X2Go Bug report logs - #879
CVE backports incomplete or wrong

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: Ulrich Sibiller <uli42@gmx.de>

To: submit@bugs.x2go.org

Subject: Re: CVE backports incomplete or wrong

Date: Thu, 21 May 2015 08:43:37 +0200

Package: nx-libs

Recently a lot of CVE fixes have been added to nx-libs.

E.g.
debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
and
debian/patches/1028-render-unvalidated-lengths-in-Render-extn.-swap.full.patch
add missing checks to nx-X11/programs/Xserver/render/render.c.

However, there's a file called
nx-X11/programs/Xserver/hw/nxagent/NXrender.c which is derived from
render.c and in that file those checks are missing, too.

(I suspect the original render/render.c is not used at all in favour
of hw/nxagent/NXrender.c but I am not 100% sure here.)

If render.c is used a all (I am not sure) the patches should be
extended to also fix NXrender.c.
If render.c is not used it should be removed and the patches should be
applied to NXrender.c instead.

There might be more cases like this, I only picked this one as an example.

Message #10 received at 879@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: Ulrich Sibiller <uli42@gmx.de>, 879@bugs.x2go.org

Cc: submit@bugs.x2go.org

Subject: Re: [X2Go-Dev] Bug#879: CVE backports incomplete or wrong

Date: Thu, 21 May 2015 10:02:10 +0200

[Message part 1 (text/plain, inline)]

Control: forwarded -1 https://github.com/ArcticaProject/nx-libs/issues/29

On Thu, May 21, 2015 at 08:43:37AM +0200, Ulrich Sibiller wrote:
> Package: nx-libs
> 
> Recently a lot of CVE fixes have been added to nx-libs.
> 
> E.g.
> debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch
> and
> debian/patches/1028-render-unvalidated-lengths-in-Render-extn.-swap.full.patch
> add missing checks to nx-X11/programs/Xserver/render/render.c.
> 
> However, there's a file called
> nx-X11/programs/Xserver/hw/nxagent/NXrender.c which is derived from
> render.c and in that file those checks are missing, too.
> 
> (I suspect the original render/render.c is not used at all in favour
> of hw/nxagent/NXrender.c but I am not 100% sure here.)
> 
> If render.c is used a all (I am not sure) the patches should be
> extended to also fix NXrender.c.
> If render.c is not used it should be removed and the patches should be
> applied to NXrender.c instead.
> 
> There might be more cases like this, I only picked this one as an example.

Forwarded to nx-libs bug tracker [1] for nx-libs 3.6.x on Github.

@Mike#2: I assigned you to this task on Github. If you are not available
for this, please assign me again.

What Ulrich and I realized (in private comm) lately is that there are some files in hw/nxagent/ that are actually Xlib (extension) copies-of-code.

Thus, we need to double-maintain those code sections (I know, it is a mess and needs to be cleared up finally).

  o step A: build against libX* from X.Org
  o step B: be aware for code passages being libX* code, but copied to
    hw/nxagent/ and maintain those passages in hw/nxagent/ for now

Greets,
Mike

[1] https://github.com/ArcticaProject/nx-libs/issues/29

-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 879@bugs.x2go.org (full text, mbox, reply):

From: Ulrich Sibiller <uli42@gmx.de>

To: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Cc: 879@bugs.x2go.org

Subject: Re: [X2Go-Dev] Bug#879: CVE backports incomplete or wrong

Date: Thu, 21 May 2015 13:29:05 +0200

On Thu, May 21, 2015 at 10:02 AM, Mike Gabriel
<mike.gabriel@das-netzwerkteam.de> wrote:
> Control: forwarded -1 https://github.com/ArcticaProject/nx-libs/issues/29

> Thus, we need to double-maintain those code sections (I know, it is a mess and needs to be cleared up finally).
>
>   o step A: build against libX* from X.Org
>   o step B: be aware for code passages being libX* code, but copied to
>     hw/nxagent/ and maintain those passages in hw/nxagent/ for now

I don't think this is limited to the X11 libraries. The mentioned
render.c is for the RENDER extension not the libXrender, I think. It
is built to render.o and included in librender.a. NXrender.c contains
the same functions (+ more) and is compiled to NXrender.o and included
into libnxagent.a. The nxagent binary is finally linked against
libnxagent.a and not librender.a (at least I have not found where that
could happen).

Uli

Message #22 received at 879@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: Ulrich Sibiller <uli42@gmx.de>

Cc: 879@bugs.x2go.org

Subject: Re: [X2Go-Dev] Bug#879: CVE backports incomplete or wrong

Date: Sat, 20 Feb 2016 19:40:58 +0000

[Message part 1 (text/plain, inline)]

Control: fixed -1 3.5.99.0
Control: tag -1 fixed-upstream

On  Do 21 Mai 2015 13:29:05 CEST, Ulrich Sibiller wrote:

> On Thu, May 21, 2015 at 10:02 AM, Mike Gabriel
> <mike.gabriel@das-netzwerkteam.de> wrote:
>> Control: forwarded -1 https://github.com/ArcticaProject/nx-libs/issues/29
>
>> Thus, we need to double-maintain those code sections (I know, it is  
>> a mess and needs to be cleared up finally).
>>
>>   o step A: build against libX* from X.Org
>>   o step B: be aware for code passages being libX* code, but copied to
>>     hw/nxagent/ and maintain those passages in hw/nxagent/ for now
>
> I don't think this is limited to the X11 libraries. The mentioned
> render.c is for the RENDER extension not the libXrender, I think. It
> is built to render.o and included in librender.a. NXrender.c contains
> the same functions (+ more) and is compiled to NXrender.o and included
> into libnxagent.a. The nxagent binary is finally linked against
> libnxagent.a and not librender.a (at least I have not found where that
> could happen).
>
> Uli

Just for the record. This issue has been resolved on the 3.6.x branch  
of nx-libs.

Mike
-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/mailxchange/kronolith/fb.php?u=m.gabriel%40das-netzwerkteam.de

[Message part 2 (application/pgp-signature, inline)]

Message #29 received at 879-quiet@bugs.x2go.org (full text, mbox, reply):

From: Stefan Baur <X2Go-ML-1@baur-itcs.de>

To: 879-quiet@bugs.x2go.org

Subject: Closing/Archiving

Date: Tue, 30 Jan 2024 22:58:45 +0100

Control: close -1
Control: archive -1

This bug has long since been moved to the Arctica Project Github issue 
tracker.

Kind Regards,
Stefan Baur
-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243

Send a report that this bug log contains spam.