Xpra memory disclosure

[Antoine Martin <antoine@xxxxxxxxxxxxx>]

Xpra is screen for X11. This is the fork located at:
http://xpra.org/

Xpra versions 0.0.7.28 (r191) through to 0.0.7.34 (r443) return random
chunks of memory to the clients by using the wrong size (multiplying by
4) for the X11 cursor memory buffer. (from XFixesGetCursorImage)
The byte order of the data returned is only slightly off (argb -> rgba)

Clients can easily trigger this bug by using X11 applications with
custom cursors, potentially many times per second. However the risks
should be fairly limited since Xpra and its Xvfb process typically run
with the same uid as the client application they host.

Thanks to 'fecund' for reporting this.
Only OpenBSD terminated the process, other unices are quite happy to let
you access memory beyond the end of the cursor buffer.

Cheers
Antoine