libICE: Changes to 'master'

[Matthieu Herrb]

 src/authutil.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

New commits:
commit ac4bb20e74e064b219de70e9b54516a921fdb7c3
Author: Tobias Stoeckmann <tobias at stoeckmann.org>
Date:   Tue Nov 22 20:13:29 2016 +0100

    Fix use after free on subsequent calls
    
    The function IceAuthFileName is vulnerable to a use after free. The
    flaw can be triggered by calling the function three times:
    
    - First call succeeds and stores the path in buf, a dynamically
      allocated buffer with size bsize.
    - Second call fails due to out of memory. It frees buf, but keeps
      the old size in bsize.
    - Third call only checks if bsize is large enough. Then it uses
      buf without allocating it again -- the use after free happens.
    
    In order to exploit this, an attacker must change environment variables
    between each call, namely ICEAUTHORITY or HOME. It also takes subsequent
    calls. Due to these limitations, I don't consider this to be of high
    priority.
    
    Reviewed-by: Matthieu Herrb <matthieu at herrb.eu>