From 5d53d6226c0ee44fbf64f1d6ec0726429b02a526 Mon Sep 17 00:00:00 2001
From: root <root@hebei.10.60.in-addr.arpa>
Date: Tue, 22 Oct 2024 15:10:38 +0800
Subject: [PATCH] fix cve-2024-31082

---
 tigervnc.spec             |  9 +++++++-
 xorg-CVE-2024-31082.patch | 47 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 xorg-CVE-2024-31082.patch

diff --git a/tigervnc.spec b/tigervnc.spec
index 38bb2dc..aa402a7 100644
--- a/tigervnc.spec
+++ b/tigervnc.spec
@@ -1,4 +1,4 @@
-%define anolis_release 1
+%define anolis_release 1.1
 #defining macros needed by SELinux
 %global selinuxtype targeted
 %global modulename vncsession
@@ -30,6 +30,9 @@ Patch50:        tigervnc-vncsession-restore-script-systemd-service.patch
 # This is tigervnc-%%{version}/unix/xserver116.patch rebased on the latest xorg
 Patch100:       tigervnc-xserver120.patch
 
+#https://gitlab.freedesktop.org/xorg/xserver/-/commit/6c684d035c06fd41c727f0ef0744517580864cef
+Patch1000:      xorg-CVE-2024-31082.patch
+
 BuildRequires:  make
 BuildRequires:  gcc-c++
 BuildRequires:  automake, autoconf, libtool, gettext, gettext-autopoint
@@ -161,6 +164,7 @@ for all in `find . -type f -perm -001`; do
 done
 %patch100 -p1 -b .xserver120-rebased
 popd
+%patch1000 -p1
 
 # Downstream patches
 
@@ -331,6 +335,9 @@ fi
 %ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
 
 %changelog
+* Tue Oct 22 2024 yangxinyu <yangxinyu@nfschina.com> - 1.13.1-1.1
+- fix cve-2024-31082
+
 * Wed Mar 08 2023 Ziyang Zhang <ZiyangZhang@linux.alibaba.com> - 1.13.1-1
 - Update to 1.13.1(Add libappstream-glib and libXrender-devel build requirement)
 
diff --git a/xorg-CVE-2024-31082.patch b/xorg-CVE-2024-31082.patch
new file mode 100644
index 0000000..df0a498
--- /dev/null
+++ b/xorg-CVE-2024-31082.patch
@@ -0,0 +1,47 @@
+From 6c684d035c06fd41c727f0ef0744517580864cef Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 22 Mar 2024 19:07:34 -0700
+Subject: [PATCH 3/4] Xquartz: ProcAppleDRICreatePixmap needs to use unswapped
+ length to send reply
+
+CVE-2024-31082
+
+Fixes: 14205ade0 ("XQuartz: appledri: Fix byte swapping in replies")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+---
+ hw/xquartz/xpr/appledri.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
+index 77574655b..40422b61a 100644
+--- a/hw/xquartz/xpr/appledri.c
++++ b/hw/xquartz/xpr/appledri.c
+@@ -272,6 +272,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
+     xAppleDRICreatePixmapReply rep;
+     int width, height, pitch, bpp;
+     void *ptr;
++    CARD32 stringLength;
+ 
+     REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq);
+ 
+@@ -307,6 +308,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
+     if (sizeof(rep) != sz_xAppleDRICreatePixmapReply)
+         ErrorF("error sizeof(rep) is %zu\n", sizeof(rep));
+ 
++    stringLength = rep.stringLength;  /* save unswapped value */
+     if (client->swapped) {
+         swaps(&rep.sequenceNumber);
+         swapl(&rep.length);
+@@ -319,7 +321,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
+     }
+ 
+     WriteToClient(client, sizeof(rep), &rep);
+-    WriteToClient(client, rep.stringLength, path);
++    WriteToClient(client, stringLength, path);
+ 
+     return Success;
+ }
+-- 
+2.44.0
+
-- 
Gitee