rpms/xorg-x11-server/FC-5 xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch, NONE, 1.1 xorg-x11-server.spec, 1.48, 1.49

[fedora-cvs-commits at redhat.com]

Author: mharris

Update of /cvs/dist/rpms/xorg-x11-server/FC-5
In directory cvs.devel.redhat.com:/tmp/cvs-serv5440

Modified Files:
	xorg-x11-server.spec 
Added Files:
	xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch 
Log Message:
* Fri May 5 2006 Mike A. Harris <mharris at redhat.com> 1.0.1-9.fc5.2
- Merge xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch security fix
  from 1.0.1-9.fc5.1.1 release from embargoed branch of CVS to FC-5 branch.


xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch:
 mitri.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

--- NEW FILE xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch ---
Index: render/mitri.c
===================================================================
RCS file: /cvs/xorg/xserver/xorg/render/mitri.c,v
retrieving revision 1.5
diff -u -r1.5 mitri.c
--- render/mitri.c	3 Jul 2005 07:02:08 -0000	1.5
+++ render/mitri.c	18 Apr 2006 22:34:08 -0000
@@ -145,7 +145,7 @@
     if (npoint < 3)
 	return;
     ntri = npoint - 2;
-    tris = ALLOCATE_LOCAL (ntri & sizeof (xTriangle));
+    tris = ALLOCATE_LOCAL (ntri * sizeof (xTriangle));
     if (!tris)
 	return;
     for (tri = tris; npoint >= 3; npoint--, points++, tri++)
@@ -177,7 +177,7 @@
     if (npoint < 3)
 	return;
     ntri = npoint - 2;
-    tris = ALLOCATE_LOCAL (ntri & sizeof (xTriangle));
+    tris = ALLOCATE_LOCAL (ntri * sizeof (xTriangle));
     if (!tris)
 	return;
     first = points++;


Index: xorg-x11-server.spec
===================================================================
RCS file: /cvs/dist/rpms/xorg-x11-server/FC-5/xorg-x11-server.spec,v
retrieving revision 1.48
retrieving revision 1.49
diff -u -r1.48 -r1.49
--- xorg-x11-server.spec	24 Apr 2006 19:10:21 -0000	1.48
+++ xorg-x11-server.spec	5 May 2006 06:15:45 -0000	1.49
@@ -4,7 +4,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.0.1
-Release:   9.fc5.1
+Release:   9.fc5.2
 URL:       http://www.x.org
 License:   MIT/X11
 Group:     User Interface/X
@@ -29,6 +29,8 @@
 Patch8:    xorg-server-1.0.1-CVE-2006-0745.patch
 # https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187083
 Patch9:    xorg-server-1.0.1-keymap-overflow.patch
+# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189802
+Patch10:   xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch
 
 # Patches taken from xserver/xorg CVS HEAD, post-1.0.1
 Patch100:  xorg-x11-server-1.0.1-fbpict-fix-rounding.patch
@@ -250,6 +252,7 @@
 %patch7 -p1 -b .xf86configfpic
 %patch8 -p1 -b .CVE-2006-0745
 %patch9 -p1 -b .keymap-overflow
+%patch10 -p0 -b .render-tris-CVE-2006-1526
 
 %patch100 -p2 -b .fbpict-fix-rounding
 %patch101 -p2 -b .SEGV-on-null-interface
@@ -530,17 +533,25 @@
 # -------------------------------------------------------------------
 
 %changelog
-* Mon Apr 24 2006 Adam Jackson <ajackson at redhat.com> - 1.0.1-9.fc5.1
+* Fri May 5 2006 Mike A. Harris <mharris at redhat.com> 1.0.1-9.fc5.2
+- Merge xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch security fix
+  from 1.0.1-9.fc5.1.1 release from embargoed branch of CVS to FC-5 branch.
+
+* Mon May 1 2006 Mike A. Harris <mharris at redhat.com> 1.0.1-9.fc5.1.1
+- Added xorg-x11-server-1.0.1-render-tris-CVE-2006-1526.patch to fix a
+  buffer overflow documented in CVE-2006-1526.  (#189802)
+
+* Mon Apr 24 2006 Adam Jackson <ajackson at redhat.com> 1.0.1-9.fc5.1
 - Backport a Render crash fix from HEAD
 
-* Sun Apr  9 2006 Ray Strode <rstrode at redhat.com> - 1.0.1-9.fc5
+* Sun Apr  9 2006 Ray Strode <rstrode at redhat.com> 1.0.1-9.fc5
 - Fix small overflow that causes crash on vt switch on ppc.
   Patch by David Woodhouse (bug 187083).
 
-* Wed Mar 15 2006 Ray Strode <rstrode at redhat.com> - 1.0.1-9
+* Wed Mar 15 2006 Ray Strode <rstrode at redhat.com> 1.0.1-9
 - CVE-2006-0745 (bug 185084)
 
-* Mon Mar  6 2006 Jeremy Katz <katzj at redhat.com> - 1.0.1-8
+* Mon Mar  6 2006 Jeremy Katz <katzj at redhat.com> 1.0.1-8
 - build libxf86config with -fPIC (#181292)
 - fix sgi 1600sw extra mode (#182430)