libxcb 1.9.1

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>

NEWS

@@ -1,3 +1,9 @@
+Release 1.9.1 (2013-05-30)
+==========================
+
+* Fix python code to work with python-3
+* Security fix for integer overflow in read_packet() [CVE-2013-2064]
+
 Release 1.9 (2012-10-05)
 ========================
 

configure.ac

@@ -4,7 +4,7 @@
 # Initialize Autoconf
 AC_PREREQ(2.57)
 AC_INIT([libxcb],
-        1.9,
+        1.9.1,
         [xcb@lists.freedesktop.org])
 AC_CONFIG_SRCDIR([xcb.pc.in])
 # Set common system defines for POSIX extensions, such as _GNU_SOURCE

src/xcb_in.c

@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
 static int read_packet(xcb_connection_t *c)
 {
     xcb_generic_reply_t genrep;
-    int length = 32;
+    uint64_t length = 32;
-    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
+    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
+    uint64_t bufsize;
     void *buf;
     pending_reply *pend = 0;
     struct event_list *event;
@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
         eventlength = genrep.length * 4;
 
-    buf = malloc(length + eventlength +
+    bufsize = length + eventlength +
-            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
+        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
+    if (bufsize < INT32_MAX)
+        buf = malloc((size_t) bufsize);
+    else
+        buf = NULL;
     if(!buf)
     {
         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);