untrusted comment: verify with openbsd-66-base.pub RWSvK/c+cFe24JPyGDNVUhL6DShQKyl5feedyO70cHSFPJLF7wvBRWxqFGsAfAo8wvM26uZXYnSZ+eH3IM9sPLEMlpnKBVP/QAc= OpenBSD 6.6 errata 040, August 25, 2020: An integer overflow in libX11 could lead to a double free. Additionally fix a regression in ximcp. Apply by doing: signify -Vep /etc/signify/openbsd-66-base.pub -x 040_xinitom.patch.sig \ -m - | (cd /usr/xenocara && patch -p0) And then compile and rebuild libX11 with cd /usr/xenocara/lib/libX11 make -f Makefile.bsd-wrapper obj make -f Makefile.bsd-wrapper build Index: lib/libX11/modules/im/ximcp/imRmAttr.c =================================================================== RCS file: /cvs/xenocara/lib/libX11/modules/im/ximcp/imRmAttr.c,v retrieving revision 1.9.18.2 diff -u -p -u -p -r1.9.18.2 imRmAttr.c --- lib/libX11/modules/im/ximcp/imRmAttr.c 6 Aug 2020 14:54:08 -0000 1.9.18.2 +++ lib/libX11/modules/im/ximcp/imRmAttr.c 20 Aug 2020 17:59:52 -0000 @@ -1407,7 +1407,7 @@ _XimCountNumberOfAttr( *names_len = 0; while (total > min_len) { len = attr[2]; - if (len >= (total - min_len)) { + if (len > (total - min_len)) { return 0; } *names_len += (len + 1); Index: lib/libX11/modules/om/generic/omGeneric.c =================================================================== RCS file: /cvs/xenocara/lib/libX11/modules/om/generic/omGeneric.c,v retrieving revision 1.9 diff -u -p -u -p -r1.9 omGeneric.c --- lib/libX11/modules/om/generic/omGeneric.c 23 Aug 2018 19:38:12 -0000 1.9 +++ lib/libX11/modules/om/generic/omGeneric.c 20 Aug 2020 17:59:52 -0000 @@ -1908,7 +1908,8 @@ init_om( char **required_list; XOrientation *orientation; char **value, buf[BUFSIZ], *bufptr; - int count = 0, num = 0, length = 0; + int count = 0, num = 0; + unsigned int length = 0; _XlcGetResource(lcd, "XLC_FONTSET", "on_demand_loading", &value, &count); if (count > 0 && _XlcCompareISOLatin1(*value, "True") == 0)