++; + #endif + /* let's try to make a valid C syntax name */ +- if (dot = index(name, '.')) { +- strcpy(new_name, name); ++ if (index(name, '.')) { ++ strncpy(new_name, name, sizeof(new_name)); ++ new_name[sizeof(new_name)-1] = 0; + /* change '.' to '_' */ + name = s = new_name; +- while (dot = index(s, '.')) { ++ while ((dot = index(s, '.'))) { + *dot = '_'; + s = dot; + } + } +- if (dot = index(name, '-')) { ++ if (index(name, '-')) { + if (name != new_name) { +- strcpy(new_name, name); ++ strncpy(new_name, name, sizeof(new_name)); ++ new_name[sizeof(new_name)-1] = 0; + name = new_name; + } + /* change '-' to '_' */ + s = name; +- while (dot = index(s, '-')) { ++ while ((dot = index(s, '-'))) { + *dot = '_'; + s = dot; + } +@@ -226,7 +230,7 @@ + fprintf(file, "\"%s", *defaults++); + + for (key = 1; key <= NKEYS; key++, defaults++) { +- if (s = *defaults) ++ if ((s = *defaults)) + fprintf(file, "\t%s %s", xpmColorKeys[key - 1], s); + } + fprintf(file, "\",\n"); +@@ -247,6 +251,8 @@ unsigned int x, y, h; h = height - 1; -+ if (cpp != 0 && width >= (SIZE_MAX - 3)/cpp) ++ if (cpp != 0 && width >= (UINT_MAX - 3)/cpp) + return XpmNoMemory; p = buf = (char *) XpmMalloc(width * cpp + 3); if (!buf) return (XpmNoMemory); -diff -urN xc/extras/Xpm~/lib/XpmI.h xc/extras/Xpm/lib/XpmI.h ---- xc/extras/Xpm~/lib/XpmI.h 2004-09-18 12:39:38.000000000 -0500 -+++ xc/extras/Xpm/lib/XpmI.h 2004-09-18 12:42:05.000000000 -0500 -@@ -116,6 +116,18 @@ +@@ -297,6 +303,11 @@ + /* + * open the given file to be written as an xpmData which is returned + */ ++#ifndef NO_ZPIPE ++ FILE *s_popen(char *cmd, const char *type); ++#else ++# define s_popen popen ++#endif + static int + OpenWriteFile(filename, mdata) + char *filename; +@@ -312,16 +323,23 @@ + mdata->type = XPMFILE; + } else { + #ifndef NO_ZPIPE +- int len = strlen(filename); ++ size_t len = strlen(filename); ++ ++ if(len == 0 || ++ filename[0] == '/' || ++ strstr(filename, "../") != NULL || ++ filename[len-1] == '/') ++ return(XpmOpenFailed); ++ + if (len > 2 && !strcmp(".Z", filename + (len - 2))) { +- sprintf(buf, "compress > \"%s\"", filename); +- if (!(mdata->stream.file = popen(buf, "w"))) ++ snprintf(buf, sizeof(buf), "compress > \"%s\"", filename); ++ if (!(mdata->stream.file = s_popen(buf, "w"))) + return (XpmOpenFailed); + + mdata->type = XPMPIPE; + } else if (len > 3 && !strcmp(".gz", filename + (len - 3))) { +- sprintf(buf, "gzip -q > \"%s\"", filename); +- if (!(mdata->stream.file = popen(buf, "w"))) ++ snprintf(buf, sizeof(buf), "gzip -q > \"%s\"", filename); ++ if (!(mdata->stream.file = s_popen(buf, "w"))) + return (XpmOpenFailed); + + mdata->type = XPMPIPE; +@@ -352,7 +370,7 @@ + break; + #ifndef NO_ZPIPE + case XPMPIPE: +- pclose(mdata->stream.file); ++ fclose(mdata->stream.file); + break; + #endif + } +diff -urN xc~/extras/Xpm/lib/XpmI.h xc/extras/Xpm/lib/XpmI.h +--- xc/extras/Xpm/lib/XpmI.h~ 2004-12-02 00:00:43.000000000 -0500 ++++ xc/extras/Xpm/lib/XpmI.h 2004-12-02 00:02:22.000000000 -0500 +@@ -49,6 +49,7 @@ + * lets try to solve include files + */ + ++#include <sys/types.h> + #include <stdio.h> + #include <stdlib.h> + /* stdio.h doesn't declare popen on a Sequent DYNIX OS */ +@@ -116,6 +117,18 @@ boundCheckingCalloc((long)(nelem),(long) (elsize)) #endif @@ -137,7 +1034,7 @@ #define XPMMAXCMTLEN BUFSIZ typedef struct { unsigned int type; -@@ -217,9 +229,9 @@ +@@ -217,9 +230,9 @@ } *xpmHashAtom; typedef struct { @@ -150,44 +1047,374 @@ xpmHashAtom *atomTable; } xpmHashTable; -diff -urN xc/extras/Xpm~/lib/create.c xc/extras/Xpm/lib/create.c ---- xc/extras/Xpm~/lib/create.c 2004-09-18 12:39:46.000000000 -0500 -+++ xc/extras/Xpm/lib/create.c 2004-09-18 12:42:05.000000000 -0500 -@@ -1,3 +1,4 @@ -+/* $XdotOrg: pre-CVS proposed fix for CESA-2004-003 alanc 7/25/2004 $ */ - /* - * Copyright (C) 1989-95 GROUPE BULL - * -@@ -819,6 +820,9 @@ +diff -urN xc~/extras/Xpm/lib/create.c xc/extras/Xpm/lib/create.c +--- xc~/extras/Xpm/lib/create.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/create.c 2004-12-01 23:25:47.000000000 -0500 +@@ -43,6 +43,8 @@ + * Lorens Younes ([EMAIL PROTECTED]) 4/96 + */ ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + #include <ctype.h> + +@@ -212,8 +214,7 @@ + } CloseColor; + + static int +-closeness_cmp(a, b) +- Const void *a, *b; ++closeness_cmp(Const void *a, Const void *b) + { + CloseColor *x = (CloseColor *) a, *y = (CloseColor *) b; + +@@ -517,7 +518,7 @@ + /* variables stored in the XpmAttributes structure */ + Visual *visual; + Colormap colormap; +- XpmColorSymbol *colorsymbols; ++ XpmColorSymbol *colorsymbols = NULL; + unsigned int numsymbols; + XpmAllocColorFunc allocColor; + void *closure; +@@ -525,7 +526,7 @@ + char *colorname; + unsigned int color, key; + Bool pixel_defined; +- XpmColorSymbol *symbol; ++ XpmColorSymbol *symbol = NULL; + char **defaults; + int ErrorStatus = XpmSuccess; + char *s; +@@ -583,7 +584,7 @@ + */ + } else { + #endif +- int i; ++ unsigned int i; + + #ifndef AMIGA + ncols = visual->map_entries; +@@ -743,12 +744,14 @@ + + + /* function call in case of error */ ++ + #undef RETURN + #define RETURN(status) \ ++do \ + { \ + ErrorStatus = status; \ + goto error; \ +-} ++} while(0) + + int + XpmCreateImageFromXpmImage(display, image, +@@ -819,6 +822,9 @@ + ErrorStatus = XpmSuccess; -+ if (image->ncolors >= SIZE_MAX / sizeof(Pixel)) ++ if (image->ncolors >= UINT_MAX / sizeof(Pixel)) + return (XpmNoMemory); + /* malloc pixels index tables */ image_pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * image->ncolors); if (!image_pixels) -@@ -991,6 +995,8 @@ +@@ -991,7 +997,13 @@ return (XpmNoMemory); #if !defined(FOR_MSW) && !defined(AMIGA) -+ if (height != 0 && (*image_return)->bytes_per_line >= SIZE_MAX / height) ++ if (height != 0 && (*image_return)->bytes_per_line >= INT_MAX / height) { ++ XDestroyImage(*image_return); + return XpmNoMemory; ++ } /* now that bytes_per_line must have been set properly alloc data */ ++ if((*image_return)->bytes_per_line == 0 || height == 0) ++ return XpmNoMemory; (*image_return)->data = (char *) XpmMalloc((*image_return)->bytes_per_line * height); -@@ -2063,6 +2069,9 @@ + +@@ -1020,7 +1032,7 @@ + LFUNC(_putbits, void, (register char *src, int dstoffset, + register int numbits, register char *dst)); + +-LFUNC(_XReverse_Bytes, int, (register unsigned char *bpt, register int nb)); ++LFUNC(_XReverse_Bytes, int, (register unsigned char *bpt, register unsigned int nb)); + + static unsigned char Const _reverse_byte[0x100] = { + 0x00, 0x80, 0x40, 0xc0, 0x20, 0xa0, 0x60, 0xe0, +@@ -1060,12 +1072,12 @@ + static int + _XReverse_Bytes(bpt, nb) + register unsigned char *bpt; +- register int nb; ++ register unsigned int nb; + { + do { + *bpt = _reverse_byte[*bpt]; + bpt++; +- } while (--nb > 0); ++ } while (--nb > 0); /* is nb user-controled? */ + return 0; + } + +@@ -1204,7 +1216,7 @@ + register char *src; + register char *dst; + register unsigned int *iptr; +- register int x, y, i; ++ register unsigned int x, y, i; + register char *data; + Pixel pixel, px; + int nbytes, depth, ibu, ibpp; +@@ -1214,8 +1226,8 @@ + depth = image->depth; + if (depth == 1) { + ibu = image->bitmap_unit; +- for (y = 0; y < height; y++) +- for (x = 0; x < width; x++, iptr++) { ++ for (y = 0; y < height; y++) /* how can we trust height */ ++ for (x = 0; x < width; x++, iptr++) { /* how can we trust width */ + pixel = pixels[*iptr]; + for (i = 0, px = pixel; i < sizeof(unsigned long); + i++, px >>= 8) +@@ -1290,12 +1302,12 @@ + { + unsigned char *data; + unsigned int *iptr; +- int y; ++ unsigned int y; + Pixel pixel; + + #ifdef WITHOUT_SPEEDUPS + +- int x; ++ unsigned int x; + unsigned char *addr; + + data = (unsigned char *) image->data; +@@ -1332,7 +1344,7 @@ + + #else /* WITHOUT_SPEEDUPS */ + +- int bpl = image->bytes_per_line; ++ unsigned int bpl = image->bytes_per_line; + unsigned char *data_ptr, *max_data; + + data = (unsigned char *) image->data; +@@ -1400,11 +1412,11 @@ + { + unsigned char *data; + unsigned int *iptr; +- int y; ++ unsigned int y; + + #ifdef WITHOUT_SPEEDUPS + +- int x; ++ unsigned int x; + unsigned char *addr; + + data = (unsigned char *) image->data; +@@ -1428,7 +1440,7 @@ + + Pixel pixel; + +- int bpl = image->bytes_per_line; ++ unsigned int bpl = image->bytes_per_line; + unsigned char *data_ptr, *max_data; + + data = (unsigned char *) image->data; +@@ -1481,11 +1493,11 @@ + { + char *data; + unsigned int *iptr; +- int y; ++ unsigned int y; + + #ifdef WITHOUT_SPEEDUPS + +- int x; ++ unsigned int x; + + data = image->data; + iptr = pixelindex; +@@ -1495,7 +1507,7 @@ + + #else /* WITHOUT_SPEEDUPS */ + +- int bpl = image->bytes_per_line; ++ unsigned int bpl = image->bytes_per_line; + char *data_ptr, *max_data; + + data = image->data; +@@ -1530,12 +1542,12 @@ + PutImagePixels(image, width, height, pixelindex, pixels); + else { + unsigned int *iptr; +- int y; ++ unsigned int y; + char *data; + + #ifdef WITHOUT_SPEEDUPS + +- int x; ++ unsigned int x; + + data = image->data; + iptr = pixelindex; +@@ -1755,10 +1767,12 @@ + register char *src; + register char *dst; + register int i; +- register char *data; + Pixel px; + int nbytes; + ++ if(x < 0 || y < 0) ++ return 0; ++ + for (i=0, px=pixel; i<sizeof(unsigned long); i++, px>>=8) + ((unsigned char *)&pixel)[i] = px; + src = &ximage->data[XYINDEX(x, y, ximage)]; +@@ -1788,9 +1802,11 @@ + register char *src; + register char *dst; + register int i; +- register char *data; + Pixel px; +- int nbytes, ibpp; ++ unsigned int nbytes, ibpp; ++ ++ if(x < 0 || y < 0) ++ return 0; + + ibpp = ximage->bits_per_pixel; + if (ximage->depth == 4) +@@ -1823,6 +1839,9 @@ + { + unsigned char *addr; + ++ if(x < 0 || y < 0) ++ return 0; ++ + addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)]; + *((unsigned long *)addr) = pixel; + return 1; +@@ -1837,6 +1856,9 @@ + { + unsigned char *addr; + ++ if(x < 0 || y < 0) ++ return 0; ++ + addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)]; + addr[0] = pixel >> 24; + addr[1] = pixel >> 16; +@@ -1854,6 +1876,9 @@ + { + unsigned char *addr; + ++ if(x < 0 || y < 0) ++ return 0; ++ + addr = &((unsigned char *)ximage->data) [ZINDEX32(x, y, ximage)]; + addr[3] = pixel >> 24; + addr[2] = pixel >> 16; +@@ -1870,7 +1895,10 @@ + unsigned long pixel; + { + unsigned char *addr; +- ++ ++ if(x < 0 || y < 0) ++ return 0; ++ + addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)]; + addr[0] = pixel >> 8; + addr[1] = pixel; +@@ -1885,7 +1913,10 @@ + unsigned long pixel; + { + unsigned char *addr; +- ++ ++ if(x < 0 || y < 0) ++ return 0; ++ + addr = &((unsigned char *)ximage->data) [ZINDEX16(x, y, ximage)]; + addr[1] = pixel >> 8; + addr[0] = pixel; +@@ -1899,6 +1930,9 @@ + int y; + unsigned long pixel; + { ++ if(x < 0 || y < 0) ++ return 0; ++ + ximage->data[ZINDEX8(x, y, ximage)] = pixel; + return 1; + } +@@ -1910,6 +1944,9 @@ + int y; + unsigned long pixel; + { ++ if(x < 0 || y < 0) ++ return 0; ++ + if (pixel & 1) + ximage->data[ZINDEX1(x, y, ximage)] |= 0x80 >> (x & 7); + else +@@ -1924,6 +1961,9 @@ + int y; + unsigned long pixel; + { ++ if(x < 0 || y < 0) ++ return 0; ++ + if (pixel & 1) + ximage->data[ZINDEX1(x, y, ximage)] |= 1 << (x & 7); + else +@@ -2063,6 +2103,9 @@ xpmGetCmt(data, &colors_cmt); /* malloc pixels index tables */ -+ if (ncolors >= SIZE_MAX / sizeof(Pixel)) -+ return XpmNoMemory; ++ if (ncolors >= UINT_MAX / sizeof(Pixel)) ++ RETURN(XpmNoMemory); + image_pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * ncolors); if (!image_pixels) RETURN(XpmNoMemory); -@@ -2317,7 +2326,8 @@ +@@ -2173,7 +2216,7 @@ + * free the hastable + */ + if (ErrorStatus != XpmSuccess) +- RETURN(ErrorStatus) ++ RETURN(ErrorStatus); + else if (USE_HASHTABLE) + xpmHashTableFree(&hashtable); + +@@ -2186,7 +2229,7 @@ + /* + * parse extensions + */ +- if (info && (info->valuemask & XpmReturnExtensions)) ++ if (info && (info->valuemask & XpmReturnExtensions)) { + if (extensions) { + ErrorStatus = xpmParseExtensions(data, &info->extensions, + &info->nextensions); +@@ -2196,7 +2239,7 @@ + info->extensions = NULL; + info->nextensions = 0; + } +- ++ } + /* + * store found informations in the XpmImage structure + */ +@@ -2317,7 +2360,8 @@ } obm = SelectObject(*dc, image->bitmap); #endif @@ -197,7 +1424,21 @@ bzero((char *)colidx, 256 * sizeof(short)); for (a = 0; a < ncolors; a++) -@@ -2423,6 +2433,9 @@ +@@ -2364,11 +2408,11 @@ + + /* array of pointers malloced by need */ + unsigned short *cidx[256]; +- int char1; ++ unsigned int char1; + + bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */ + for (a = 0; a < ncolors; a++) { +- char1 = colorTable[a].string[0]; ++ char1 = (unsigned char) colorTable[a].string[0]; + if (cidx[char1] == NULL) { /* get new memory */ + cidx[char1] = (unsigned short *) + XpmCalloc(256, sizeof(unsigned short)); +@@ -2423,6 +2467,9 @@ char *s; char buf[BUFSIZ]; @@ -207,22 +1448,62 @@ buf[cpp] = '\0'; if (USE_HASHTABLE) { xpmHashAtom *slot; -diff -urN xc/extras/Xpm~/lib/data.c xc/extras/Xpm/lib/data.c ---- xc/extras/Xpm~/lib/data.c 2004-09-18 12:39:46.000000000 -0500 -+++ xc/extras/Xpm/lib/data.c 2004-09-18 12:42:05.000000000 -0500 -@@ -374,7 +374,7 @@ +diff -urN xc~/extras/Xpm/lib/data.c xc/extras/Xpm/lib/data.c +--- xc~/extras/Xpm/lib/data.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/data.c 2004-12-01 23:26:45.000000000 -0500 +@@ -32,6 +32,8 @@ + * Developed by Arnaud Le Hors * + \*****************************************************************************/ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #ifndef CXPMPROG + /* Official version number */ + static char *RCS_Version = "$XpmVersion: 3.4k $"; +@@ -49,8 +51,7 @@ + #endif + + static int +-ParseComment(data) +- xpmData *data; ++ParseComment(xpmData *data) { + if (data->type == XPMBUFFER) { + register char c; +@@ -261,7 +262,7 @@ + } + Ungetc(data, c, file); + } +- return (n); ++ return (n); /* this returns bytes read + 1 */ + } + + /* +@@ -374,8 +375,9 @@ + { if (!data->type) *cmt = NULL; - else if (data->CommentLength) { -+ else if (data->CommentLength != 0 && data->CommentLength < SIZE_MAX - 1) { - *cmt = (char *) XpmMalloc(data->CommentLength + 1); +- *cmt = (char *) XpmMalloc(data->CommentLength + 1); ++ else if (data->CommentLength != 0 && data->CommentLength < UINT_MAX - 1) { ++ if( (*cmt = (char *) XpmMalloc(data->CommentLength + 1)) == NULL) ++ return XpmNoMemory; strncpy(*cmt, data->Comment, data->CommentLength); (*cmt)[data->CommentLength] = '\0'; -diff -urN xc/extras/Xpm~/lib/hashtab.c xc/extras/Xpm/lib/hashtab.c ---- xc/extras/Xpm~/lib/hashtab.c 2004-09-18 12:39:46.000000000 -0500 -+++ xc/extras/Xpm/lib/hashtab.c 2004-09-18 12:42:05.000000000 -0500 -@@ -135,7 +135,7 @@ + data->CommentLength = 0; +@@ -403,7 +405,7 @@ + xpmParseHeader(data) + xpmData *data; + { +- char buf[BUFSIZ]; ++ char buf[BUFSIZ+1] = {0}; + int l, n = 0; + + if (data->type) { +diff -urN xc~/extras/Xpm/lib/hashtab.c xc/extras/Xpm/lib/hashtab.c +--- xc~/extras/Xpm/lib/hashtab.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/hashtab.c 2004-12-01 23:26:57.000000000 -0500 +@@ -135,15 +135,17 @@ xpmHashTable *table; { xpmHashAtom *atomTable = table->atomTable; @@ -230,12 +1511,14 @@ + unsigned int size = table->size; xpmHashAtom *t, *p; int i; - int oldSize = size; -@@ -144,6 +144,8 @@ +- int oldSize = size; ++ unsigned int oldSize = size; + + t = atomTable; HASH_TABLE_GROWS table->size = size; table->limit = size / 3; -+ if (size >= SIZE_MAX / sizeof(*atomTable)) ++ if (size >= UINT_MAX / sizeof(*atomTable)) + return (XpmNoMemory); atomTable = (xpmHashAtom *) XpmMalloc(size * sizeof(*atomTable)); if (!atomTable) @@ -244,45 +1527,58 @@ table->size = INITIAL_HASH_SIZE; table->limit = table->size / 3; table->used = 0; -+ if (table->size >= SIZE_MAX / sizeof(*atomTable)) ++ if (table->size >= UINT_MAX / sizeof(*atomTable)) + return (XpmNoMemory); atomTable = (xpmHashAtom *) XpmMalloc(table->size * sizeof(*atomTable)); if (!atomTable) return (XpmNoMemory); -diff -urN xc/extras/Xpm~/lib/parse.c xc/extras/Xpm/lib/parse.c ---- xc/extras/Xpm~/lib/parse.c 2004-09-18 12:39:46.000000000 -0500 -+++ xc/extras/Xpm/lib/parse.c 2004-09-18 12:42:05.000000000 -0500 -@@ -1,3 +1,4 @@ -+/* $XdotOrg: pre-CVS proposed fix for CESA-2004-003 alanc 7/25/2004 $ */ - /* - * Copyright (C) 1989-95 GROUPE BULL - * -@@ -43,6 +44,24 @@ +diff -urN xc~/extras/Xpm/lib/misc.c xc/extras/Xpm/lib/misc.c +--- xc~/extras/Xpm/lib/misc.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/misc.c 2004-12-01 23:13:30.000000000 -0500 +@@ -44,7 +44,7 @@ + char *s1; + { + char *s2; +- int l = strlen(s1) + 1; ++ size_t l = strlen(s1) + 1; + + if (s2 = (char *) XpmMalloc(l)) + strcpy(s2, s1); +diff -urN xc~/extras/Xpm/lib/parse.c xc/extras/Xpm/lib/parse.c +--- xc~/extras/Xpm/lib/parse.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/parse.c 2004-12-01 23:16:39.000000000 -0500 +@@ -39,10 +39,30 @@ + * HeDu ([EMAIL PROTECTED]) 4/94 + */ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" #include <ctype.h> #include <string.h> +#ifdef HAS_STRLCAT -+# define STRLCAT(dst, src, dstsize) { \ -+ if (strlcat(dst, src, dstsize) >= (dstsize)) \ -+ return (XpmFileInvalid); } -+# define STRLCPY(dst, src, dstsize) { \ -+ if (strlcpy(dst, src, dstsize) >= (dstsize)) \ -+ return (XpmFileInvalid); } ++# define STRLCAT(dst, src, dstsize) do { \ ++ if (strlcat(dst, src, dstsize) >= (dstsize)) \ ++ return (XpmFileInvalid); } while(0) ++# define STRLCPY(dst, src, dstsize) do { \ ++ if (strlcpy(dst, src, dstsize) >= (dstsize)) \ ++ return (XpmFileInvalid); } while(0) +#else -+# define STRLCAT(dst, src, dstsize) { \ ++# define STRLCAT(dst, src, dstsize) do { \ + if ((strlen(dst) + strlen(src)) < (dstsize)) \ -+ strcat(dst, src); \ -+ else return (XpmFileInvalid); } -+# define STRLCPY(dst, src, dstsize) { \ ++ strcat(dst, src); \ ++ else return (XpmFileInvalid); } while(0) ++# define STRLCPY(dst, src, dstsize) do { \ + if (strlen(src) < (dstsize)) \ -+ strcpy(dst, src); \ -+ else return (XpmFileInvalid); } ++ strcpy(dst, src); \ ++ else return (XpmFileInvalid); } while(0) +#endif + LFUNC(ParsePixels, int, (xpmData *data, unsigned int width, unsigned int height, unsigned int ncolors, unsigned int cpp, XpmColor *colorTable, -@@ -65,7 +84,7 @@ +@@ -65,7 +85,7 @@ unsigned int *extensions; { unsigned int l; @@ -291,7 +1587,7 @@ if (!data->format) { /* XPM 2 or 3 */ -@@ -174,10 +193,10 @@ +@@ -174,10 +194,10 @@ XpmColor **colorTablePtr; xpmHashTable *hashtable; { @@ -304,27 +1600,36 @@ char curbuf[BUFSIZ]; /* current buffer */ char **sptr, *s; XpmColor *color; -@@ -185,6 +204,8 @@ +@@ -185,6 +205,8 @@ char **defaults; int ErrorStatus; -+ if (ncolors >= SIZE_MAX / sizeof(XpmColor)) ++ if (ncolors >= UINT_MAX / sizeof(XpmColor)) + return (XpmNoMemory); colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor)); if (!colorTable) return (XpmNoMemory); -@@ -196,6 +217,10 @@ +@@ -196,6 +218,10 @@ /* * read pixel value */ -+ if (cpp >= SIZE_MAX - 1) { ++ if (cpp >= UINT_MAX - 1) { + xpmFreeColorTable(colorTable, ncolors); + return (XpmNoMemory); + } color->string = (char *) XpmMalloc(cpp + 1); if (!color->string) { xpmFreeColorTable(colorTable, ncolors); -@@ -233,13 +258,14 @@ +@@ -224,7 +250,7 @@ + curkey = 0; + lastwaskey = 0; + *curbuf = '\0'; /* init curbuf */ +- while (l = xpmNextWord(data, buf, BUFSIZ)) { ++ while ((l = xpmNextWord(data, buf, BUFSIZ))) { + if (!lastwaskey) { + for (key = 0, sptr = xpmColorKeys; key < NKEYS; key++, + sptr++) +@@ -233,13 +259,14 @@ } if (!lastwaskey && key < NKEYS) { /* open new key */ if (curkey) { /* flush string */ @@ -341,24 +1646,24 @@ } curkey = key + 1; /* set new key */ *curbuf = '\0'; /* reset curbuf */ -@@ -250,9 +276,9 @@ +@@ -250,9 +277,9 @@ return (XpmFileInvalid); } if (!lastwaskey) - strcat(curbuf, " "); /* append space */ -+ STRLCAT(curbuf, " ", sizeof(curbuf)); /* append space */ ++ STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */ buf[l] = '\0'; - strcat(curbuf, buf);/* append buf */ -+ STRLCAT(curbuf, buf, sizeof(curbuf));/* append buf */ ++ STRLCAT(curbuf, buf, sizeof(curbuf)); /* append buf */ lastwaskey = 0; } } -@@ -260,12 +286,13 @@ +@@ -260,12 +287,13 @@ xpmFreeColorTable(colorTable, ncolors); return (XpmFileInvalid); } - s = defaults[curkey] = (char *) XpmMalloc(strlen(curbuf) + 1); -+ len = strlen(curbuf) + 1; ++ len = strlen(curbuf) + 1; /* integer overflow just theoretically possible */ + s = defaults[curkey] = (char *) XpmMalloc(len); if (!s) { xpmFreeColorTable(colorTable, ncolors); @@ -369,20 +1674,23 @@ } } else { /* XPM 1 */ /* get to the beginning of the first string */ -@@ -278,6 +305,10 @@ +@@ -278,6 +306,10 @@ /* * read pixel value */ -+ if (cpp >= SIZE_MAX - 1) { ++ if (cpp >= UINT_MAX - 1) { + xpmFreeColorTable(colorTable, ncolors); + return (XpmNoMemory); + } color->string = (char *) XpmMalloc(cpp + 1); if (!color->string) { xpmFreeColorTable(colorTable, ncolors); -@@ -306,16 +337,17 @@ +@@ -304,21 +336,22 @@ + */ + xpmNextString(data); /* get to the next string */ *curbuf = '\0'; /* init curbuf */ - while (l = xpmNextWord(data, buf, BUFSIZ)) { +- while (l = xpmNextWord(data, buf, BUFSIZ)) { ++ while ((l = xpmNextWord(data, buf, BUFSIZ))) { if (*curbuf != '\0') - strcat(curbuf, " ");/* append space */ + STRLCAT(curbuf, " ", sizeof(curbuf));/* append space */ @@ -401,41 +1709,364 @@ + memcpy(s, curbuf, len); color->c_color = s; *curbuf = '\0'; /* reset curbuf */ - if (a < ncolors - 1) -@@ -340,6 +372,9 @@ - unsigned int *iptr, *iptr2; +- if (a < ncolors - 1) ++ if (a < ncolors - 1) /* can we trust ncolors -> leave data's bounds */ + xpmNextString(data); /* get to the next string */ + } + } +@@ -337,9 +370,12 @@ + xpmHashTable *hashtable; + unsigned int **pixels; + { +- unsigned int *iptr, *iptr2; ++ unsigned int *iptr, *iptr2 = NULL; /* found by Egbert Eich */ unsigned int a, x, y; -+ if ((height > 0 && width >= SIZE_MAX / height) || -+ width * height >= SIZE_MAX / sizeof(unsigned int)) ++ if ((height > 0 && width >= UINT_MAX / height) || ++ width * height >= UINT_MAX / sizeof(unsigned int)) + return XpmNoMemory; #ifndef FOR_MSW iptr2 = (unsigned int *) XpmMalloc(sizeof(unsigned int) * width * height); #else -@@ -363,6 +398,9 @@ +@@ -363,6 +399,11 @@ { unsigned short colidx[256]; -+ if (ncolors > 256) ++ if (ncolors > 256) { ++ XpmFree(iptr2); /* found by Egbert Eich */ + return (XpmFileInvalid); ++ } + bzero((char *)colidx, 256 * sizeof(short)); for (a = 0; a < ncolors; a++) colidx[(unsigned char)colorTable[a].string[0]] = a + 1; -@@ -441,6 +479,9 @@ +@@ -388,16 +429,20 @@ + { + + /* free all allocated pointers at all exits */ +-#define FREE_CIDX {int f; for (f = 0; f < 256; f++) \ +-if (cidx[f]) XpmFree(cidx[f]);} ++#define FREE_CIDX \ ++do \ ++{ \ ++ int f; for (f = 0; f < 256; f++) \ ++ if (cidx[f]) XpmFree(cidx[f]); \ ++} while(0) + + /* array of pointers malloced by need */ + unsigned short *cidx[256]; +- int char1; ++ unsigned int char1; + + bzero((char *)cidx, 256 * sizeof(unsigned short *)); /* init */ + for (a = 0; a < ncolors; a++) { +- char1 = colorTable[a].string[0]; ++ char1 = (unsigned char) colorTable[a].string[0]; + if (cidx[char1] == NULL) { /* get new memory */ + cidx[char1] = (unsigned short *) + XpmCalloc(256, sizeof(unsigned short)); +@@ -441,6 +486,11 @@ char *s; char buf[BUFSIZ]; -+ if (cpp >= sizeof(buf)) ++ if (cpp >= sizeof(buf)) { ++ XpmFree(iptr2); /* found by Egbert Eich */ + return (XpmFileInvalid); ++ } + buf[cpp] = '\0'; if (USE_HASHTABLE) { xpmHashAtom *slot; -diff -urN xc/extras/Xpm~/lib/scan.c xc/extras/Xpm/lib/scan.c ---- xc/extras/Xpm~/lib/scan.c 2004-09-18 12:39:46.000000000 -0500 -+++ xc/extras/Xpm/lib/scan.c 2004-09-18 12:42:05.000000000 -0500 -@@ -103,7 +103,8 @@ +@@ -449,7 +499,7 @@ + xpmNextString(data); + for (x = 0; x < width; x++, iptr++) { + for (a = 0, s = buf; a < cpp; a++, s++) +- *s = xpmGetC(data); ++ *s = xpmGetC(data); /* int assigned to char, not a problem here */ + slot = xpmHashSlot(hashtable, buf); + if (!*slot) { /* no color matches */ + XpmFree(iptr2); +@@ -463,7 +513,7 @@ + xpmNextString(data); + for (x = 0; x < width; x++, iptr++) { + for (a = 0, s = buf; a < cpp; a++, s++) +- *s = xpmGetC(data); ++ *s = xpmGetC(data); /* int assigned to char, not a problem here */ + for (a = 0; a < ncolors; a++) + if (!strcmp(colorTable[a].string, buf)) + break; +@@ -518,7 +568,7 @@ + while (!notstart && notend) { + /* there starts an extension */ + ext = (XpmExtension *) +- XpmRealloc(exts, (num + 1) * sizeof(XpmExtension)); ++ XpmRealloc(exts, (num + 1) * sizeof(XpmExtension)); /* can the loop be forced to iterate often enough to make "(num + 1) * sizeof(XpmExtension)" wrapping? */ + if (!ext) { + XpmFree(string); + XpmFreeExtensions(exts, num); +@@ -555,7 +605,7 @@ + while ((notstart = strncmp("XPMEXT", string, 6)) + && (notend = strncmp("XPMENDEXT", string, 9))) { + sp = (char **) +- XpmRealloc(ext->lines, (nlines + 1) * sizeof(char *)); ++ XpmRealloc(ext->lines, (nlines + 1) * sizeof(char *)); /* can we iterate enough for a wrapping? */ + if (!sp) { + XpmFree(string); + ext->nlines = nlines; +@@ -595,9 +645,9 @@ + /* function call in case of error */ + #undef RETURN + #define RETURN(status) \ +-{ \ ++do { \ + goto error; \ +-} ++} while(0) + + /* + * This function parses an Xpm file or data and store the found informations +@@ -695,7 +745,7 @@ + /* + * parse extensions + */ +- if (info && (info->valuemask & XpmReturnExtensions)) ++ if (info && (info->valuemask & XpmReturnExtensions)) { + if (extensions) { + ErrorStatus = xpmParseExtensions(data, &info->extensions, + &info->nextensions); +@@ -705,6 +755,7 @@ + info->extensions = NULL; + info->nextensions = 0; + } ++ } + + /* + * store found informations in the XpmImage structure +diff -urN xc~/extras/Xpm/lib/s_popen.c xc/extras/Xpm/lib/s_popen.c +--- xc~/extras/Xpm/lib/s_popen.c 1969-12-31 19:00:00.000000000 -0500 ++++ xc/extras/Xpm/lib/s_popen.c 2004-12-01 23:13:30.000000000 -0500 +@@ -0,0 +1,181 @@ ++/* ++ * Copyright (C) 2004 The X.Org fundation ++ * ++ * Permission is hereby granted, free of charge, to any person ++ * obtaining a copy of this software and associated documentation ++ * files (the "Software"), to deal in the Software without ++ * restriction, including without limitation the rights to use, copy, ++ * modify, merge, publish, distribute, sublicense, and/or sell copies ++ * of the Software, and to permit persons to whom the Software is fur- ++ * nished to do so, subject to the following conditions: ++ * ++ * The above copyright notice and this permission notice shall be ++ * included in all copies or substantial portions of the Software. ++ * ++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, ++ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF ++ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ++ * NONINFRINGEMENT. IN NO EVENT SHALL THE X CONSORTIUM BE LIABLE FOR ++ * ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF ++ * CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION ++ * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ++ * ++ * Except as contained in this notice, the name of the X.Org fundation ++ * shall not be used in advertising or otherwise to promote the sale, ++ * use or other dealings in this Software without prior written ++ * authorization from the X.Org fundation. ++ */ ++ ++/* ++** This is a secure but NOT 100% compatible replacement for popen() ++** Note: - don't use pclose() use fclose() for closing the returned ++** filedesc.!!! ++** ++** Known Bugs: - unable to use i/o-redirection like > or < ++** Author: - Thomas Biege <[EMAIL PROTECTED]> ++** Credits: - Andreas Pfaller <[EMAIL PROTECTED]> for fixing a SEGV when ++** calling strtok() ++*/ ++ ++#include <sys/types.h> ++#include <sys/wait.h> ++#include <stdio.h> ++#include <stdlib.h> ++#include <unistd.h> ++#include <string.h> ++ ++#define __SEC_POPEN_TOKEN " " ++ ++FILE *s_popen(char *cmd, const char *type) ++{ ++ pid_t pid; ++ int pfd[2]; ++ int rpipe = 0, wpipe = 0, i; ++ char **argv; ++ char *ptr; ++ char *cmdcpy; ++ ++ ++ if(cmd == NULL || cmd == "") ++ return(NULL); ++ ++ if(type[0] != 'r' && type[0] != 'w') ++ return(NULL); ++ ++ if ((cmdcpy = strdup(cmd)) == NULL) ++ return(NULL); ++ ++ argv = NULL; ++ if( (ptr = strtok(cmdcpy, __SEC_POPEN_TOKEN)) == NULL) ++ { ++ free(cmdcpy); ++ return(NULL); ++ } ++ ++ for(i = 0;; i++) ++ { ++ if( ( argv = (char **) realloc(argv, (i+1) * sizeof(char *)) ) == NULL) ++ { ++ free(cmdcpy); ++ return(NULL); ++ } ++ ++ if( (*(argv+i) = (char *) malloc((strlen(ptr)+1) * sizeof(char))) == NULL) ++ { ++ free(cmdcpy); ++ return(NULL); ++ } ++ ++ strcpy(argv[i], ptr); ++ ++ if( (ptr = strtok(NULL, __SEC_POPEN_TOKEN)) == NULL) ++ { ++ if( ( argv = (char **) realloc(argv, (i+2) * sizeof(char *))) == NULL) ++ { ++ free(cmdcpy); ++ return(NULL); ++ } ++ argv[i+1] = NULL; ++ break; ++ } ++ } ++ ++ ++ if(type[0] == 'r') ++ rpipe = 1; ++ else ++ wpipe = 1; ++ ++ if (pipe(pfd) < 0) ++ { ++ free(cmdcpy); ++ return(NULL); ++ } ++ ++ if((pid = fork()) < 0) ++ { ++ close(pfd[0]); ++ close(pfd[1]); ++ free(cmdcpy); ++ return(NULL); ++ } ++ ++ if(pid == 0) /* child */ ++ { ++ if((pid = fork()) < 0) ++ { ++ close(pfd[0]); ++ close(pfd[1]); ++ free(cmdcpy); ++ return(NULL); ++ } ++ if(pid > 0) ++ { ++ exit(0); /* child nr. 1 exits */ ++ } ++ ++ /* child nr. 2 */ ++ if(rpipe) ++ { ++ close(pfd[0]); /* close reading end, we don't need it */ ++ dup2(STDOUT_FILENO, STDERR_FILENO); ++ if (pfd[1] != STDOUT_FILENO) ++ dup2(pfd[1], STDOUT_FILENO); /* redirect stdout to writing end of pipe */ ++ } ++ else ++ { ++ close(pfd[1]); /* close writing end, we don't need it */ ++ if (pfd[0] != STDIN_FILENO) ++ dup2(pfd[0], STDIN_FILENO); /* redirect stdin to reading end of pipe */ ++ } ++ ++ if(strchr(argv[0], '/') == NULL) ++ execvp(argv[0], argv); /* search in $PATH */ ++ else ++ execv(argv[0], argv); ++ ++ close(pfd[0]); ++ close(pfd[1]); ++ free(cmdcpy); ++ return(NULL); /* exec failed.. ooops! */ ++ } ++ else /* parent */ ++ { ++ waitpid(pid, NULL, 0); /* wait for child nr. 1 */ ++ ++ if(rpipe) ++ { ++ close(pfd[1]); ++ free(cmdcpy); ++ return(fdopen(pfd[0], "r")); ++ } ++ else ++ { ++ close(pfd[0]); ++ free(cmdcpy); ++ return(fdopen(pfd[1], "w")); ++ } ++ ++ } ++} ++ +diff -urN xc~/extras/Xpm/lib/scan.c xc/extras/Xpm/lib/scan.c +--- xc~/extras/Xpm/lib/scan.c 2004-12-01 23:11:42.000000000 -0500 ++++ xc/extras/Xpm/lib/scan.c 2004-12-01 23:28:46.000000000 -0500 +@@ -42,6 +42,8 @@ + * Lorens Younes ([EMAIL PROTECTED]) 4/96 + */ + ++/* October 2004, source code review by Thomas Biege <[EMAIL PROTECTED]> */ ++ + #include "XpmI.h" + + #define MAXPRINTABLE 92 /* number of printable ascii chars +@@ -73,6 +75,9 @@ + LFUNC(storeMaskPixel, int, (Pixel pixel, PixelsMap *pmap, + unsigned int *index_return)); + ++typedef int (*storeFuncPtr)(Pixel pixel, PixelsMap *pmap, ++ unsigned int *index_return); ++ + #ifndef FOR_MSW + # ifndef AMIGA + LFUNC(GetImagePixels, int, (XImage *image, unsigned int width, +@@ -89,21 +94,22 @@ + + LFUNC(GetImagePixels1, int, (XImage *image, unsigned int width, + unsigned int height, PixelsMap *pmap, +- int (*storeFunc) ())); ++ storeFuncPtr storeFunc)); + # else /* AMIGA */ + LFUNC(AGetImagePixels, int, (XImage *image, unsigned int width, + unsigned int height, PixelsMap *pmap, +- int (*storeFunc) ())); ++ storeFuncPtr storeFunc)); + # endif/* AMIGA */ + #else /* ndef FOR_MSW */ + LFUNC(MSWGetImagePixels, int, (Display *d, XImage *image, unsigned int width, + unsigned int height, PixelsMap *pmap, +- int (*storeFunc) ())); ++ storeFuncPtr storeFunc)); + #endif LFUNC(ScanTransparentColor, int, (XpmColor *color, unsigned int cpp, XpmAttributes *attributes)); @@ -445,44 +2076,75 @@ Pixel *pixels, unsigned int mask, unsigned int cpp, XpmAttributes *attributes)); -@@ -228,11 +229,17 @@ +@@ -167,10 +173,10 @@ + /* function call in case of error */ + #undef RETURN + #define RETURN(status) \ +-{ \ ++do { \ + ErrorStatus = status; \ + goto error; \ +-} ++} while(0) + + /* + * This function scans the given image and stores the found informations in +@@ -191,7 +197,7 @@ + /* variables to return */ + PixelsMap pmap; + XpmColor *colorTable = NULL; +- int ErrorStatus; ++ int ErrorStatus = 0; + + /* calculation variables */ + unsigned int width = 0; +@@ -228,11 +234,17 @@ else cpp = 0; -+ if ((height > 0 && width >= SIZE_MAX / height) || -+ width * height >= SIZE_MAX / sizeof(unsigned int)) ++ if ((height > 0 && width >= UINT_MAX / height) || ++ width * height >= UINT_MAX / sizeof(unsigned int)) + RETURN(XpmNoMemory); pmap.pixelindex = (unsigned int *) XpmCalloc(width * height, sizeof(unsigned int)); if (!pmap.pixelindex) RETURN(XpmNoMemory); -+ if (pmap.size >= SIZE_MAX / sizeof(Pixel)) ++ if (pmap.size >= UINT_MAX / sizeof(Pixel)) + RETURN(XpmNoMemory); + pmap.pixels = (Pixel *) XpmMalloc(sizeof(Pixel) * pmap.size); if (!pmap.pixels) RETURN(XpmNoMemory); -@@ -297,7 +304,8 @@ +@@ -297,7 +309,8 @@ * get rgb values and a string of char, and possibly a name for each * color */ - -+ if (pmap.ncolors >= SIZE_MAX / sizeof(XpmColor)) ++ if (pmap.ncolors >= UINT_MAX / sizeof(XpmColor)) + RETURN(XpmNoMemory); colorTable = (XpmColor *) XpmCalloc(pmap.ncolors, sizeof(XpmColor)); if (!colorTable) RETURN(XpmNoMemory); -@@ -356,6 +364,8 @@ +@@ -356,6 +369,8 @@ /* first get a character string */ a = 0; -+ if (cpp >= SIZE_MAX - 1) ++ if (cpp >= UINT_MAX - 1) + return (XpmNoMemory); if (!(s = color->string = (char *) XpmMalloc(cpp + 1))) return (XpmNoMemory); *s++ = printable[c = a % MAXPRINTABLE]; -@@ -403,7 +413,7 @@ +@@ -385,7 +400,7 @@ + ((XpmColor **) attributes->colorTable)[attributes->mask_pixel]; + /* end 3.2 bc */ + for (key = 1; key <= NKEYS; key++) { +- if (s = mask_defaults[key]) { ++ if ((s = mask_defaults[key])) { + defaults[key] = (char *) xpmstrdup(s); + if (!defaults[key]) + return (XpmNoMemory); +@@ -403,7 +418,7 @@ ScanOtherColors(display, colors, ncolors, pixels, mask, cpp, attributes) Display *display; XpmColor *colors; @@ -491,19 +2153,149 @@ Pixel *pixels; unsigned int mask; unsigned int cpp; -@@ -447,6 +457,8 @@ +@@ -423,10 +438,10 @@ + XpmColor *color; + XColor *xcolors = NULL, *xcolor; + char *colorname, *s; +- XpmColor *colorTable, **oldColorTable = NULL; ++ XpmColor *colorTable = NULL, **oldColorTable = NULL; + unsigned int ancolors = 0; +- Pixel *apixels; +- unsigned int mask_pixel; ++ Pixel *apixels = NULL; ++ unsigned int mask_pixel = 0; + Bool found; + + /* retrieve information from the XpmAttributes */ +@@ -447,6 +462,8 @@ } /* first get character strings and rgb values */ -+ if (ncolors >= SIZE_MAX / sizeof(XColor) || cpp >= SIZE_MAX - 1) ++ if (ncolors >= UINT_MAX / sizeof(XColor) || cpp >= UINT_MAX - 1) + return (XpmNoMemory); xcolors = (XColor *) XpmMalloc(sizeof(XColor) * ncolors); if (!xcolors) return (XpmNoMemory); -diff -urN xc/lib/Xpm~/Imakefile xc/lib/Xpm/Imakefile ---- xc/lib/Xpm~/Imakefile 2004-09-18 12:39:46.000000000 -0500 -+++ xc/lib/Xpm/Imakefile 2004-09-18 12:42:05.000000000 -0500 -@@ -42,11 +42,16 @@ +@@ -521,7 +538,7 @@ + + found = True; + for (key = 1; key <= NKEYS; key++) { +- if (s = adefaults[key]) ++ if ((s = adefaults[key])) + defaults[key] = (char *) xpmstrdup(s); + } + } +@@ -603,7 +620,7 @@ + char *dst; + unsigned int *iptr; + char *data; +- int x, y, i; ++ unsigned int x, y, i; + int bits, depth, ibu, ibpp, offset; + unsigned long lbt; + Pixel pixel, px; +@@ -705,7 +722,7 @@ + unsigned char *addr; + unsigned char *data; + unsigned int *iptr; +- int x, y; ++ unsigned int x, y; + unsigned long lbt; + Pixel pixel; + int depth; +@@ -770,7 +787,7 @@ + unsigned char *addr; + unsigned char *data; + unsigned int *iptr; +- int x, y; ++ unsigned int x, y; + unsigned long lbt; + Pixel pixel; + int depth; +@@ -815,7 +832,7 @@ + { + unsigned int *iptr; + unsigned char *data; +- int x, y; ++ unsigned int x, y; + unsigned long lbt; + Pixel pixel; + int depth; +@@ -845,10 +862,10 @@ + unsigned int width; + unsigned int height; + PixelsMap *pmap; +- int (*storeFunc) (); ++ storeFuncPtr storeFunc; + { + unsigned int *iptr; +- int x, y; ++ unsigned int x, y; + char *data; + Pixel pixel; + int xoff, yoff, offset, bpl; +@@ -884,11 +901,11 @@ + # else /* AMIGA */ + + #define CLEAN_UP(status) \ +-{\ ++do {\ + if (pixels) XpmFree (pixels);\ + if (tmp_img) FreeXImage (tmp_img);\ + return (status);\ +-} ++} while(0) + + static int + AGetImagePixels ( +@@ -909,7 +926,7 @@ + + tmp_img = AllocXImage ((((width+15)>>4)<<4), 1, image->rp->BitMap->Depth); + if (tmp_img == NULL) +- CLEAN_UP (XpmNoMemory) ++ CLEAN_UP (XpmNoMemory); + + iptr = pmap->pixelindex; + for (y = 0; y < height; ++y) +@@ -918,11 +935,11 @@ + for (x = 0; x < width; ++x, ++iptr) + { + if ((*storeFunc) (pixels[x], pmap, iptr)) +- CLEAN_UP (XpmNoMemory) ++ CLEAN_UP (XpmNoMemory); + } + } + +- CLEAN_UP (XpmSuccess) ++ CLEAN_UP (XpmSuccess); + } + + #undef CLEAN_UP +diff -urN xc~/extras/Xpm/lib/xpm.h xc/extras/Xpm/lib/xpm.h +--- xc~/extras/Xpm/lib/xpm.h 1999-01-11 08:23:11.000000000 -0500 ++++ xc/extras/Xpm/lib/xpm.h 2004-12-01 23:29:05.000000000 -0500 +@@ -392,7 +392,7 @@ + FUNC(XpmReadFileToData, int, (char *filename, char ***data_return)); + FUNC(XpmWriteFileFromData, int, (char *filename, char **data)); + +- FUNC(XpmAttributesSize, int, ()); ++ FUNC(XpmAttributesSize, int, (void)); + FUNC(XpmFreeAttributes, void, (XpmAttributes *attributes)); + FUNC(XpmFreeExtensions, void, (XpmExtension *extensions, + int nextensions)); +@@ -400,7 +400,7 @@ + FUNC(XpmFreeXpmImage, void, (XpmImage *image)); + FUNC(XpmFreeXpmInfo, void, (XpmInfo *info)); + FUNC(XpmGetErrorString, char *, (int errcode)); +- FUNC(XpmLibraryVersion, int, ()); ++ FUNC(XpmLibraryVersion, int, (void)); + + /* XpmImage functions */ + FUNC(XpmReadFileToXpmImage, int, (char *filename, +diff -urN xc~/lib/Xpm/Imakefile xc/lib/Xpm/Imakefile +--- xc~/lib/Xpm/Imakefile 2004-12-01 23:11:42.000000000 -0500 ++++ xc/lib/Xpm/Imakefile 2004-12-01 23:13:31.000000000 -0500 +@@ -42,11 +42,24 @@ SPRINTFDEF = -DVOID_SPRINTF #endif @@ -511,13 +2303,50 @@ +STRLCATDEF = -DHAS_STRLCAT +#endif + ++#if HasSnprintf ++SNPRINTFDEF = -DHAS_SNPRINTF ++#else ++SNPRINTFDEF = -Dsnprintf=_XpmSnprintf ++SNPRINTFSRCS = snprintf.c ++SNPRINTFOBJS = snprintf.o ++#endif ++ #if defined(Win32Architecture) ZPIPEDEF = -DNO_ZPIPE #endif -DEFINES = $(STRDUPDEF) $(STRCASECMPDEF) $(SPRINTFDEF) $(ZPIPEDEF) $(ZFILEDEF) +DEFINES = $(STRDUPDEF) $(STRCASECMPDEF) $(SPRINTFDEF) $(STRLCATDEF) \ -+ $(ZPIPEDEF) $(ZFILEDEF) ++ $(SNPRINTFDEF) $(ZPIPEDEF) $(ZFILEDEF) HEADERS = xpm.h +@@ -54,13 +67,15 @@ + CrBufFrI.c CrDatFrP.c CrPFrBuf.c RdFToI.c WrFFrI.c \ + CrBufFrP.c CrIFrBuf.c CrPFrDat.c RdFToP.c WrFFrP.c \ + CrDatFrI.c CrIFrDat.c RdFToDat.c WrFFrDat.c \ +- Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c ++ Attrib.c CrIFrP.c CrPFrI.c Image.c Info.c RdFToBuf.c WrFFrBuf.c \ ++ s_popen.c $(SNPRINTFSRCS) + + OBJS = data.o create.o misc.o rgb.o scan.o parse.o hashtab.o \ + CrBufFrI.o CrDatFrP.o CrPFrBuf.o RdFToI.o WrFFrI.o \ + CrBufFrP.o CrIFrBuf.o CrPFrDat.o RdFToP.o WrFFrP.o \ + CrDatFrI.o CrIFrDat.o RdFToDat.o WrFFrDat.o \ +- Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o ++ Attrib.o CrIFrP.o CrPFrI.o Image.o Info.o RdFToBuf.o WrFFrBuf.o \ ++ s_popen.o $(SNPRINTFOBJS) + + XPMDIR = $(TOP)/extras/Xpm + XPMLIBDIR = $(TOP)/extras/Xpm/lib +@@ -99,5 +114,10 @@ + LinkSourceFile(RdFToBuf.c,$(XPMLIBDIR)) + LinkSourceFile(WrFFrBuf.c,$(XPMLIBDIR)) + LinkSourceFile(xpm.h,$(XPMLIBDIR)) ++LinkSourceFile(s_popen.c,$(XPMLIBDIR)) ++ ++#if !HasSnprintf ++LinkSourceFile(snprintf.c,$(LIBSRC)/misc) ++#endif + + DependTarget() Modified: branches/4.1.0/woody/debian/patches/400_hppa_support.diff =================================================================== --- branches/4.1.0/woody/debian/patches/400_hppa_support.diff 2004-11-22 11:46:20 UTC (rev 2038) +++ branches/4.1.0/woody/debian/patches/400_hppa_support.diff 2004-12-02 13:27:52 UTC (rev 2039) @@ -42,8 +42,8 @@ # endif diff -ur xc-dist/extras/Xpm/lib/XpmI.h xc/extras/Xpm/lib/XpmI.h --- xc-dist/extras/Xpm/lib/XpmI.h Sun Jul 29 03:33:09 2001 -+++ xc/extras/Xpm/lib/XpmI.h Sun Jul 29 03:43:14 2001 -@@ -84,7 +84,8 @@ ++++ xc/extras/Xpm/lib/XpmI.h Thu Dec 2 00:06:20 2004 +@@ -85,7 +85,8 @@ /* the following is defined in X11R6 but not in previous versions */ #if defined(__alpha) || defined(__alpha__) || \