From 198be2506ae31179bbc40047e70b591c814973cf Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 30 Mar 2026 10:37:16 -0400 Subject: [PATCH] import CS libX11-1.8.12-1.el9 --- .gitignore | 2 +- .libX11.metadata | 2 +- ...ut-of-bounds-memory-access-in-_XkbRe.patch | 58 ----- ...tack-exhaustion-from-infinite-recurs.patch | 37 --- ...nteger-overflow-in-XCreateImage-lead.patch | 59 ----- ...unds-checks-for-extension-request-ev.patch | 108 --------- ...1-Lower-autoconf-requirement-to-2.69.patch | 11 + ...-that-a-pointer-isn-t-NULL-before-us.patch | 40 ---- ...le-the-new-_EVDEVK-xorgproto-symbols.patch | 43 ---- ...fabricate-key-events-with-XKeyEvent-.patch | 200 ---------------- ...mages-to-maximum-height-width-allowe.patch | 41 ---- ...p-Commit-first-info-in-XimCommitInfo.patch | 158 ------------- ...igger-BadValue-error-for-out-of-rang.patch | 47 ---- ...-and-unmark-fabricated-with-serial-0.patch | 65 ------ ...ated_time-in-XimProtoPrivate-for-tim.patch | 216 ------------------ ...ows-in-XFilterEvent-to-update-XIM-st.patch | 168 -------------- ...ricated-with-serial-0-and-Xic-commit.patch | 82 ------- ...d-LIBX11_ENABLE_FABRICATED_ORDER-env.patch | 58 ----- SOURCES/dont-forward-keycode-0.patch | 16 +- SPECS/libX11.spec | 49 ++-- 20 files changed, 39 insertions(+), 1421 deletions(-) delete mode 100644 SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch delete mode 100644 SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch delete mode 100644 SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch delete mode 100644 SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch create mode 100644 SOURCES/0001-Lower-autoconf-requirement-to-2.69.patch delete mode 100644 SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch delete mode 100644 SOURCES/0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch delete mode 100644 SOURCES/0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch delete mode 100644 SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch delete mode 100644 SOURCES/0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch delete mode 100644 SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch delete mode 100644 SOURCES/0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch delete mode 100644 SOURCES/0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch delete mode 100644 SOURCES/0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch delete mode 100644 SOURCES/0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch delete mode 100644 SOURCES/0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch diff --git a/.gitignore b/.gitignore index 2f0e162..809de1c 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/libX11-1.7.0.tar.bz2 +SOURCES/libX11-1.8.12.tar.xz diff --git a/.libX11.metadata b/.libX11.metadata index de8dcb5..87a5355 100644 --- a/.libX11.metadata +++ b/.libX11.metadata @@ -1 +1 @@ -48fd27a11572a7d3c1014368e1dc9f40a7b23e7d SOURCES/libX11-1.7.0.tar.bz2 +0339b900f66d14ca4faf65d8515faa744f75aa2f SOURCES/libX11-1.8.12.tar.xz diff --git a/SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch b/SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch deleted file mode 100644 index 6427fc2..0000000 --- a/SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 6858d468d9ca55fb4c5fd70b223dbc78a3358a7f Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Sun, 17 Sep 2023 14:19:40 -0700 -Subject: [PATCH] CVE-2023-43785: out-of-bounds memory access in - _XkbReadKeySyms() - -Make sure we allocate enough memory in the first place, and -also handle error returns from _XkbReadBufferCopyKeySyms() when -it detects out-of-bounds issues. - -Reported-by: Gregory James DUCK -Signed-off-by: Alan Coopersmith ---- - src/xkb/XKBGetMap.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - -diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c -index 2891d21e..31199e4a 100644 ---- a/src/xkb/XKBGetMap.c -+++ b/src/xkb/XKBGetMap.c -@@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) - if (offset + newMap->nSyms >= map->size_syms) { - register int sz; - -- sz = map->size_syms + 128; -+ sz = offset + newMap->nSyms; -+ sz = ((sz + (unsigned) 128) / 128) * 128; - _XkbResizeArray(map->syms, map->size_syms, sz, KeySym); - if (map->syms == NULL) { - map->size_syms = 0; -@@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) - map->size_syms = sz; - } - if (newMap->nSyms > 0) { -- _XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset], -- newMap->nSyms); -+ if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset], -+ newMap->nSyms) == 0) -+ return BadLength; - offset += newMap->nSyms; - } - else { -@@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep) - newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp); - if (newSyms == NULL) - return BadAlloc; -- if (newMap->nSyms > 0) -- _XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms); -+ if (newMap->nSyms > 0) { -+ if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0) -+ return BadLength; -+ } - else - newSyms[0] = NoSymbol; - oldMap->kt_index[0] = newMap->ktIndex[0]; --- -2.41.0 - diff --git a/SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch b/SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch deleted file mode 100644 index 8f6a446..0000000 --- a/SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 204c3393c4c90a29ed6bef64e43849536e863a86 Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Thu, 7 Sep 2023 15:54:30 -0700 -Subject: [PATCH 1/3] CVE-2023-43786: stack exhaustion from infinite recursion - in PutSubImage() - -When splitting a single line of pixels into chunks to send to the -X server, be sure to take into account the number of bits per pixel, -so we don't just loop forever trying to send more pixels than fit in -the given request size and not breaking them down into a small enough -chunk to fix. - -Fixes: "almost complete rewrite" (Dec. 12, 1987) from X11R2 -Signed-off-by: Alan Coopersmith ---- - src/PutImage.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/src/PutImage.c b/src/PutImage.c -index 857ee916..a6db7b42 100644 ---- a/src/PutImage.c -+++ b/src/PutImage.c -@@ -914,8 +914,9 @@ PutSubImage ( - req_width, req_height - SubImageHeight, - dest_bits_per_pixel, dest_scanline_pad); - } else { -- int SubImageWidth = (((Available << 3) / dest_scanline_pad) -- * dest_scanline_pad) - left_pad; -+ int SubImageWidth = ((((Available << 3) / dest_scanline_pad) -+ * dest_scanline_pad) - left_pad) -+ / dest_bits_per_pixel; - - PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y, - (unsigned int) SubImageWidth, 1, --- -2.41.0 - diff --git a/SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch b/SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch deleted file mode 100644 index 3468d6e..0000000 --- a/SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 7916869d16bdd115ac5be30a67c3749907aea6a0 Mon Sep 17 00:00:00 2001 -From: Yair Mizrahi -Date: Thu, 7 Sep 2023 16:15:32 -0700 -Subject: [PATCH] CVE-2023-43787: Integer overflow in XCreateImage() leading to - a heap overflow - -When the format is `Pixmap` it calculates the size of the image data as: - ROUNDUP((bits_per_pixel * width), image->bitmap_pad); -There is no validation on the `width` of the image, and so this -calculation exceeds the capacity of a 4-byte integer, causing an overflow. - -Signed-off-by: Alan Coopersmith ---- - src/ImUtil.c | 20 +++++++++++++++----- - 1 file changed, 15 insertions(+), 5 deletions(-) - -diff --git a/src/ImUtil.c b/src/ImUtil.c -index 36f08a03..fbfad33e 100644 ---- a/src/ImUtil.c -+++ b/src/ImUtil.c -@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group. - #include - #include - #include -+#include - #include "ImUtil.h" - - static int _XDestroyImage(XImage *); -@@ -361,13 +362,22 @@ XImage *XCreateImage ( - /* - * compute per line accelerator. - */ -- { -- if (format == ZPixmap) -+ if (format == ZPixmap) { -+ if ((INT_MAX / bits_per_pixel) < width) { -+ Xfree(image); -+ return NULL; -+ } -+ - min_bytes_per_line = -- ROUNDUP((bits_per_pixel * width), image->bitmap_pad); -- else -+ ROUNDUP((bits_per_pixel * width), image->bitmap_pad); -+ } else { -+ if ((INT_MAX - offset) < width) { -+ Xfree(image); -+ return NULL; -+ } -+ - min_bytes_per_line = -- ROUNDUP((width + offset), image->bitmap_pad); -+ ROUNDUP((width + offset), image->bitmap_pad); - } - if (image_bytes_per_line == 0) { - image->bytes_per_line = min_bytes_per_line; --- -2.41.0 - diff --git a/SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch b/SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch deleted file mode 100644 index 014bdc0..0000000 --- a/SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Sat, 10 Jun 2023 16:30:07 -0700 -Subject: [PATCH libX11] InitExt.c: Add bounds checks for extension request, - event, & error codes - -Fixes CVE-2023-3138: X servers could return values from XQueryExtension -that would cause Xlib to write entries out-of-bounds of the arrays to -store them, though this would only overwrite other parts of the Display -struct, not outside the bounds allocated for that structure. - -Reported-by: Gregory James DUCK -Signed-off-by: Alan Coopersmith ---- - src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 42 insertions(+) - -diff --git a/src/InitExt.c b/src/InitExt.c -index 4de46f15..afc00a6b 100644 ---- a/src/InitExt.c -+++ b/src/InitExt.c -@@ -33,6 +33,18 @@ from The Open Group. - #include - #include - -+/* The X11 protocol spec reserves events 64 through 127 for extensions */ -+#ifndef LastExtensionEvent -+#define LastExtensionEvent 127 -+#endif -+ -+/* The X11 protocol spec reserves requests 128 through 255 for extensions */ -+#ifndef LastExtensionRequest -+#define FirstExtensionRequest 128 -+#define LastExtensionRequest 255 -+#endif -+ -+ - /* - * This routine is used to link a extension in so it will be called - * at appropriate times. -@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent( - WireToEventType proc) /* routine to call when converting event */ - { - register WireToEventType oldproc; -+ if (event_number < 0 || -+ event_number > LastExtensionEvent) { -+ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n", -+ event_number); -+ return (WireToEventType)_XUnknownWireEvent; -+ } - if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent; - LockDisplay (dpy); - oldproc = dpy->event_vec[event_number]; -@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie( - ) - { - WireToEventCookieType oldproc; -+ if (extension < FirstExtensionRequest || -+ extension > LastExtensionRequest) { -+ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n", -+ extension); -+ return (WireToEventCookieType)_XUnknownWireEventCookie; -+ } - if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie; - LockDisplay (dpy); - oldproc = dpy->generic_event_vec[extension & 0x7F]; -@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie( - ) - { - CopyEventCookieType oldproc; -+ if (extension < FirstExtensionRequest || -+ extension > LastExtensionRequest) { -+ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n", -+ extension); -+ return (CopyEventCookieType)_XUnknownCopyEventCookie; -+ } - if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie; - LockDisplay (dpy); - oldproc = dpy->generic_event_copy_vec[extension & 0x7F]; -@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire( - EventToWireType proc) /* routine to call when converting event */ - { - register EventToWireType oldproc; -+ if (event_number < 0 || -+ event_number > LastExtensionEvent) { -+ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n", -+ event_number); -+ return (EventToWireType)_XUnknownNativeEvent; -+ } - if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent; - LockDisplay (dpy); - oldproc = dpy->wire_vec[event_number]; -@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError( - WireToErrorType proc) /* routine to call when converting error */ - { - register WireToErrorType oldproc = NULL; -+ if (error_number < 0 || -+ error_number > LastExtensionError) { -+ fprintf(stderr, "Xlib: ignoring invalid extension error %d\n", -+ error_number); -+ return (WireToErrorType)_XDefaultWireError; -+ } - if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError; - LockDisplay (dpy); - if (!dpy->error_vec) { --- -2.41.0 - diff --git a/SOURCES/0001-Lower-autoconf-requirement-to-2.69.patch b/SOURCES/0001-Lower-autoconf-requirement-to-2.69.patch new file mode 100644 index 0000000..b42bebd --- /dev/null +++ b/SOURCES/0001-Lower-autoconf-requirement-to-2.69.patch @@ -0,0 +1,11 @@ +diff -up libX11-1.8.12/configure.ac.autoconf269 libX11-1.8.12/configure.ac +--- libX11-1.8.12/configure.ac.autoconf269 2024-12-13 00:00:00.000000000 +0000 ++++ libX11-1.8.12/configure.ac 2024-12-13 00:00:00.000000000 +0000 +@@ -1,6 +1,6 @@ + + # Initialize Autoconf +-AC_PREREQ([2.70]) ++AC_PREREQ([2.69]) + AC_INIT([libX11], [1.8.12], + [https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues], [libX11]) + AC_CONFIG_SRCDIR([Makefile.am]) diff --git a/SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch b/SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch deleted file mode 100644 index d8c9fd7..0000000 --- a/SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 623b77d4f30b47258a40f89262e5aa5d25e95fa7 Mon Sep 17 00:00:00 2001 -From: Benno Schulenberg -Date: Mon, 14 Feb 2022 11:33:25 +0100 -Subject: [PATCH] imDefLkup: verify that a pointer isn't NULL before using it - -It is possible for _XimICOfXICID() to return NULL, so it is necessary -to check this isn't actually the case before dereferencing the pointer. -All other callers of _XimICOfXICID() do this check too. - -(The check itself is ugly, but it follows the style of the code in the -rest of the module.) - -Fixes issue #45. - -Reported-by: Bhavi Dhingra - -Original-patch-by: Bhavi Dhingra - -Signed-off-by: Benno Schulenberg ---- - modules/im/ximcp/imDefLkup.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c -index dea7f66d..dd1adf53 100644 ---- a/modules/im/ximcp/imDefLkup.c -+++ b/modules/im/ximcp/imDefLkup.c -@@ -88,7 +88,8 @@ _XimSetEventMaskCallback( - - if (imid == im->private.proto.imid) { - if (icid) { -- ic = _XimICOfXICID(im, icid); -+ if (!(ic = _XimICOfXICID(im, icid))) -+ return False; - _XimProcICSetEventMask(ic, (XPointer)&buf_s[2]); - } else { - _XimProcIMSetEventMask(im, (XPointer)&buf_s[2]); --- -2.46.0 - diff --git a/SOURCES/0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch b/SOURCES/0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch deleted file mode 100644 index 55adaae..0000000 --- a/SOURCES/0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch +++ /dev/null @@ -1,43 +0,0 @@ -From e92efc63acd7b377faa9e534f4bf52aaa86be2a9 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Tue, 27 Jul 2021 11:46:19 +1000 -Subject: [PATCH libX11] makekeys: handle the new _EVDEVK xorgproto symbols - -These keys are all defined through a macro in the form: - #define XF86XK_BrightnessAuto _EVDEVK(0x0F4) - -The _EVDEVK macro is simply an offset of 0x10081000. -Let's parse these lines correctly so those keysyms end up in our -hashtables. - -Signed-off-by: Peter Hutterer ---- - src/util/makekeys.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/src/util/makekeys.c b/src/util/makekeys.c -index e847ef4c..4896cc53 100644 ---- a/src/util/makekeys.c -+++ b/src/util/makekeys.c -@@ -78,6 +78,18 @@ parse_line(const char *buf, char *key, KeySym *val, char *prefix) - return 1; - } - -+ /* See if we can parse one of the _EVDEVK symbols */ -+ i = sscanf(buf, "#define %127s _EVDEVK(0x%lx)", key, val); -+ if (i == 2 && (tmp = strstr(key, "XK_"))) { -+ memcpy(prefix, key, (size_t)(tmp - key)); -+ prefix[tmp - key] = '\0'; -+ tmp += 3; -+ memmove(key, tmp, strlen(tmp) + 1); -+ -+ *val += 0x10081000; -+ return 1; -+ } -+ - /* Now try to catch alias (XK_foo XK_bar) definitions, and resolve them - * immediately: if the target is in the form XF86XK_foo, we need to - * canonicalise this to XF86foo before we do the lookup. */ --- -2.31.1 - diff --git a/SOURCES/0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch b/SOURCES/0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch deleted file mode 100644 index 6670e50..0000000 --- a/SOURCES/0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch +++ /dev/null @@ -1,200 +0,0 @@ -From a91e5a5e6fca25f23c7dd24c6694ab1b80b6030e Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 12 Apr 2024 10:21:41 +0900 -Subject: [PATCH libX11 1/7] ximcp: Unmark to fabricate key events with - XKeyEvent serial - -_XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can -receive XKeyEvent from both the typing on the keyboard and the -callback of XIM_FORWARD_EVENT. - -If the filter functions unmark to fabricate XKeyEvent from the typing -on the keyboard during receiving XKeyEvent from the callback of -XIM_FORWARD_EVENT with typing keys very quickly likes an bar code -scanner (or evemu-play), XIM server cannot receive some key events and -it causes the key typing order to get scrambled. - -Now XIM client saves the serial in XKeyEvent and the filter functions -unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT -only. - -This and 024d229f are same patches but the regression issues will be -fixed by the later patches. - -Closes: #198 -Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") -Part-of: -(cherry picked from commit 13e9ac4d458069c81d795f6b4842814d30431b4b) ---- - modules/im/ximcp/imDefFlt.c | 8 ++--- - modules/im/ximcp/imDefIm.c | 1 + - modules/im/ximcp/imDefLkup.c | 58 ++++++++++++++++++++++++++++++++---- - src/xlibi18n/XimintP.h | 17 +++++++++++ - 4 files changed, 75 insertions(+), 9 deletions(-) - -diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c -index f89d2cb0..a7948df8 100644 ---- a/modules/im/ximcp/imDefFlt.c -+++ b/modules/im/ximcp/imDefFlt.c -@@ -142,9 +142,9 @@ _XimProtoKeypressFilter( - { - Xim im = (Xim)ic->core.im; - -- if ((ev->keycode == 0) || IS_FABRICATED(im)) { -+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) { - _XimPendingFilter(ic); -- UNMARK_FABRICATED(im); -+ _XimUnfabricateSerial(im, ev->serial); - return NOTFILTERD; - } - -@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter( - { - Xim im = (Xim)ic->core.im; - -- if (IS_FABRICATED(im)) { -+ if (_XimIsFabricatedSerial(im, ev->serial)) { - _XimPendingFilter(ic); -- UNMARK_FABRICATED(im); -+ _XimUnfabricateSerial(im, ev->serial); - return NOTFILTERD; - } - -diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c -index ccdf14c1..a231a0ac 100644 ---- a/modules/im/ximcp/imDefIm.c -+++ b/modules/im/ximcp/imDefIm.c -@@ -430,6 +430,7 @@ _XimPreConnect( - return False; - - im->private.proto.im_window = im_window; -+ im->private.proto.fabricated_serial = 0; - return True; - } - -diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c -index 18289a80..a6923d5b 100644 ---- a/modules/im/ximcp/imDefLkup.c -+++ b/modules/im/ximcp/imDefLkup.c -@@ -351,6 +351,54 @@ _XimForwardEvent( - return _XimForwardEventCore(ic, ev, sync); - } - -+Bool -+_XimFabricateSerial( -+ Xim im, -+ unsigned long serial) -+{ -+ if (!serial) -+ return False; -+ if (serial == im->private.proto.fabricated_serial) { -+ fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__); -+ return False; -+ } -+ if (im->private.proto.fabricated_serial) -+ fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__); -+ -+ MARK_FABRICATED(im); -+ im->private.proto.fabricated_serial = serial; -+ return True; -+} -+ -+Bool -+_XimUnfabricateSerial( -+ Xim im, -+ unsigned long serial) -+{ -+ if (!serial) -+ return False; -+ if (!im->private.proto.fabricated_serial) { -+ fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__); -+ return False; -+ } -+ if (serial != im->private.proto.fabricated_serial) -+ fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__); -+ -+ im->private.proto.fabricated_serial = 0; -+ UNMARK_FABRICATED(im); -+ return True; -+} -+ -+Bool -+_XimIsFabricatedSerial( -+ Xim im, -+ unsigned long serial) -+{ -+ if (!serial) -+ return False; -+ return (serial == im->private.proto.fabricated_serial); -+} -+ - static void - _XimProcEvent( - Display *d, -@@ -365,7 +413,7 @@ _XimProcEvent( - ev->xany.serial |= serial << 16; - ev->xany.send_event = False; - ev->xany.display = d; -- MARK_FABRICATED(ic->core.im); -+ _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial); - return; - } - -@@ -727,10 +775,6 @@ _XimCommitRecv( - - (void)_XimRespSyncReply(ic, flag); - -- if (ic->private.proto.registed_filter_event -- & (KEYPRESS_MASK | KEYRELEASE_MASK)) -- MARK_FABRICATED(im); -- - bzero(&ev, sizeof(ev)); /* uninitialized : found when running kterm under valgrind */ - - ev.type = KeyPress; -@@ -742,6 +786,10 @@ _XimCommitRecv( - - ev.time = 0L; - ev.serial = LastKnownRequestProcessed(im->core.display); -+ -+ if (ic->private.proto.registed_filter_event -+ & (KEYPRESS_MASK | KEYRELEASE_MASK)) -+ _XimFabricateSerial(im, ev.serial); - /* FIXME : - I wish there were COMMENTs (!) about the data passed around. - */ -diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h -index 14a7e6d5..7f5b107a 100644 ---- a/src/xlibi18n/XimintP.h -+++ b/src/xlibi18n/XimintP.h -@@ -149,6 +149,8 @@ typedef struct _XimProtoPrivateRec { - XimTransRegDispatcher register_dispatcher; - XimTransCallDispatcher call_dispatcher; - XPointer spec; -+ -+ unsigned long fabricated_serial; - } XimProtoPrivateRec; - - /* -@@ -307,4 +309,19 @@ typedef struct _XicProtoPrivateRec { - #define XIM_MAXIMNAMELEN 64 - #define XIM_MAXLCNAMELEN 64 - -+Bool -+_XimFabricateSerial( -+ Xim im, -+ unsigned long serial); -+ -+Bool -+_XimUnfabricateSerial( -+ Xim im, -+ unsigned long serial); -+ -+Bool -+_XimIsFabricatedSerial( -+ Xim im, -+ unsigned long serial); -+ - #endif /* _XIMINTP_H */ --- -2.47.1 - diff --git a/SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch b/SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch deleted file mode 100644 index 27b5912..0000000 --- a/SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 73a37d5f2fcadd6540159b432a70d80f442ddf4a Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Thu, 7 Sep 2023 15:55:04 -0700 -Subject: [PATCH 2/3] XPutImage: clip images to maximum height & width allowed - by protocol - -The PutImage request specifies height & width of the image as CARD16 -(unsigned 16-bit integer), same as the maximum dimensions of an X11 -Drawable, which the image is being copied to. - -Signed-off-by: Alan Coopersmith ---- - src/PutImage.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/PutImage.c b/src/PutImage.c -index a6db7b42..ba411e36 100644 ---- a/src/PutImage.c -+++ b/src/PutImage.c -@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group. - #include "Xlibint.h" - #include "Xutil.h" - #include -+#include - #include "Cr.h" - #include "ImUtil.h" - #include "reallocarray.h" -@@ -962,6 +963,10 @@ XPutImage ( - height = image->height - req_yoffset; - if ((width <= 0) || (height <= 0)) - return 0; -+ if (width > USHRT_MAX) -+ width = USHRT_MAX; -+ if (height > USHRT_MAX) -+ height = USHRT_MAX; - - if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) { - dest_bits_per_pixel = 1; --- -2.41.0 - diff --git a/SOURCES/0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch b/SOURCES/0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch deleted file mode 100644 index 48b6711..0000000 --- a/SOURCES/0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch +++ /dev/null @@ -1,158 +0,0 @@ -From a1037538b74e4016c3a1c2ebef9b1836811ed687 Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 12 Apr 2024 10:21:43 +0900 -Subject: [PATCH libX11 2/7] imDefLkup: Commit first info in XimCommitInfo - -Xic.private.proto.commit_info can receive multiple XimCommitInfo -when typing keys very quickly like an bar code scanner (or evemu-play) -and the first info in XimCommitInfo should be committed to keep -the typing key order. - -This and 041b5291 are same patches but the regression issues will be -fixed by the later patches. - -Closes: #198 -Fixes: 041b5291 ("imDefLkup: Commit first info in XimCommitInfo") -Part-of: -(cherry picked from commit c7790072657f9fdbe8cda031776617088c5f11db) ---- - modules/im/ximcp/imDefLkup.c | 60 +++++++++++++++++++++++++++++------- - 1 file changed, 49 insertions(+), 11 deletions(-) - -diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c -index a6923d5b..31205e6b 100644 ---- a/modules/im/ximcp/imDefLkup.c -+++ b/modules/im/ximcp/imDefLkup.c -@@ -650,18 +650,29 @@ _XimRegCommitInfo( - } - - static void --_XimUnregCommitInfo( -- Xic ic) -+_XimUnregRealCommitInfo( -+ Xic ic, -+ Bool reverse) - { - XimCommitInfo info; -+ XimCommitInfo prev_info = NULL; - -- if (!(info = ic->private.proto.commit_info)) -+ info = ic->private.proto.commit_info; -+ while (reverse && info) { -+ if (!info->next) -+ break; -+ prev_info = info; -+ info = info->next; -+ } -+ if (!info) - return; - -- - Xfree(info->string); - Xfree(info->keysym); -- ic->private.proto.commit_info = info->next; -+ if (prev_info) -+ prev_info->next = info->next; -+ else -+ ic->private.proto.commit_info = info->next; - Xfree(info); - - /* -@@ -679,6 +690,20 @@ _XimUnregCommitInfo( - return; - } - -+static void -+_XimUnregCommitInfo( -+ Xic ic) -+{ -+ _XimUnregRealCommitInfo(ic, False); -+} -+ -+static void -+_XimUnregFirstCommitInfo( -+ Xic ic) -+{ -+ _XimUnregRealCommitInfo(ic, True); -+} -+ - void - _XimFreeCommitInfo( - Xic ic) -@@ -688,6 +713,19 @@ _XimFreeCommitInfo( - return; - } - -+static XimCommitInfo -+_XimFirstCommitInfo( -+ Xic ic) -+{ -+ XimCommitInfo info = ic->private.proto.commit_info; -+ while (info) { -+ if (!info->next) -+ break; -+ info = info->next; -+ } -+ return info; -+} -+ - static Bool - _XimProcKeySym( - Xic ic, -@@ -1082,7 +1120,7 @@ _XimProtoMbLookupString( - state = &tmp_state; - - if ((ev->type == KeyPress) && (ev->keycode == 0)) { /* Filter function */ -- if (!(info = ic->private.proto.commit_info)) { -+ if (!(info = _XimFirstCommitInfo(ic))) { - *state = XLookupNone; - return 0; - } -@@ -1098,7 +1136,7 @@ _XimProtoMbLookupString( - else - *state = XLookupKeySym; - } -- _XimUnregCommitInfo(ic); -+ _XimUnregFirstCommitInfo(ic); - - } else if (ev->type == KeyPress) { - ret = _XimLookupMBText(ic, ev, buffer, bytes, keysym, NULL); -@@ -1145,7 +1183,7 @@ _XimProtoWcLookupString( - state = &tmp_state; - - if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */ -- if (!(info = ic->private.proto.commit_info)) { -+ if (!(info = _XimFirstCommitInfo(ic))) { - *state = XLookupNone; - return 0; - } -@@ -1161,7 +1199,7 @@ _XimProtoWcLookupString( - else - *state = XLookupKeySym; - } -- _XimUnregCommitInfo(ic); -+ _XimUnregFirstCommitInfo(ic); - - } else if (ev->type == KeyPress) { - ret = _XimLookupWCText(ic, ev, buffer, bytes, keysym, NULL); -@@ -1208,7 +1246,7 @@ _XimProtoUtf8LookupString( - state = &tmp_state; - - if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */ -- if (!(info = ic->private.proto.commit_info)) { -+ if (!(info = _XimFirstCommitInfo(ic))) { - *state = XLookupNone; - return 0; - } -@@ -1224,7 +1262,7 @@ _XimProtoUtf8LookupString( - else - *state = XLookupKeySym; - } -- _XimUnregCommitInfo(ic); -+ _XimUnregFirstCommitInfo(ic); - - } else if (ev->type == KeyPress) { - ret = _XimLookupUTF8Text(ic, ev, buffer, bytes, keysym, NULL); --- -2.47.1 - diff --git a/SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch b/SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch deleted file mode 100644 index 0900498..0000000 --- a/SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch +++ /dev/null @@ -1,47 +0,0 @@ -From b4031fc023816aca07fbd592ed97010b9b48784b Mon Sep 17 00:00:00 2001 -From: Alan Coopersmith -Date: Thu, 7 Sep 2023 16:12:27 -0700 -Subject: [PATCH 3/3] XCreatePixmap: trigger BadValue error for out-of-range - dimensions - -The CreatePixmap request specifies height & width of the image as CARD16 -(unsigned 16-bit integer), so if either is larger than that, set it to 0 -so the X server returns a BadValue error as the protocol requires. - -Signed-off-by: Alan Coopersmith ---- - src/CrPixmap.c | 11 +++++++++++ - 1 file changed, 11 insertions(+) - -diff --git a/src/CrPixmap.c b/src/CrPixmap.c -index cdf31207..3cb2ca6d 100644 ---- a/src/CrPixmap.c -+++ b/src/CrPixmap.c -@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group. - #include - #endif - #include "Xlibint.h" -+#include - - #ifdef USE_DYNAMIC_XCURSOR - void -@@ -47,6 +48,16 @@ Pixmap XCreatePixmap ( - Pixmap pid; - register xCreatePixmapReq *req; - -+ /* -+ * Force a BadValue X Error if the requested dimensions are larger -+ * than the X11 protocol has room for, since that's how callers expect -+ * to get notified of errors. -+ */ -+ if (width > USHRT_MAX) -+ width = 0; -+ if (height > USHRT_MAX) -+ height = 0; -+ - LockDisplay(dpy); - GetReq(CreatePixmap, req); - req->drawable = d; --- -2.41.0 - diff --git a/SOURCES/0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch b/SOURCES/0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch deleted file mode 100644 index 98d3a04..0000000 --- a/SOURCES/0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch +++ /dev/null @@ -1,65 +0,0 @@ -From ed53956985d37c57fcd3587c642ee7ebf653d1af Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 12 Apr 2024 10:50:33 +0900 -Subject: [PATCH libX11 3/7] imDefLkup: Mark and unmark fabricated with serial - 0 - -GTK2 applications with GTK_IM_MODULE=xim sets the serial number 0 -to the XKeyEvent and the previous _XimFabricateSerial() logic did -not work for the applications. -Now the API marks to fabricate with the serial 0. - -Closes: #205 -Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") -Part-of: -(cherry picked from commit 1181abd6ffede3ac5663a3a3d4ee66aef1fa553b) ---- - modules/im/ximcp/imDefLkup.c | 17 ++++++++++++----- - 1 file changed, 12 insertions(+), 5 deletions(-) - -diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c -index 31205e6b..53cf1f87 100644 ---- a/modules/im/ximcp/imDefLkup.c -+++ b/modules/im/ximcp/imDefLkup.c -@@ -356,8 +356,11 @@ _XimFabricateSerial( - Xim im, - unsigned long serial) - { -- if (!serial) -- return False; -+ /* GTK2 XIM module sets serial=0. */ -+ if (!serial) { -+ MARK_FABRICATED(im); -+ return True; -+ } - if (serial == im->private.proto.fabricated_serial) { - fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__); - return False; -@@ -375,8 +378,11 @@ _XimUnfabricateSerial( - Xim im, - unsigned long serial) - { -- if (!serial) -- return False; -+ /* GTK2 XIM module sets serial=0. */ -+ if (!serial) { -+ UNMARK_FABRICATED(im); -+ return True; -+ } - if (!im->private.proto.fabricated_serial) { - fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__); - return False; -@@ -394,8 +400,9 @@ _XimIsFabricatedSerial( - Xim im, - unsigned long serial) - { -+ /* GTK2 XIM module sets serial=0. */ - if (!serial) -- return False; -+ return IS_FABRICATED(im); - return (serial == im->private.proto.fabricated_serial); - } - --- -2.47.1 - diff --git a/SOURCES/0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch b/SOURCES/0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch deleted file mode 100644 index fd31753..0000000 --- a/SOURCES/0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch +++ /dev/null @@ -1,216 +0,0 @@ -From 24f2fdba4e5162ebcb011ce41104fb195b163169 Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 26 Apr 2024 00:49:14 +0900 -Subject: [PATCH libX11 4/7] ximcp: Add fabricated_time in XimProtoPrivate for - timeout - -When users type keys quickly, some applications using Steam or Java -do not call XNextEvent() for a key event but _XimFilterKeypress() -and _XimFilterKeyrelease() expect to receive the key events -forwarded by input methods. - -Now fabricated_time Time value is added to XimProtoPrivate to check -the timeout value. - -Closes: #205 -Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") -Part-of: -(cherry picked from commit 5a14178c7cc408f425fe298aeade3dee749b1ca1) ---- - modules/im/ximcp/imDefFlt.c | 8 +++--- - modules/im/ximcp/imDefIm.c | 2 ++ - modules/im/ximcp/imDefLkup.c | 48 ++++++++++++++++++++++++++---------- - src/xlibi18n/XimintP.h | 10 +++++--- - 4 files changed, 47 insertions(+), 21 deletions(-) - -diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c -index a7948df8..ad8a272b 100644 ---- a/modules/im/ximcp/imDefFlt.c -+++ b/modules/im/ximcp/imDefFlt.c -@@ -142,9 +142,9 @@ _XimProtoKeypressFilter( - { - Xim im = (Xim)ic->core.im; - -- if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) { -+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) { - _XimPendingFilter(ic); -- _XimUnfabricateSerial(im, ev->serial); -+ _XimUnfabricateSerial(im, ev); - return NOTFILTERD; - } - -@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter( - { - Xim im = (Xim)ic->core.im; - -- if (_XimIsFabricatedSerial(im, ev->serial)) { -+ if (_XimIsFabricatedSerial(im, ev)) { - _XimPendingFilter(ic); -- _XimUnfabricateSerial(im, ev->serial); -+ _XimUnfabricateSerial(im, ev); - return NOTFILTERD; - } - -diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c -index a231a0ac..7eba0b34 100644 ---- a/modules/im/ximcp/imDefIm.c -+++ b/modules/im/ximcp/imDefIm.c -@@ -431,6 +431,8 @@ _XimPreConnect( - - im->private.proto.im_window = im_window; - im->private.proto.fabricated_serial = 0; -+ im->private.proto.fabricated_time = 0; -+ im->private.proto.enable_fabricated_order = True; - return True; - } - -diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c -index 53cf1f87..6b2d27dc 100644 ---- a/modules/im/ximcp/imDefLkup.c -+++ b/modules/im/ximcp/imDefLkup.c -@@ -354,14 +354,14 @@ _XimForwardEvent( - Bool - _XimFabricateSerial( - Xim im, -- unsigned long serial) -+ XKeyEvent *event) - { - /* GTK2 XIM module sets serial=0. */ -- if (!serial) { -+ if (!event->serial || !im->private.proto.enable_fabricated_order) { - MARK_FABRICATED(im); - return True; - } -- if (serial == im->private.proto.fabricated_serial) { -+ if (event->serial == im->private.proto.fabricated_serial) { - fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__); - return False; - } -@@ -369,17 +369,18 @@ _XimFabricateSerial( - fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__); - - MARK_FABRICATED(im); -- im->private.proto.fabricated_serial = serial; -+ im->private.proto.fabricated_serial = event->serial; -+ im->private.proto.fabricated_time = event->time; - return True; - } - - Bool - _XimUnfabricateSerial( - Xim im, -- unsigned long serial) -+ XKeyEvent *event) - { - /* GTK2 XIM module sets serial=0. */ -- if (!serial) { -+ if (!event->serial || !im->private.proto.enable_fabricated_order) { - UNMARK_FABRICATED(im); - return True; - } -@@ -387,10 +388,11 @@ _XimUnfabricateSerial( - fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__); - return False; - } -- if (serial != im->private.proto.fabricated_serial) -+ if (event->serial != im->private.proto.fabricated_serial) - fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__); - - im->private.proto.fabricated_serial = 0; -+ im->private.proto.fabricated_time = 0; - UNMARK_FABRICATED(im); - return True; - } -@@ -398,12 +400,32 @@ _XimUnfabricateSerial( - Bool - _XimIsFabricatedSerial( - Xim im, -- unsigned long serial) -+ XKeyEvent *event) - { - /* GTK2 XIM module sets serial=0. */ -- if (!serial) -- return IS_FABRICATED(im); -- return (serial == im->private.proto.fabricated_serial); -+ if (!event->serial || !im->private.proto.enable_fabricated_order) -+ return IS_FABRICATED(im) ? True : False; -+ if (event->serial == im->private.proto.fabricated_serial) -+ return True; -+ if (!im->private.proto.fabricated_serial) -+ return False; -+ /* Rotate time */ -+ if (event->time < im->private.proto.fabricated_time) { -+ if (event->time >= 1000) -+ im->private.proto.fabricated_time = 0; -+ } else if (event->time - im->private.proto.fabricated_time > 1000) { -+ fprintf(stderr, -+ "%s,%d: The application disposed a key event with %ld serial.\n", -+ __FILE__, __LINE__, -+ im->private.proto.fabricated_serial); -+ im->private.proto.enable_fabricated_order = False; -+ if (IS_FABRICATED(im)) { -+ if (event->serial) -+ im->private.proto.fabricated_serial = event->serial; -+ return True; -+ } -+ } -+ return False; - } - - static void -@@ -420,7 +442,7 @@ _XimProcEvent( - ev->xany.serial |= serial << 16; - ev->xany.send_event = False; - ev->xany.display = d; -- _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial); -+ _XimFabricateSerial((Xim)ic->core.im, &ev->xkey); - return; - } - -@@ -834,7 +856,7 @@ _XimCommitRecv( - - if (ic->private.proto.registed_filter_event - & (KEYPRESS_MASK | KEYRELEASE_MASK)) -- _XimFabricateSerial(im, ev.serial); -+ _XimFabricateSerial(im, &ev); - /* FIXME : - I wish there were COMMENTs (!) about the data passed around. - */ -diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h -index 7f5b107a..715800c7 100644 ---- a/src/xlibi18n/XimintP.h -+++ b/src/xlibi18n/XimintP.h -@@ -150,7 +150,9 @@ typedef struct _XimProtoPrivateRec { - XimTransCallDispatcher call_dispatcher; - XPointer spec; - -- unsigned long fabricated_serial; -+ unsigned long fabricated_serial; -+ Time fabricated_time; -+ Bool enable_fabricated_order; - } XimProtoPrivateRec; - - /* -@@ -312,16 +314,16 @@ typedef struct _XicProtoPrivateRec { - Bool - _XimFabricateSerial( - Xim im, -- unsigned long serial); -+ XKeyEvent *event); - - Bool - _XimUnfabricateSerial( - Xim im, -- unsigned long serial); -+ XKeyEvent *event); - - Bool - _XimIsFabricatedSerial( - Xim im, -- unsigned long serial); -+ XKeyEvent *event); - - #endif /* _XIMINTP_H */ --- -2.47.1 - diff --git a/SOURCES/0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch b/SOURCES/0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch deleted file mode 100644 index 147cf6e..0000000 --- a/SOURCES/0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch +++ /dev/null @@ -1,168 +0,0 @@ -From b3157722535db692d54b8fe7d26d07f94d49daf3 Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 26 Apr 2024 01:29:26 +0900 -Subject: [PATCH libX11 5/7] Accept anon windows in XFilterEvent to update XIM - state - -When input focuses are switched quickly with shortcut keys in a Java -window, the focus is sometimes lost and the Window=0 is assigned in -XFilterEvent() but the XKeyEvent was forwarded by a XIM serer(IBus) -with XIM_FORWARD_EVENT -> XNextEvent() -> XFilterEvent() and the event -needs to be forwarded to the XIM XKeyEvent press and release filters -to update the XIM state with Window=0 likes _XimPendingFilter() and -_XimUnfabricateSerial(). - -Closes: #205, #206 -Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial") -Part-of: -(cherry picked from commit 5a1e62d77b65ba148b1c6d1d22a81dc2b07e7d9e) ---- - modules/im/ximcp/imDefFlt.c | 34 ++++++++++++++++++++++++++++++---- - src/FilterEv.c | 25 +++++++++++++++++++++++++ - 2 files changed, 55 insertions(+), 4 deletions(-) - -diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c -index ad8a272b..76d63e88 100644 ---- a/modules/im/ximcp/imDefFlt.c -+++ b/modules/im/ximcp/imDefFlt.c -@@ -138,7 +138,8 @@ _XimPendingFilter( - static Bool - _XimProtoKeypressFilter( - Xic ic, -- XKeyEvent *ev) -+ XKeyEvent *ev, -+ Window w) - { - Xim im = (Xim)ic->core.im; - -@@ -147,6 +148,9 @@ _XimProtoKeypressFilter( - _XimUnfabricateSerial(im, ev); - return NOTFILTERD; - } -+ /* w=0 is used for _XimIsFabricatedSerial() only */ -+ if (!w) -+ return NOTFILTERD; - - if (IS_NEGLECT_EVENT(ic, KeyPressMask)) - return FILTERD; -@@ -193,13 +197,14 @@ _XimFilterKeypress( - XEvent *ev, - XPointer client_data) - { -- return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev ); -+ return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev, w); - } - - static Bool - _XimProtoKeyreleaseFilter( - Xic ic, -- XKeyEvent *ev) -+ XKeyEvent *ev, -+ Window w) - { - Xim im = (Xim)ic->core.im; - -@@ -208,6 +213,9 @@ _XimProtoKeyreleaseFilter( - _XimUnfabricateSerial(im, ev); - return NOTFILTERD; - } -+ /* w=0 is used for _XimIsFabricatedSerial() only */ -+ if (!w) -+ return NOTFILTERD; - - if (IS_NEGLECT_EVENT(ic, KeyReleaseMask)) - return FILTERD; -@@ -254,7 +262,7 @@ _XimFilterKeyrelease( - XEvent *ev, - XPointer client_data) - { -- return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev); -+ return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev, w); - } - - static void -@@ -263,6 +271,11 @@ _XimRegisterKeyPressFilter( - { - if (ic->core.focus_window) { - if (!(ic->private.proto.registed_filter_event & KEYPRESS_MASK)) { -+ _XRegisterFilterByType (ic->core.im->core.display, -+ 0, -+ KeyPress, KeyPress, -+ _XimFilterKeypress, -+ (XPointer)ic); - _XRegisterFilterByType (ic->core.im->core.display, - ic->core.focus_window, - KeyPress, KeyPress, -@@ -280,6 +293,11 @@ _XimRegisterKeyReleaseFilter( - { - if (ic->core.focus_window) { - if (!(ic->private.proto.registed_filter_event & KEYRELEASE_MASK)) { -+ _XRegisterFilterByType (ic->core.im->core.display, -+ 0, -+ KeyRelease, KeyRelease, -+ _XimFilterKeyrelease, -+ (XPointer)ic); - _XRegisterFilterByType (ic->core.im->core.display, - ic->core.focus_window, - KeyRelease, KeyRelease, -@@ -301,6 +319,10 @@ _XimUnregisterKeyPressFilter( - ic->core.focus_window, - _XimFilterKeypress, - (XPointer)ic); -+ _XUnregisterFilter (ic->core.im->core.display, -+ 0, -+ _XimFilterKeypress, -+ (XPointer)ic); - ic->private.proto.registed_filter_event &= ~KEYPRESS_MASK; - } - } -@@ -317,6 +339,10 @@ _XimUnregisterKeyReleaseFilter( - ic->core.focus_window, - _XimFilterKeyrelease, - (XPointer)ic); -+ _XUnregisterFilter (ic->core.im->core.display, -+ 0, -+ _XimFilterKeyrelease, -+ (XPointer)ic); - ic->private.proto.registed_filter_event &= ~KEYRELEASE_MASK; - } - } -diff --git a/src/FilterEv.c b/src/FilterEv.c -index 0a48e548..07845bcc 100644 ---- a/src/FilterEv.c -+++ b/src/FilterEv.c -@@ -100,6 +100,31 @@ XFilterEvent( - } - } - } -+ for (p = ev->xany.display->im_filters; p != NULL; p = p->next) { -+ /* Java sometimes calls XFilterEvent() with window=0 and ev come from -+ * XNextEvent() when users type some keys quickly and switch multiple -+ * input focuses in a Java window with the keys. -+ * But XKeyEvent filters need to receive the event with window=0 for -+ * _XimPendingFilter() and _XimUnfabricateSerial() to clear the -+ * fowarded XKeyEvent with XIM_FORWARD_EVENT. -+ * -+ * The case of p->window == 0 is checkekd after all cases of p->window -+ * != 0 are checked because all input contexts share -+ * Display->im_filters but each input context has -+ * Xic->private.proto.registed_filter_event for the filters -+ * and same p->filter could be registerd to Display->im_filters twice -+ * with different p->window. -+ */ -+ if (p->window == 0 && window == 0) { -+ if ((mask & p->event_mask) || -+ (ev->type >= p->start_type && ev->type <= p->end_type)) { -+ UnlockDisplay(ev->xany.display); -+ ret = (*(p->filter))(ev->xany.display, p->window, ev, -+ p->client_data); -+ return(ret); -+ } -+ } -+ } - UnlockDisplay(ev->xany.display); - #endif - return(False); --- -2.47.1 - diff --git a/SOURCES/0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch b/SOURCES/0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch deleted file mode 100644 index 23c29db..0000000 --- a/SOURCES/0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 546a51348322d83a57fd9b8c1e42b44fbe970368 Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 26 Apr 2024 01:29:34 +0900 -Subject: [PATCH libX11 6/7] ximcp: Unmark fabricated with serial 0 and Xic - commit_info - -GTK2 XIM resets the XKeyEvent serial to 0 even if _XimCommitRecv() -sets the serial so now checks if the events are sent with -Xic->private.proto.commit_info. - -Closes: !246 -Part-of: -(cherry picked from commit 898746f9b1fb384d6d24ed827c836ec8a0b3da3b) ---- - modules/im/ximcp/imDefFlt.c | 4 ++-- - modules/im/ximcp/imDefLkup.c | 12 +++++++++++- - src/xlibi18n/XimintP.h | 1 + - 3 files changed, 14 insertions(+), 3 deletions(-) - -diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c -index 76d63e88..3dfbf8cd 100644 ---- a/modules/im/ximcp/imDefFlt.c -+++ b/modules/im/ximcp/imDefFlt.c -@@ -145,7 +145,7 @@ _XimProtoKeypressFilter( - - if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) { - _XimPendingFilter(ic); -- _XimUnfabricateSerial(im, ev); -+ _XimUnfabricateSerial(im, ic, ev); - return NOTFILTERD; - } - /* w=0 is used for _XimIsFabricatedSerial() only */ -@@ -210,7 +210,7 @@ _XimProtoKeyreleaseFilter( - - if (_XimIsFabricatedSerial(im, ev)) { - _XimPendingFilter(ic); -- _XimUnfabricateSerial(im, ev); -+ _XimUnfabricateSerial(im, ic, ev); - return NOTFILTERD; - } - /* w=0 is used for _XimIsFabricatedSerial() only */ -diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c -index 6b2d27dc..326339fe 100644 ---- a/modules/im/ximcp/imDefLkup.c -+++ b/modules/im/ximcp/imDefLkup.c -@@ -377,10 +377,20 @@ _XimFabricateSerial( - Bool - _XimUnfabricateSerial( - Xim im, -+ Xic ic, - XKeyEvent *event) - { -+ if (!im->private.proto.enable_fabricated_order) { -+ UNMARK_FABRICATED(im); -+ return True; -+ } - /* GTK2 XIM module sets serial=0. */ -- if (!event->serial || !im->private.proto.enable_fabricated_order) { -+ if (!event->serial) { -+ /* _XimCommitRecv() sets event->serial and call _XimFabricateSerial() -+ * but GTK2 XIM always reset event->serial=0 with XFilterEvent(). -+ */ -+ if (ic && ic->private.proto.commit_info) -+ im->private.proto.fabricated_serial = 0; - UNMARK_FABRICATED(im); - return True; - } -diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h -index 715800c7..fe52231e 100644 ---- a/src/xlibi18n/XimintP.h -+++ b/src/xlibi18n/XimintP.h -@@ -319,6 +319,7 @@ _XimFabricateSerial( - Bool - _XimUnfabricateSerial( - Xim im, -+ Xic ic, - XKeyEvent *event); - - Bool --- -2.47.1 - diff --git a/SOURCES/0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch b/SOURCES/0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch deleted file mode 100644 index 6a80930..0000000 --- a/SOURCES/0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 9abd669f8826909a715e9b19531fd687800ce44c Mon Sep 17 00:00:00 2001 -From: Takao Fujiwara -Date: Fri, 26 Apr 2024 01:29:39 +0900 -Subject: [PATCH libX11 7/7] imDefIm: Add LIBX11_ENABLE_FABRICATED_ORDER env - -If an XIM application does not return the XKeyEvent from XNextEvent() -to XFilterEvent(), a timeout is reached and the behavior is fallen -back to the previous one with a warning messsage and we can ask -the application to send the XKeyEvent to XFilterEvent() but also -libX11 provides LIBX11_ENABLE_FABRICATED_ORDER environment variable. -If the application runs with LIBX11_ENABLE_FABRICATED_ORDER=0, the -previous behavior is available until the application is fixed. - -Closes: !246 -Part-of: -(cherry picked from commit 90b8fc65da1e773b0091a50be46b23609591e8b7) ---- - modules/im/ximcp/imDefIm.c | 10 ++++++++++ - 1 file changed, 10 insertions(+) - -diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c -index 7eba0b34..f42aa92c 100644 ---- a/modules/im/ximcp/imDefIm.c -+++ b/modules/im/ximcp/imDefIm.c -@@ -63,6 +63,8 @@ PERFORMANCE OF THIS SOFTWARE. - #include "Ximint.h" - - #include -+#include -+#include - - int - _XimCheckDataSize( -@@ -400,6 +402,7 @@ _XimPreConnect( - Atom *atoms; - Window im_window = 0; - register int i; -+ const char *env_enable_fabricated_order; - - if((imserver = XInternAtom(display, XIM_SERVERS, True)) == (Atom)None) - return False; -@@ -433,6 +436,13 @@ _XimPreConnect( - im->private.proto.fabricated_serial = 0; - im->private.proto.fabricated_time = 0; - im->private.proto.enable_fabricated_order = True; -+ env_enable_fabricated_order = getenv("LIBX11_ENABLE_FABRICATED_ORDER"); -+ if (env_enable_fabricated_order && *env_enable_fabricated_order) { -+ if (!strncasecmp(env_enable_fabricated_order, "0", 2) || -+ !strncasecmp(env_enable_fabricated_order, "false", 6)) { -+ im->private.proto.enable_fabricated_order = False; -+ } -+ } - return True; - } - --- -2.47.1 - diff --git a/SOURCES/dont-forward-keycode-0.patch b/SOURCES/dont-forward-keycode-0.patch index c16d874..466c583 100644 --- a/SOURCES/dont-forward-keycode-0.patch +++ b/SOURCES/dont-forward-keycode-0.patch @@ -1,19 +1,19 @@ diff -up libX11-1.6.3/modules/im/ximcp/imDefFlt.c.jx libX11-1.6.3/modules/im/ximcp/imDefFlt.c --- libX11-1.6.3/modules/im/ximcp/imDefFlt.c.jx 2015-03-09 18:28:45.000000000 -0400 +++ libX11-1.6.3/modules/im/ximcp/imDefFlt.c 2015-03-10 12:32:31.912149644 -0400 -@@ -142,7 +142,7 @@ _XimProtoKeypressFilter( +@@ -143,7 +143,7 @@ _XimProtoKeypressFilter( { Xim im = (Xim)ic->core.im; -- if (IS_FABRICATED(im)) { -+ if ((ev->keycode == 0) || IS_FABRICATED(im)) { +- if (_XimIsFabricatedSerial(im, ev)) { ++ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) { _XimPendingFilter(ic); - UNMARK_FABRICATED(im); + _XimUnfabricateSerial(im, ic, ev); return NOTFILTERD; diff -up libX11-1.6.3/modules/im/ximcp/imDefLkup.c.jx libX11-1.6.3/modules/im/ximcp/imDefLkup.c --- libX11-1.6.3/modules/im/ximcp/imDefLkup.c.jx 2015-03-09 18:28:45.000000000 -0400 +++ libX11-1.6.3/modules/im/ximcp/imDefLkup.c 2015-03-10 12:32:31.911149637 -0400 -@@ -332,6 +332,17 @@ _XimForwardEvent( +@@ -333,6 +333,17 @@ _XimForwardEvent( XEvent *ev, Bool sync) { @@ -31,9 +31,9 @@ diff -up libX11-1.6.3/modules/im/ximcp/imDefLkup.c.jx libX11-1.6.3/modules/im/xi #ifdef EXT_FORWARD if (((ev->type == KeyPress) || (ev->type == KeyRelease))) if (_XimExtForwardKeyEvent(ic, (XKeyEvent *)ev, sync)) -@@ -604,6 +615,19 @@ _XimUnregCommitInfo( - Xfree(info->keysym); - ic->private.proto.commit_info = info->next; +@@ -703,6 +714,19 @@ _XimUnregRealCommitInfo( + else + ic->private.proto.commit_info = info->next; Xfree(info); + + /* diff --git a/SPECS/libX11.spec b/SPECS/libX11.spec index 45a65a3..d680c7e 100644 --- a/SPECS/libX11.spec +++ b/SPECS/libX11.spec @@ -4,9 +4,9 @@ Summary: Core X11 protocol client library Name: libX11 -Version: 1.7.0 -Release: 11%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist} -License: MIT +Version: 1.8.12 +Release: 1%{?dist} +License: MIT AND X11 URL: http://www.x.org %if 0%{?gitdate} @@ -14,37 +14,13 @@ Source0: %{tarball}-%{gitdate}.tar.bz2 Source1: make-git-snapshot.sh Source2: commitid %else -Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.bz2 +Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.xz %endif +Patch1: 0001-Lower-autoconf-requirement-to-2.69.patch Patch2: dont-forward-keycode-0.patch -Patch3: 0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch -# CVE-2023-3138 -Patch4: 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch - -# CVE-2023-43785 -Patch5: 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch - -# CVE-2023-43786 -Patch6: 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch -Patch7: 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch -Patch8: 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch - -# CVE-2023-43787 -Patch9: 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch - -# https://issues.redhat.com/browse/RHEL-58298 -Patch10: 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch - -# https://issues.redhat.com/browse/RHEL-69791 -Patch11: 0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch -Patch12: 0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch -Patch13: 0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch -Patch14: 0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch -Patch15: 0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch -Patch16: 0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch -Patch17: 0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch +BuildRequires: libtool BuildRequires: make BuildRequires: xorg-x11-util-macros >= 1.11 BuildRequires: pkgconfig(xproto) >= 7.0.15 @@ -119,7 +95,7 @@ make %{?_smp_mflags} check %{_libdir}/libX11-xcb.so.1.0.0 %files common -%doc AUTHORS COPYING README.md NEWS +%doc AUTHORS COPYING README.md %{_datadir}/X11/locale/ %{_datadir}/X11/XErrorDB %dir /var/cache/libX11 @@ -147,6 +123,17 @@ make %{?_smp_mflags} check %{_mandir}/man5/*.5* %changelog +* Wed Nov 05 2025 RHEL Packaging Agent - 1.8.12-1 +- Rebase to version 1.8.12 +- Update license to MIT AND X11 (SPDX migration) +- Change source format from .tar.bz2 to .tar.xz +- Add libtool as BuildRequires +- Remove CVE patches (now included upstream) +- Add patch to lower autoconf requirement to 2.69 +- Update dont-forward-keycode-0.patch for new codebase +- Remove NEWS from %doc (file not present in 1.8.12) +- Resolves: RHEL-111537 + * Fri Dec 13 2024 Olivier Fourdan - 1.7.0-11 - Backport fixes for XIM input sometimes jumbled (RHEL-69791)