--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/open-src/lib/libxcb/CVE-2013-2064.patch	Wed May 15 13:44:02 2013 -0700
@@ -0,0 +1,48 @@
+From e480abd0af181242022a85bff2d4d5e73385255e Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <[email protected]>
+Date: Wed, 1 May 2013 17:59:31 -0700
+Subject: [PATCH:libxcb] integer overflow in read_packet() [CVE-2013-2064]
+
+Ensure that when calculating the size of the incoming response from the
+Xserver, we don't overflow the integer used in the calculations when we
+multiply the int32_t length by 4 and add it to the default response size.
+
+Signed-off-by: Alan Coopersmith <[email protected]>
+---
+ src/xcb_in.c |   13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/src/xcb_in.c b/src/xcb_in.c
+index b810783..8a7af92 100644
+--- a/src/xcb_in.c
++++ b/src/xcb_in.c
+@@ -93,8 +93,9 @@ static void remove_finished_readers(reader_list **prev_reader, uint64_t complete
+ static int read_packet(xcb_connection_t *c)
+ {
+     xcb_generic_reply_t genrep;
+-    int length = 32;
+-    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
++    uint64_t length = 32;
++    uint64_t eventlength = 0; /* length after first 32 bytes for GenericEvents */
++    uint64_t bufsize;
+     void *buf;
+     pending_reply *pend = 0;
+     struct event_list *event;
+@@ -169,8 +170,12 @@ static int read_packet(xcb_connection_t *c)
+     if ((genrep.response_type & 0x7f) == XCB_XGE_EVENT)
+         eventlength = genrep.length * 4;
+ 
+-    buf = malloc(length + eventlength +
+-            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
++    bufsize = length + eventlength +
++        (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t));
++    if (bufsize < INT32_MAX)
++        buf = malloc((size_t) bufsize);
++    else
++        buf = NULL;
+     if(!buf)
+     {
+         _xcb_conn_shutdown(c, XCB_CONN_CLOSED_MEM_INSUFFICIENT);
+-- 
+1.7.9.2
+