libXcursor: Changes to 'master'

[Alan Coopersmith]

 src/file.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 8f677eaea05290531d007d1fec2768119926088d
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Fri Apr 12 21:17:28 2013 -0700

    signedness bug & integer overflow in _XcursorFileHeaderCreate() [CVE-2013-2003]
    
    When parsing cursor files, a user defined (e.g. through environment
    variables) cursor file is opened and parsed.
    
    The header is read in _XcursorReadFileHeader(), which reads an unsigned
    int for the number of toc structures in the header, but it was being
    passed to _XcursorFileHeaderCreate() as a signed int to allocate those
    structures.  If the number was negative, it would pass the bounds check
    and could overflow the calculation for how much memory to allocate to
    store the data being read, leading to overflowing the buffer with the
    data read from the user controlled file.
    
    Reported-by: Ilja Van Sprundel <ivansprundel at ioactive.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>