Apply Matthieu Herrb's fixes for CVE-2007-1351 and CVE-2007-1352, with some reduced duplication...
Do proper input validation to fix for CVE-2011-2895.

It ensures that all valid input can be decompressed, checks that the
overflow conditions doesn't happen and generally tightens the
validation of the LZW stream and doesn't pessimize the inner loop for
no good reason. It's derived from a change in libarchive from 2004.

Author: Joerg Sonnenberger <joerg@britannica.bec.de>
Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
Reviewed-by: Tomas Hoger <thoger@redhat.com>
CVE-2014-0209: integer overflow of realloc() size in FontFileAddEntry()

FontFileReadDirectory() opens a fonts.dir file, and reads over every
line in an fscanf loop.  For each successful entry read (font name,
file name) a call is made to FontFileAddFontFile().

FontFileAddFontFile() will add a font file entry (for the font name
and file) each time it’s called, by calling FontFileAddEntry().
FontFileAddEntry() will do the actual adding.  If the table it has
to add to is full, it will do a realloc, adding 100 more entries
to the table size without checking to see if that will overflow the
int used to store the size.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 2f5e57317339c526e6eaee1010b0e2ab8089c42e)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0209: integer overflow of realloc() size in FontFileAddEntry()

FontFileReadDirectory() opens a fonts.dir file, and reads over every
line in an fscanf loop.  For each successful entry read (font name,
file name) a call is made to FontFileAddFontFile().

FontFileAddFontFile() will add a font file entry (for the font name
and file) each time it’s called, by calling FontFileAddEntry().
FontFileAddEntry() will do the actual adding.  If the table it has
to add to is full, it will do a realloc, adding 100 more entries
to the table size without checking to see if that will overflow the
int used to store the size.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 2f5e57317339c526e6eaee1010b0e2ab8089c42e)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated length in _fs_recv_conn_setup()

The connection setup reply from the font server can include a list
of alternate servers to contact if this font server stops working.

The reply specifies a total size of all the font server names, and
then provides a list of names. _fs_recv_conn_setup() allocated the
specified total size for copying the names to, but didn't check to
make sure it wasn't copying more data to that buffer than the size
it had allocated.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 891e084b26837162b12f841060086a105edde86d)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated lengths when reading replies from font server

Functions to handle replies to font server requests were casting replies
from the generic form to reply specific structs without first checking
that the reply was at least as long as the struct being cast to.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit cbb64aef35960b2882be721f4b8fbaa0fb649d12)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0211: Integer overflow in fs_get_reply/_fs_start_read

fs_get_reply() would take any reply size, multiply it by 4 and pass to
_fs_start_read.  If that size was bigger than the current reply buffer
size, _fs_start_read would add it to the existing buffer size plus the
buffer size increment constant and realloc the buffer to that result.

This math could overflow, causing the code to allocate a smaller
buffer than the amount it was about to read into that buffer from
the network.  It could also succeed, allowing the remote font server
to cause massive allocations in the X server, possibly using up all
the address space in a 32-bit X server, allowing the triggering of
other bugs in code that fails to handle malloc failure properly.

This patch protects against both problems, by disconnecting any
font server trying to feed us more than (the somewhat arbitrary)
64 mb in a single reply.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 0f1a5d372c143f91a602bdf10c917d7eabaee09b)
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated length fields in fs_read_query_info()

fs_read_query_info() parses a reply from the font server.  The reply
contains embedded length fields, none of which are validated.  This
can cause out of bound reads in either fs_read_query_info() or in
_fs_convert_props() which it calls to parse the fsPropInfo in the reply.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 491291cabf78efdeec8f18b09e14726a9030cc8f)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0211: integer overflow in fs_read_extent_info()

fs_read_extent_info() parses a reply from the font server.
The reply contains a 32bit number of elements field which is used
to calculate a buffer length. There is an integer overflow in this
calculation which can lead to memory corruption.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit c578408c1fd4db09e4e3173f8a9e65c81cc187c1)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated length fields in fs_read_extent_info()

Looping over the extents in the reply could go past the end of the
reply buffer if the reply indicated more extents than could fit in
the specified reply length.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit a3f21421537620fc4e1f844a594a4bcd9f7e2bd8)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated length fields in fs_read_glyphs()

fs_read_glyphs() parses a reply from the font server.  The reply
contains embedded length fields, none of which are validated.
This can cause out of bound reads when looping over the glyph
bitmaps in the reply.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 520683652564c2a4e42328ae23eef9bb63271565)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated length fields in fs_read_list()

fs_read_list() parses a reply from the font server.  The reply
contains a list of strings with embedded length fields, none of
which are validated. This can cause out of bound reads when looping
over the strings in the reply.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 5fa73ac18474be3032ee7af9c6e29deab163ea39)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>
CVE-2014-0210: unvalidated length fields in fs_read_list_info()

fs_read_list_info() parses a reply from the font server.  The reply
contains a number of additional data items with embedded length or
count fields, none of which are validated. This can cause out of
bound reads when looping over these items in the reply.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit d338f81df1e188eb16e1d6aeea7f4800f89c1218)

Author: Alan Coopersmith <alan.coopersmith@oracle.com>