1 files changed, 0 insertions, 69 deletions
diff --git a/import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch b/import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch
deleted file mode 100644
index f5b4d69d4..000000000
--- a/import-layers/yocto-poky/meta/recipes-graphics/xorg-lib/libx11/CVE-2016-7942.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From 8ea762f94f4c942d898fdeb590a1630c83235c17 Mon Sep 17 00:00:00 2001
-From: Tobias Stoeckmann <tobias@stoeckmann.org>
-Date: Sun, 25 Sep 2016 21:25:25 +0200
-Subject: Validation of server responses in XGetImage()
-
-Check if enough bytes were received for specified image type and
-geometry. Otherwise GetPixel and other functions could trigger an
-out of boundary read later on.
-
-CVE: CVE-2016-7942
-Upstream-Status: Backport
-
-Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
-Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
-Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
-
-diff --git a/src/GetImage.c b/src/GetImage.c
-index c461abc..ff32d58 100644
---- a/src/GetImage.c
-+++ b/src/GetImage.c
-@@ -59,6 +59,7 @@ XImage *XGetImage (
- 	char *data;
- 	unsigned long nbytes;
- 	XImage *image;
-+	int planes;
- 	LockDisplay(dpy);
- 	GetReq (GetImage, req);
- 	/*
-@@ -91,18 +92,28 @@ XImage *XGetImage (
- 	    return (XImage *) NULL;
- 	}
-         _XReadPad (dpy, data, nbytes);
--        if (format == XYPixmap)
--	   image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
--		  Ones (plane_mask &
--			(((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
--		  format, 0, data, width, height, dpy->bitmap_pad, 0);
--	else /* format == ZPixmap */
--           image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
--		 rep.depth, ZPixmap, 0, data, width, height,
--		  _XGetScanlinePad(dpy, (int) rep.depth), 0);
-+        if (format == XYPixmap) {
-+	    image = XCreateImage(dpy, _XVIDtoVisual(dpy, rep.visual),
-+		Ones (plane_mask &
-+		    (((unsigned long)0xFFFFFFFF) >> (32 - rep.depth))),
-+		format, 0, data, width, height, dpy->bitmap_pad, 0);
-+	    planes = image->depth;
-+	} else { /* format == ZPixmap */
-+            image = XCreateImage (dpy, _XVIDtoVisual(dpy, rep.visual),
-+		rep.depth, ZPixmap, 0, data, width, height,
-+		    _XGetScanlinePad(dpy, (int) rep.depth), 0);
-+	    planes = 1;
-+	}
- 
- 	if (!image)
- 	    Xfree(data);
-+	if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
-+	    INT_MAX / image->height <= image->bytes_per_line ||
-+	    INT_MAX / planes <= image->height * image->bytes_per_line ||
-+	    nbytes < planes * image->height * image->bytes_per_line) {
-+	    XDestroyImage(image);
-+	    image = NULL;
-+	}
- 	UnlockDisplay(dpy);
- 	SyncHandle();
- 	return (image);
--- 
-cgit v0.10.2
-