untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24L8PyzHyOPGzodcQ7LWEvAVuD7Yfix8B1G1BGfnyf1R/rwmyxAqAF3AZBIIwmI/Ig+rKqJJyis2EHW/Pm3F0dAY=
OpenBSD 6.6 errata 039, August 07, 2020:
The recent security errata 037 broke X11 input methods.
Apply by doing:
signify -Vep /etc/signify/openbsd-66-base.pub -x 039_ximcp.patch.sig \
-m - | (cd /usr/xenocara && patch -p0)
And then compile and rebuild the X11 library
cd /usr/xenocara/lib/libX11
make -f Makefile.bsd-wrapper obj
make -f Makefile.bsd-wrapper build
Index: lib/libX11/modules/im/ximcp/imRmAttr.c
===================================================================
RCS file: /cvs/xenocara/lib/libX11/modules/im/ximcp/imRmAttr.c,v
retrieving revision 1.9.18.1
diff -u -p -r1.9.18.1 imRmAttr.c
--- lib/libX11/modules/im/ximcp/imRmAttr.c 31 Jul 2020 18:43:52 -0000 1.9.18.1
+++ lib/libX11/modules/im/ximcp/imRmAttr.c 4 Aug 2020 19:40:17 -0000
@@ -265,7 +265,7 @@ _XimAttributeToValue(
if (num > (USHRT_MAX / sizeof(XIMStyle)))
return False;
- if ((sizeof(num) + (num * sizeof(XIMStyle))) > data_len)
+ if ((2 * sizeof(CARD16) + (num * sizeof(CARD32))) > data_len)
return False;
alloc_len = sizeof(XIMStyles) + sizeof(XIMStyle) * num;
if (alloc_len < sizeof(XIMStyles))
@@ -379,7 +379,7 @@ _XimAttributeToValue(
if (num > (UINT_MAX / sizeof(XIMHotKeyTrigger)))
return False;
- if ((sizeof(num) + (num * sizeof(XIMHotKeyTrigger))) > data_len)
+ if ((2 * sizeof(CARD16) + (num * 3 * sizeof(CARD32))) > data_len)
return False;
alloc_len = sizeof(XIMHotKeyTriggers)
+ sizeof(XIMHotKeyTrigger) * num;
