[notify] xorg-server: Fix for CVE-2020-14347.

X.Org security advisory: July 31, 2020

X Server Pixel Data Uninitialized Memory Information Disclosure
===============================================================

CVE-2020-14347

Allocation for pixmap data in AllocatePixmap() does not initialize the
memory in xserver, it leads to leak uninitialize heap memory to
clients. When the X server runs with elevated privileges.

This flaw can lead to ASLR bypass, which when combined with other
flaws (known/unknown) could lead to lead to privilege elevation in the
client.

xorg-server/.signature

@@ -1,5 +1,6 @@
 untrusted comment: verify with /etc/ports/xorg.pub
-RWTSGWF5Q7TndDg1Anu2ouJAb7KUFEPSKqh472+MCvxVBHiDcuPT93VorAqVbFCmcpsSEI4l73lkhcm04cQvMdHdNpknkA/mJwA=
-SHA256 (Pkgfile) = d051963ce7c6250aabc5c609700c293f4c4a93df5ce436958f6c729734b14a97
+RWTSGWF5Q7TndO6ucO1zqkMnuHKTjsfLzAeeCsVuNPNeyBRjpEFi1wF2R38IGZBO5CQtDCF+UmiGXmKiKjs1LE3agFVeTjhh9A4=
+SHA256 (Pkgfile) = 3b300ca40982d994f747b1832e1bb939677aff193dd9a969ded6ce4b3ec453b6
 SHA256 (.footprint) = d159a275a4868001332954580ab4f70976c97a80334b157023935b36722e50cd
 SHA256 (xorg-server-1.20.8.tar.bz2) = d17b646bee4ba0fb7850c1cc55b18e3e8513ed5c02bdf38da7e107f84e2d0146
+SHA256 (CVE-2020-14347.patch) = 8ec70385e7e8195c27db0a86c851b7505249ec4ef167e1b0d171b187bc837604

xorg-server/CVE-2020-14347.patch

@@ -0,0 +1,12 @@
+diff --git a/dix/pixmap.c b/dix/pixmap.c
+index 1186d7dbb..5a0146bbb 100644
+--- a/dix/pixmap.c
++++ b/dix/pixmap.c
+@@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
+     if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
+         return NullPixmap;
+ 
+-    pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize);
++    pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize);
+     if (!pPixmap)
+         return NullPixmap;

xorg-server/Pkgfile

@@ -5,12 +5,15 @@
 
 name=xorg-server
 version=1.20.8
-release=1
-source=(https://www.x.org/releases/individual/xserver/$name-$version.tar.bz2)
+release=2
+source=(https://www.x.org/releases/individual/xserver/$name-$version.tar.bz2 \
+	CVE-2020-14347.patch)
 
 build() {
     cd $name-$version
 
+    patch -p1 -i $SRC/CVE-2020-14347.patch
+
     ./configure --prefix=/usr \
                 --localstatedir=/var \
                 --with-fontrootdir=/usr/share/fonts/X11 \