rpms/libX11
6
0
Fork 0
Code Issues Pull Requests Releases Activity

Rebase libX11 to 1.8.12 with license and build fixes

Browse Source 
Rebase to version 1.8.12 with the following changes:
- Updated license to MIT AND X11 (SPDX migration)
- Changed source format from .tar.bz2 to .tar.xz
- Added libtool as BuildRequires
- Removed CVE patches (Patch3-17) now included upstream
- Added patch to lower autoconf requirement to 2.69
- Updated dont-forward-keycode-0.patch for new codebase
- Removed NEWS from %doc as file is not present in 1.8.12 tarball

Resolves: RHEL-111537

This commit was created by Jotnar, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Jotnar
This commit is contained in:
RHEL Packaging Agent 2025-11-05 12:27:22 +00:00
parent 1011d87cb7
commit ca86966d1e
20 changed files with 39 additions and 1420 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -1 +1,2 @@
/libX11-*.tar.bz2
/libX11-1.8.12.tar.xz

58
0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
View File

@ -1,58 +0,0 @@
From 6858d468d9ca55fb4c5fd70b223dbc78a3358a7f Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 17 Sep 2023 14:19:40 -0700
Subject: [PATCH] CVE-2023-43785: out-of-bounds memory access in
_XkbReadKeySyms()
Make sure we allocate enough memory in the first place, and
also handle error returns from _XkbReadBufferCopyKeySyms() when
it detects out-of-bounds issues.
Reported-by: Gregory James DUCK <gjduck@gmail.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
src/xkb/XKBGetMap.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
index 2891d21e..31199e4a 100644
--- a/src/xkb/XKBGetMap.c
+++ b/src/xkb/XKBGetMap.c
@@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
if (offset + newMap->nSyms >= map->size_syms) {
register int sz;
- sz = map->size_syms + 128;
+ sz = offset + newMap->nSyms;
+ sz = ((sz + (unsigned) 128) / 128) * 128;
_XkbResizeArray(map->syms, map->size_syms, sz, KeySym);
if (map->syms == NULL) {
map->size_syms = 0;
@@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
map->size_syms = sz;
}
if (newMap->nSyms > 0) {
- _XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
- newMap->nSyms);
+ if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
+ newMap->nSyms) == 0)
+ return BadLength;
offset += newMap->nSyms;
}
else {
@@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp);
if (newSyms == NULL)
return BadAlloc;
- if (newMap->nSyms > 0)
- _XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms);
+ if (newMap->nSyms > 0) {
+ if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0)
+ return BadLength;
+ }
else
newSyms[0] = NoSymbol;
oldMap->kt_index[0] = newMap->ktIndex[0];
--
2.41.0

37
0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
View File

@ -1,37 +0,0 @@
From 204c3393c4c90a29ed6bef64e43849536e863a86 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu, 7 Sep 2023 15:54:30 -0700
Subject: [PATCH 1/3] CVE-2023-43786: stack exhaustion from infinite recursion
in PutSubImage()
When splitting a single line of pixels into chunks to send to the
X server, be sure to take into account the number of bits per pixel,
so we don't just loop forever trying to send more pixels than fit in
the given request size and not breaking them down into a small enough
chunk to fix.
Fixes: "almost complete rewrite" (Dec. 12, 1987) from X11R2
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
src/PutImage.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/PutImage.c b/src/PutImage.c
index 857ee916..a6db7b42 100644
--- a/src/PutImage.c
+++ b/src/PutImage.c
@@ -914,8 +914,9 @@ PutSubImage (
req_width, req_height - SubImageHeight,
dest_bits_per_pixel, dest_scanline_pad);
} else {
- int SubImageWidth = (((Available << 3) / dest_scanline_pad)
- * dest_scanline_pad) - left_pad;
+ int SubImageWidth = ((((Available << 3) / dest_scanline_pad)
+ * dest_scanline_pad) - left_pad)
+ / dest_bits_per_pixel;
PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
(unsigned int) SubImageWidth, 1,
--
2.41.0

59
0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
View File

@ -1,59 +0,0 @@
From 7916869d16bdd115ac5be30a67c3749907aea6a0 Mon Sep 17 00:00:00 2001
From: Yair Mizrahi <yairm@jfrog.com>
Date: Thu, 7 Sep 2023 16:15:32 -0700
Subject: [PATCH] CVE-2023-43787: Integer overflow in XCreateImage() leading to
a heap overflow
When the format is `Pixmap` it calculates the size of the image data as:
ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
There is no validation on the `width` of the image, and so this
calculation exceeds the capacity of a 4-byte integer, causing an overflow.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
src/ImUtil.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/src/ImUtil.c b/src/ImUtil.c
index 36f08a03..fbfad33e 100644
--- a/src/ImUtil.c
+++ b/src/ImUtil.c
@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
#include <X11/Xlibint.h>
#include <X11/Xutil.h>
#include <stdio.h>
+#include <limits.h>
#include "ImUtil.h"
static int _XDestroyImage(XImage *);
@@ -361,13 +362,22 @@ XImage *XCreateImage (
/*
* compute per line accelerator.
*/
- {
- if (format == ZPixmap)
+ if (format == ZPixmap) {
+ if ((INT_MAX / bits_per_pixel) < width) {
+ Xfree(image);
+ return NULL;
+ }
+
min_bytes_per_line =
- ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
- else
+ ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
+ } else {
+ if ((INT_MAX - offset) < width) {
+ Xfree(image);
+ return NULL;
+ }
+
min_bytes_per_line =
- ROUNDUP((width + offset), image->bitmap_pad);
+ ROUNDUP((width + offset), image->bitmap_pad);
}
if (image_bytes_per_line == 0) {
image->bytes_per_line = min_bytes_per_line;
--
2.41.0

108
0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
View File

@ -1,108 +0,0 @@
From 304a654a0d57bf0f00d8998185f0360332cfa36c Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 10 Jun 2023 16:30:07 -0700
Subject: [PATCH libX11] InitExt.c: Add bounds checks for extension request,
event, & error codes
Fixes CVE-2023-3138: X servers could return values from XQueryExtension
that would cause Xlib to write entries out-of-bounds of the arrays to
store them, though this would only overwrite other parts of the Display
struct, not outside the bounds allocated for that structure.
Reported-by: Gregory James DUCK <gjduck@gmail.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
src/InitExt.c | 42 ++++++++++++++++++++++++++++++++++++++++++
1 file changed, 42 insertions(+)
diff --git a/src/InitExt.c b/src/InitExt.c
index 4de46f15..afc00a6b 100644
--- a/src/InitExt.c
+++ b/src/InitExt.c
@@ -33,6 +33,18 @@ from The Open Group.
#include <X11/Xos.h>
#include <stdio.h>
+/* The X11 protocol spec reserves events 64 through 127 for extensions */
+#ifndef LastExtensionEvent
+#define LastExtensionEvent 127
+#endif
+
+/* The X11 protocol spec reserves requests 128 through 255 for extensions */
+#ifndef LastExtensionRequest
+#define FirstExtensionRequest 128
+#define LastExtensionRequest 255
+#endif
+
+
/*
* This routine is used to link a extension in so it will be called
* at appropriate times.
@@ -242,6 +254,12 @@ WireToEventType XESetWireToEvent(
WireToEventType proc) /* routine to call when converting event */
{
register WireToEventType oldproc;
+ if (event_number < 0 ||
+ event_number > LastExtensionEvent) {
+ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
+ event_number);
+ return (WireToEventType)_XUnknownWireEvent;
+ }
if (proc == NULL) proc = (WireToEventType)_XUnknownWireEvent;
LockDisplay (dpy);
oldproc = dpy->event_vec[event_number];
@@ -263,6 +281,12 @@ WireToEventCookieType XESetWireToEventCookie(
)
{
WireToEventCookieType oldproc;
+ if (extension < FirstExtensionRequest ||
+ extension > LastExtensionRequest) {
+ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
+ extension);
+ return (WireToEventCookieType)_XUnknownWireEventCookie;
+ }
if (proc == NULL) proc = (WireToEventCookieType)_XUnknownWireEventCookie;
LockDisplay (dpy);
oldproc = dpy->generic_event_vec[extension & 0x7F];
@@ -284,6 +308,12 @@ CopyEventCookieType XESetCopyEventCookie(
)
{
CopyEventCookieType oldproc;
+ if (extension < FirstExtensionRequest ||
+ extension > LastExtensionRequest) {
+ fprintf(stderr, "Xlib: ignoring invalid extension opcode %d\n",
+ extension);
+ return (CopyEventCookieType)_XUnknownCopyEventCookie;
+ }
if (proc == NULL) proc = (CopyEventCookieType)_XUnknownCopyEventCookie;
LockDisplay (dpy);
oldproc = dpy->generic_event_copy_vec[extension & 0x7F];
@@ -305,6 +335,12 @@ EventToWireType XESetEventToWire(
EventToWireType proc) /* routine to call when converting event */
{
register EventToWireType oldproc;
+ if (event_number < 0 ||
+ event_number > LastExtensionEvent) {
+ fprintf(stderr, "Xlib: ignoring invalid extension event %d\n",
+ event_number);
+ return (EventToWireType)_XUnknownNativeEvent;
+ }
if (proc == NULL) proc = (EventToWireType) _XUnknownNativeEvent;
LockDisplay (dpy);
oldproc = dpy->wire_vec[event_number];
@@ -325,6 +361,12 @@ WireToErrorType XESetWireToError(
WireToErrorType proc) /* routine to call when converting error */
{
register WireToErrorType oldproc = NULL;
+ if (error_number < 0 ||
+ error_number > LastExtensionError) {
+ fprintf(stderr, "Xlib: ignoring invalid extension error %d\n",
+ error_number);
+ return (WireToErrorType)_XDefaultWireError;
+ }
if (proc == NULL) proc = (WireToErrorType)_XDefaultWireError;
LockDisplay (dpy);
if (!dpy->error_vec) {
--
2.41.0

11
0001-Lower-autoconf-requirement-to-2.69.patch Normal file
View File

@ -0,0 +1,11 @@
diff -up libX11-1.8.12/configure.ac.autoconf269 libX11-1.8.12/configure.ac
--- libX11-1.8.12/configure.ac.autoconf269 2024-12-13 00:00:00.000000000 +0000
+++ libX11-1.8.12/configure.ac 2024-12-13 00:00:00.000000000 +0000
@@ -1,6 +1,6 @@
# Initialize Autoconf
-AC_PREREQ([2.70])
+AC_PREREQ([2.69])
AC_INIT([libX11], [1.8.12],
[https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues], [libX11])
AC_CONFIG_SRCDIR([Makefile.am])

40
0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
View File

@ -1,40 +0,0 @@
From 623b77d4f30b47258a40f89262e5aa5d25e95fa7 Mon Sep 17 00:00:00 2001
From: Benno Schulenberg <bensberg@telfort.nl>
Date: Mon, 14 Feb 2022 11:33:25 +0100
Subject: [PATCH] imDefLkup: verify that a pointer isn't NULL before using it
It is possible for _XimICOfXICID() to return NULL, so it is necessary
to check this isn't actually the case before dereferencing the pointer.
All other callers of _XimICOfXICID() do this check too.
(The check itself is ugly, but it follows the style of the code in the
rest of the module.)
Fixes issue #45.
Reported-by: Bhavi Dhingra
Original-patch-by: Bhavi Dhingra
Signed-off-by: Benno Schulenberg <bensberg@telfort.nl>
---
modules/im/ximcp/imDefLkup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index dea7f66d..dd1adf53 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -88,7 +88,8 @@ _XimSetEventMaskCallback(
if (imid == im->private.proto.imid) {
if (icid) {
- ic = _XimICOfXICID(im, icid);
+ if (!(ic = _XimICOfXICID(im, icid)))
+ return False;
_XimProcICSetEventMask(ic, (XPointer)&buf_s[2]);
} else {
_XimProcIMSetEventMask(im, (XPointer)&buf_s[2]);
--
2.46.0

43
0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch
View File

@ -1,43 +0,0 @@
From e92efc63acd7b377faa9e534f4bf52aaa86be2a9 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Tue, 27 Jul 2021 11:46:19 +1000
Subject: [PATCH libX11] makekeys: handle the new _EVDEVK xorgproto symbols
These keys are all defined through a macro in the form:
#define XF86XK_BrightnessAuto _EVDEVK(0x0F4)
The _EVDEVK macro is simply an offset of 0x10081000.
Let's parse these lines correctly so those keysyms end up in our
hashtables.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
src/util/makekeys.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/util/makekeys.c b/src/util/makekeys.c
index e847ef4c..4896cc53 100644
--- a/src/util/makekeys.c
+++ b/src/util/makekeys.c
@@ -78,6 +78,18 @@ parse_line(const char *buf, char *key, KeySym *val, char *prefix)
return 1;
}
+ /* See if we can parse one of the _EVDEVK symbols */
+ i = sscanf(buf, "#define %127s _EVDEVK(0x%lx)", key, val);
+ if (i == 2 && (tmp = strstr(key, "XK_"))) {
+ memcpy(prefix, key, (size_t)(tmp - key));
+ prefix[tmp - key] = '\0';
+ tmp += 3;
+ memmove(key, tmp, strlen(tmp) + 1);
+
+ *val += 0x10081000;
+ return 1;
+ }
+
/* Now try to catch alias (XK_foo XK_bar) definitions, and resolve them
* immediately: if the target is in the form XF86XK_foo, we need to
* canonicalise this to XF86foo before we do the lookup. */
--
2.31.1

200
0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch
View File

@ -1,200 +0,0 @@
From a91e5a5e6fca25f23c7dd24c6694ab1b80b6030e Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 12 Apr 2024 10:21:41 +0900
Subject: [PATCH libX11 1/7] ximcp: Unmark to fabricate key events with
XKeyEvent serial
_XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can
receive XKeyEvent from both the typing on the keyboard and the
callback of XIM_FORWARD_EVENT.
If the filter functions unmark to fabricate XKeyEvent from the typing
on the keyboard during receiving XKeyEvent from the callback of
XIM_FORWARD_EVENT with typing keys very quickly likes an bar code
scanner (or evemu-play), XIM server cannot receive some key events and
it causes the key typing order to get scrambled.
Now XIM client saves the serial in XKeyEvent and the filter functions
unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT
only.
This and 024d229f are same patches but the regression issues will be
fixed by the later patches.
Closes: #198
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 13e9ac4d458069c81d795f6b4842814d30431b4b)
---
modules/im/ximcp/imDefFlt.c | 8 ++---
modules/im/ximcp/imDefIm.c | 1 +
modules/im/ximcp/imDefLkup.c | 58 ++++++++++++++++++++++++++++++++----
src/xlibi18n/XimintP.h | 17 +++++++++++
4 files changed, 75 insertions(+), 9 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index f89d2cb0..a7948df8 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -142,9 +142,9 @@ _XimProtoKeypressFilter(
{
Xim im = (Xim)ic->core.im;
- if ((ev->keycode == 0) || IS_FABRICATED(im)) {
+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) {
_XimPendingFilter(ic);
- UNMARK_FABRICATED(im);
+ _XimUnfabricateSerial(im, ev->serial);
return NOTFILTERD;
}
@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter(
{
Xim im = (Xim)ic->core.im;
- if (IS_FABRICATED(im)) {
+ if (_XimIsFabricatedSerial(im, ev->serial)) {
_XimPendingFilter(ic);
- UNMARK_FABRICATED(im);
+ _XimUnfabricateSerial(im, ev->serial);
return NOTFILTERD;
}
diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
index ccdf14c1..a231a0ac 100644
--- a/modules/im/ximcp/imDefIm.c
+++ b/modules/im/ximcp/imDefIm.c
@@ -430,6 +430,7 @@ _XimPreConnect(
return False;
im->private.proto.im_window = im_window;
+ im->private.proto.fabricated_serial = 0;
return True;
}
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 18289a80..a6923d5b 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -351,6 +351,54 @@ _XimForwardEvent(
return _XimForwardEventCore(ic, ev, sync);
}
+Bool
+_XimFabricateSerial(
+ Xim im,
+ unsigned long serial)
+{
+ if (!serial)
+ return False;
+ if (serial == im->private.proto.fabricated_serial) {
+ fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
+ return False;
+ }
+ if (im->private.proto.fabricated_serial)
+ fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
+
+ MARK_FABRICATED(im);
+ im->private.proto.fabricated_serial = serial;
+ return True;
+}
+
+Bool
+_XimUnfabricateSerial(
+ Xim im,
+ unsigned long serial)
+{
+ if (!serial)
+ return False;
+ if (!im->private.proto.fabricated_serial) {
+ fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
+ return False;
+ }
+ if (serial != im->private.proto.fabricated_serial)
+ fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
+
+ im->private.proto.fabricated_serial = 0;
+ UNMARK_FABRICATED(im);
+ return True;
+}
+
+Bool
+_XimIsFabricatedSerial(
+ Xim im,
+ unsigned long serial)
+{
+ if (!serial)
+ return False;
+ return (serial == im->private.proto.fabricated_serial);
+}
+
static void
_XimProcEvent(
Display *d,
@@ -365,7 +413,7 @@ _XimProcEvent(
ev->xany.serial |= serial << 16;
ev->xany.send_event = False;
ev->xany.display = d;
- MARK_FABRICATED(ic->core.im);
+ _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial);
return;
}
@@ -727,10 +775,6 @@ _XimCommitRecv(
(void)_XimRespSyncReply(ic, flag);
- if (ic->private.proto.registed_filter_event
- & (KEYPRESS_MASK | KEYRELEASE_MASK))
- MARK_FABRICATED(im);
-
bzero(&ev, sizeof(ev)); /* uninitialized : found when running kterm under valgrind */
ev.type = KeyPress;
@@ -742,6 +786,10 @@ _XimCommitRecv(
ev.time = 0L;
ev.serial = LastKnownRequestProcessed(im->core.display);
+
+ if (ic->private.proto.registed_filter_event
+ & (KEYPRESS_MASK | KEYRELEASE_MASK))
+ _XimFabricateSerial(im, ev.serial);
/* FIXME :
I wish there were COMMENTs (!) about the data passed around.
*/
diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
index 14a7e6d5..7f5b107a 100644
--- a/src/xlibi18n/XimintP.h
+++ b/src/xlibi18n/XimintP.h
@@ -149,6 +149,8 @@ typedef struct _XimProtoPrivateRec {
XimTransRegDispatcher register_dispatcher;
XimTransCallDispatcher call_dispatcher;
XPointer spec;
+
+ unsigned long fabricated_serial;
} XimProtoPrivateRec;
/*
@@ -307,4 +309,19 @@ typedef struct _XicProtoPrivateRec {
#define XIM_MAXIMNAMELEN 64
#define XIM_MAXLCNAMELEN 64
+Bool
+_XimFabricateSerial(
+ Xim im,
+ unsigned long serial);
+
+Bool
+_XimUnfabricateSerial(
+ Xim im,
+ unsigned long serial);
+
+Bool
+_XimIsFabricatedSerial(
+ Xim im,
+ unsigned long serial);
+
#endif /* _XIMINTP_H */
--
2.47.1

41
0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
View File

@ -1,41 +0,0 @@
From 73a37d5f2fcadd6540159b432a70d80f442ddf4a Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu, 7 Sep 2023 15:55:04 -0700
Subject: [PATCH 2/3] XPutImage: clip images to maximum height & width allowed
by protocol
The PutImage request specifies height & width of the image as CARD16
(unsigned 16-bit integer), same as the maximum dimensions of an X11
Drawable, which the image is being copied to.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
src/PutImage.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/PutImage.c b/src/PutImage.c
index a6db7b42..ba411e36 100644
--- a/src/PutImage.c
+++ b/src/PutImage.c
@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
#include "Xlibint.h"
#include "Xutil.h"
#include <stdio.h>
+#include <limits.h>
#include "Cr.h"
#include "ImUtil.h"
#include "reallocarray.h"
@@ -962,6 +963,10 @@ XPutImage (
height = image->height - req_yoffset;
if ((width <= 0) || (height <= 0))
return 0;
+ if (width > USHRT_MAX)
+ width = USHRT_MAX;
+ if (height > USHRT_MAX)
+ height = USHRT_MAX;
if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) {
dest_bits_per_pixel = 1;
--
2.41.0

158
0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch
View File

@ -1,158 +0,0 @@
From a1037538b74e4016c3a1c2ebef9b1836811ed687 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 12 Apr 2024 10:21:43 +0900
Subject: [PATCH libX11 2/7] imDefLkup: Commit first info in XimCommitInfo
Xic.private.proto.commit_info can receive multiple XimCommitInfo
when typing keys very quickly like an bar code scanner (or evemu-play)
and the first info in XimCommitInfo should be committed to keep
the typing key order.
This and 041b5291 are same patches but the regression issues will be
fixed by the later patches.
Closes: #198
Fixes: 041b5291 ("imDefLkup: Commit first info in XimCommitInfo")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit c7790072657f9fdbe8cda031776617088c5f11db)
---
modules/im/ximcp/imDefLkup.c | 60 +++++++++++++++++++++++++++++-------
1 file changed, 49 insertions(+), 11 deletions(-)
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index a6923d5b..31205e6b 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -650,18 +650,29 @@ _XimRegCommitInfo(
}
static void
-_XimUnregCommitInfo(
- Xic ic)
+_XimUnregRealCommitInfo(
+ Xic ic,
+ Bool reverse)
{
XimCommitInfo info;
+ XimCommitInfo prev_info = NULL;
- if (!(info = ic->private.proto.commit_info))
+ info = ic->private.proto.commit_info;
+ while (reverse && info) {
+ if (!info->next)
+ break;
+ prev_info = info;
+ info = info->next;
+ }
+ if (!info)
return;
-
Xfree(info->string);
Xfree(info->keysym);
- ic->private.proto.commit_info = info->next;
+ if (prev_info)
+ prev_info->next = info->next;
+ else
+ ic->private.proto.commit_info = info->next;
Xfree(info);
/*
@@ -679,6 +690,20 @@ _XimUnregCommitInfo(
return;
}
+static void
+_XimUnregCommitInfo(
+ Xic ic)
+{
+ _XimUnregRealCommitInfo(ic, False);
+}
+
+static void
+_XimUnregFirstCommitInfo(
+ Xic ic)
+{
+ _XimUnregRealCommitInfo(ic, True);
+}
+
void
_XimFreeCommitInfo(
Xic ic)
@@ -688,6 +713,19 @@ _XimFreeCommitInfo(
return;
}
+static XimCommitInfo
+_XimFirstCommitInfo(
+ Xic ic)
+{
+ XimCommitInfo info = ic->private.proto.commit_info;
+ while (info) {
+ if (!info->next)
+ break;
+ info = info->next;
+ }
+ return info;
+}
+
static Bool
_XimProcKeySym(
Xic ic,
@@ -1082,7 +1120,7 @@ _XimProtoMbLookupString(
state = &tmp_state;
if ((ev->type == KeyPress) && (ev->keycode == 0)) { /* Filter function */
- if (!(info = ic->private.proto.commit_info)) {
+ if (!(info = _XimFirstCommitInfo(ic))) {
*state = XLookupNone;
return 0;
}
@@ -1098,7 +1136,7 @@ _XimProtoMbLookupString(
else
*state = XLookupKeySym;
}
- _XimUnregCommitInfo(ic);
+ _XimUnregFirstCommitInfo(ic);
} else if (ev->type == KeyPress) {
ret = _XimLookupMBText(ic, ev, buffer, bytes, keysym, NULL);
@@ -1145,7 +1183,7 @@ _XimProtoWcLookupString(
state = &tmp_state;
if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
- if (!(info = ic->private.proto.commit_info)) {
+ if (!(info = _XimFirstCommitInfo(ic))) {
*state = XLookupNone;
return 0;
}
@@ -1161,7 +1199,7 @@ _XimProtoWcLookupString(
else
*state = XLookupKeySym;
}
- _XimUnregCommitInfo(ic);
+ _XimUnregFirstCommitInfo(ic);
} else if (ev->type == KeyPress) {
ret = _XimLookupWCText(ic, ev, buffer, bytes, keysym, NULL);
@@ -1208,7 +1246,7 @@ _XimProtoUtf8LookupString(
state = &tmp_state;
if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
- if (!(info = ic->private.proto.commit_info)) {
+ if (!(info = _XimFirstCommitInfo(ic))) {
*state = XLookupNone;
return 0;
}
@@ -1224,7 +1262,7 @@ _XimProtoUtf8LookupString(
else
*state = XLookupKeySym;
}
- _XimUnregCommitInfo(ic);
+ _XimUnregFirstCommitInfo(ic);
} else if (ev->type == KeyPress) {
ret = _XimLookupUTF8Text(ic, ev, buffer, bytes, keysym, NULL);
--
2.47.1

47
0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
View File

@ -1,47 +0,0 @@
From b4031fc023816aca07fbd592ed97010b9b48784b Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu, 7 Sep 2023 16:12:27 -0700
Subject: [PATCH 3/3] XCreatePixmap: trigger BadValue error for out-of-range
dimensions
The CreatePixmap request specifies height & width of the image as CARD16
(unsigned 16-bit integer), so if either is larger than that, set it to 0
so the X server returns a BadValue error as the protocol requires.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
src/CrPixmap.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/src/CrPixmap.c b/src/CrPixmap.c
index cdf31207..3cb2ca6d 100644
--- a/src/CrPixmap.c
+++ b/src/CrPixmap.c
@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
#include <config.h>
#endif
#include "Xlibint.h"
+#include <limits.h>
#ifdef USE_DYNAMIC_XCURSOR
void
@@ -47,6 +48,16 @@ Pixmap XCreatePixmap (
Pixmap pid;
register xCreatePixmapReq *req;
+ /*
+ * Force a BadValue X Error if the requested dimensions are larger
+ * than the X11 protocol has room for, since that's how callers expect
+ * to get notified of errors.
+ */
+ if (width > USHRT_MAX)
+ width = 0;
+ if (height > USHRT_MAX)
+ height = 0;
+
LockDisplay(dpy);
GetReq(CreatePixmap, req);
req->drawable = d;
--
2.41.0

65
0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch
View File

@ -1,65 +0,0 @@
From ed53956985d37c57fcd3587c642ee7ebf653d1af Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 12 Apr 2024 10:50:33 +0900
Subject: [PATCH libX11 3/7] imDefLkup: Mark and unmark fabricated with serial
0
GTK2 applications with GTK_IM_MODULE=xim sets the serial number 0
to the XKeyEvent and the previous _XimFabricateSerial() logic did
not work for the applications.
Now the API marks to fabricate with the serial 0.
Closes: #205
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 1181abd6ffede3ac5663a3a3d4ee66aef1fa553b)
---
modules/im/ximcp/imDefLkup.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 31205e6b..53cf1f87 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -356,8 +356,11 @@ _XimFabricateSerial(
Xim im,
unsigned long serial)
{
- if (!serial)
- return False;
+ /* GTK2 XIM module sets serial=0. */
+ if (!serial) {
+ MARK_FABRICATED(im);
+ return True;
+ }
if (serial == im->private.proto.fabricated_serial) {
fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
return False;
@@ -375,8 +378,11 @@ _XimUnfabricateSerial(
Xim im,
unsigned long serial)
{
- if (!serial)
- return False;
+ /* GTK2 XIM module sets serial=0. */
+ if (!serial) {
+ UNMARK_FABRICATED(im);
+ return True;
+ }
if (!im->private.proto.fabricated_serial) {
fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
return False;
@@ -394,8 +400,9 @@ _XimIsFabricatedSerial(
Xim im,
unsigned long serial)
{
+ /* GTK2 XIM module sets serial=0. */
if (!serial)
- return False;
+ return IS_FABRICATED(im);
return (serial == im->private.proto.fabricated_serial);
}
--
2.47.1

216
0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch
View File

@ -1,216 +0,0 @@
From 24f2fdba4e5162ebcb011ce41104fb195b163169 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 00:49:14 +0900
Subject: [PATCH libX11 4/7] ximcp: Add fabricated_time in XimProtoPrivate for
timeout
When users type keys quickly, some applications using Steam or Java
do not call XNextEvent() for a key event but _XimFilterKeypress()
and _XimFilterKeyrelease() expect to receive the key events
forwarded by input methods.
Now fabricated_time Time value is added to XimProtoPrivate to check
the timeout value.
Closes: #205
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 5a14178c7cc408f425fe298aeade3dee749b1ca1)
---
modules/im/ximcp/imDefFlt.c | 8 +++---
modules/im/ximcp/imDefIm.c | 2 ++
modules/im/ximcp/imDefLkup.c | 48 ++++++++++++++++++++++++++----------
src/xlibi18n/XimintP.h | 10 +++++---
4 files changed, 47 insertions(+), 21 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index a7948df8..ad8a272b 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -142,9 +142,9 @@ _XimProtoKeypressFilter(
{
Xim im = (Xim)ic->core.im;
- if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) {
+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev->serial);
+ _XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter(
{
Xim im = (Xim)ic->core.im;
- if (_XimIsFabricatedSerial(im, ev->serial)) {
+ if (_XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev->serial);
+ _XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
index a231a0ac..7eba0b34 100644
--- a/modules/im/ximcp/imDefIm.c
+++ b/modules/im/ximcp/imDefIm.c
@@ -431,6 +431,8 @@ _XimPreConnect(
im->private.proto.im_window = im_window;
im->private.proto.fabricated_serial = 0;
+ im->private.proto.fabricated_time = 0;
+ im->private.proto.enable_fabricated_order = True;
return True;
}
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 53cf1f87..6b2d27dc 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -354,14 +354,14 @@ _XimForwardEvent(
Bool
_XimFabricateSerial(
Xim im,
- unsigned long serial)
+ XKeyEvent *event)
{
/* GTK2 XIM module sets serial=0. */
- if (!serial) {
+ if (!event->serial || !im->private.proto.enable_fabricated_order) {
MARK_FABRICATED(im);
return True;
}
- if (serial == im->private.proto.fabricated_serial) {
+ if (event->serial == im->private.proto.fabricated_serial) {
fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
return False;
}
@@ -369,17 +369,18 @@ _XimFabricateSerial(
fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
MARK_FABRICATED(im);
- im->private.proto.fabricated_serial = serial;
+ im->private.proto.fabricated_serial = event->serial;
+ im->private.proto.fabricated_time = event->time;
return True;
}
Bool
_XimUnfabricateSerial(
Xim im,
- unsigned long serial)
+ XKeyEvent *event)
{
/* GTK2 XIM module sets serial=0. */
- if (!serial) {
+ if (!event->serial || !im->private.proto.enable_fabricated_order) {
UNMARK_FABRICATED(im);
return True;
}
@@ -387,10 +388,11 @@ _XimUnfabricateSerial(
fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
return False;
}
- if (serial != im->private.proto.fabricated_serial)
+ if (event->serial != im->private.proto.fabricated_serial)
fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
im->private.proto.fabricated_serial = 0;
+ im->private.proto.fabricated_time = 0;
UNMARK_FABRICATED(im);
return True;
}
@@ -398,12 +400,32 @@ _XimUnfabricateSerial(
Bool
_XimIsFabricatedSerial(
Xim im,
- unsigned long serial)
+ XKeyEvent *event)
{
/* GTK2 XIM module sets serial=0. */
- if (!serial)
- return IS_FABRICATED(im);
- return (serial == im->private.proto.fabricated_serial);
+ if (!event->serial || !im->private.proto.enable_fabricated_order)
+ return IS_FABRICATED(im) ? True : False;
+ if (event->serial == im->private.proto.fabricated_serial)
+ return True;
+ if (!im->private.proto.fabricated_serial)
+ return False;
+ /* Rotate time */
+ if (event->time < im->private.proto.fabricated_time) {
+ if (event->time >= 1000)
+ im->private.proto.fabricated_time = 0;
+ } else if (event->time - im->private.proto.fabricated_time > 1000) {
+ fprintf(stderr,
+ "%s,%d: The application disposed a key event with %ld serial.\n",
+ __FILE__, __LINE__,
+ im->private.proto.fabricated_serial);
+ im->private.proto.enable_fabricated_order = False;
+ if (IS_FABRICATED(im)) {
+ if (event->serial)
+ im->private.proto.fabricated_serial = event->serial;
+ return True;
+ }
+ }
+ return False;
}
static void
@@ -420,7 +442,7 @@ _XimProcEvent(
ev->xany.serial |= serial << 16;
ev->xany.send_event = False;
ev->xany.display = d;
- _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial);
+ _XimFabricateSerial((Xim)ic->core.im, &ev->xkey);
return;
}
@@ -834,7 +856,7 @@ _XimCommitRecv(
if (ic->private.proto.registed_filter_event
& (KEYPRESS_MASK | KEYRELEASE_MASK))
- _XimFabricateSerial(im, ev.serial);
+ _XimFabricateSerial(im, &ev);
/* FIXME :
I wish there were COMMENTs (!) about the data passed around.
*/
diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
index 7f5b107a..715800c7 100644
--- a/src/xlibi18n/XimintP.h
+++ b/src/xlibi18n/XimintP.h
@@ -150,7 +150,9 @@ typedef struct _XimProtoPrivateRec {
XimTransCallDispatcher call_dispatcher;
XPointer spec;
- unsigned long fabricated_serial;
+ unsigned long fabricated_serial;
+ Time fabricated_time;
+ Bool enable_fabricated_order;
} XimProtoPrivateRec;
/*
@@ -312,16 +314,16 @@ typedef struct _XicProtoPrivateRec {
Bool
_XimFabricateSerial(
Xim im,
- unsigned long serial);
+ XKeyEvent *event);
Bool
_XimUnfabricateSerial(
Xim im,
- unsigned long serial);
+ XKeyEvent *event);
Bool
_XimIsFabricatedSerial(
Xim im,
- unsigned long serial);
+ XKeyEvent *event);
#endif /* _XIMINTP_H */
--
2.47.1

168
0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch
View File

@ -1,168 +0,0 @@
From b3157722535db692d54b8fe7d26d07f94d49daf3 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 01:29:26 +0900
Subject: [PATCH libX11 5/7] Accept anon windows in XFilterEvent to update XIM
state
When input focuses are switched quickly with shortcut keys in a Java
window, the focus is sometimes lost and the Window=0 is assigned in
XFilterEvent() but the XKeyEvent was forwarded by a XIM serer(IBus)
with XIM_FORWARD_EVENT -> XNextEvent() -> XFilterEvent() and the event
needs to be forwarded to the XIM XKeyEvent press and release filters
to update the XIM state with Window=0 likes _XimPendingFilter() and
_XimUnfabricateSerial().
Closes: #205, #206
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 5a1e62d77b65ba148b1c6d1d22a81dc2b07e7d9e)
---
modules/im/ximcp/imDefFlt.c | 34 ++++++++++++++++++++++++++++++----
src/FilterEv.c | 25 +++++++++++++++++++++++++
2 files changed, 55 insertions(+), 4 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index ad8a272b..76d63e88 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -138,7 +138,8 @@ _XimPendingFilter(
static Bool
_XimProtoKeypressFilter(
Xic ic,
- XKeyEvent *ev)
+ XKeyEvent *ev,
+ Window w)
{
Xim im = (Xim)ic->core.im;
@@ -147,6 +148,9 @@ _XimProtoKeypressFilter(
_XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
+ /* w=0 is used for _XimIsFabricatedSerial() only */
+ if (!w)
+ return NOTFILTERD;
if (IS_NEGLECT_EVENT(ic, KeyPressMask))
return FILTERD;
@@ -193,13 +197,14 @@ _XimFilterKeypress(
XEvent *ev,
XPointer client_data)
{
- return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev );
+ return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev, w);
}
static Bool
_XimProtoKeyreleaseFilter(
Xic ic,
- XKeyEvent *ev)
+ XKeyEvent *ev,
+ Window w)
{
Xim im = (Xim)ic->core.im;
@@ -208,6 +213,9 @@ _XimProtoKeyreleaseFilter(
_XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
+ /* w=0 is used for _XimIsFabricatedSerial() only */
+ if (!w)
+ return NOTFILTERD;
if (IS_NEGLECT_EVENT(ic, KeyReleaseMask))
return FILTERD;
@@ -254,7 +262,7 @@ _XimFilterKeyrelease(
XEvent *ev,
XPointer client_data)
{
- return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev);
+ return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev, w);
}
static void
@@ -263,6 +271,11 @@ _XimRegisterKeyPressFilter(
{
if (ic->core.focus_window) {
if (!(ic->private.proto.registed_filter_event & KEYPRESS_MASK)) {
+ _XRegisterFilterByType (ic->core.im->core.display,
+ 0,
+ KeyPress, KeyPress,
+ _XimFilterKeypress,
+ (XPointer)ic);
_XRegisterFilterByType (ic->core.im->core.display,
ic->core.focus_window,
KeyPress, KeyPress,
@@ -280,6 +293,11 @@ _XimRegisterKeyReleaseFilter(
{
if (ic->core.focus_window) {
if (!(ic->private.proto.registed_filter_event & KEYRELEASE_MASK)) {
+ _XRegisterFilterByType (ic->core.im->core.display,
+ 0,
+ KeyRelease, KeyRelease,
+ _XimFilterKeyrelease,
+ (XPointer)ic);
_XRegisterFilterByType (ic->core.im->core.display,
ic->core.focus_window,
KeyRelease, KeyRelease,
@@ -301,6 +319,10 @@ _XimUnregisterKeyPressFilter(
ic->core.focus_window,
_XimFilterKeypress,
(XPointer)ic);
+ _XUnregisterFilter (ic->core.im->core.display,
+ 0,
+ _XimFilterKeypress,
+ (XPointer)ic);
ic->private.proto.registed_filter_event &= ~KEYPRESS_MASK;
}
}
@@ -317,6 +339,10 @@ _XimUnregisterKeyReleaseFilter(
ic->core.focus_window,
_XimFilterKeyrelease,
(XPointer)ic);
+ _XUnregisterFilter (ic->core.im->core.display,
+ 0,
+ _XimFilterKeyrelease,
+ (XPointer)ic);
ic->private.proto.registed_filter_event &= ~KEYRELEASE_MASK;
}
}
diff --git a/src/FilterEv.c b/src/FilterEv.c
index 0a48e548..07845bcc 100644
--- a/src/FilterEv.c
+++ b/src/FilterEv.c
@@ -100,6 +100,31 @@ XFilterEvent(
}
}
}
+ for (p = ev->xany.display->im_filters; p != NULL; p = p->next) {
+ /* Java sometimes calls XFilterEvent() with window=0 and ev come from
+ * XNextEvent() when users type some keys quickly and switch multiple
+ * input focuses in a Java window with the keys.
+ * But XKeyEvent filters need to receive the event with window=0 for
+ * _XimPendingFilter() and _XimUnfabricateSerial() to clear the
+ * fowarded XKeyEvent with XIM_FORWARD_EVENT.
+ *
+ * The case of p->window == 0 is checkekd after all cases of p->window
+ * != 0 are checked because all input contexts share
+ * Display->im_filters but each input context has
+ * Xic->private.proto.registed_filter_event for the filters
+ * and same p->filter could be registerd to Display->im_filters twice
+ * with different p->window.
+ */
+ if (p->window == 0 && window == 0) {
+ if ((mask & p->event_mask) ||
+ (ev->type >= p->start_type && ev->type <= p->end_type)) {
+ UnlockDisplay(ev->xany.display);
+ ret = (*(p->filter))(ev->xany.display, p->window, ev,
+ p->client_data);
+ return(ret);
+ }
+ }
+ }
UnlockDisplay(ev->xany.display);
#endif
return(False);
--
2.47.1

82
0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch
View File

@ -1,82 +0,0 @@
From 546a51348322d83a57fd9b8c1e42b44fbe970368 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 01:29:34 +0900
Subject: [PATCH libX11 6/7] ximcp: Unmark fabricated with serial 0 and Xic
commit_info
GTK2 XIM resets the XKeyEvent serial to 0 even if _XimCommitRecv()
sets the serial so now checks if the events are sent with
Xic->private.proto.commit_info.
Closes: !246
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 898746f9b1fb384d6d24ed827c836ec8a0b3da3b)
---
modules/im/ximcp/imDefFlt.c | 4 ++--
modules/im/ximcp/imDefLkup.c | 12 +++++++++++-
src/xlibi18n/XimintP.h | 1 +
3 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index 76d63e88..3dfbf8cd 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -145,7 +145,7 @@ _XimProtoKeypressFilter(
if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev);
+ _XimUnfabricateSerial(im, ic, ev);
return NOTFILTERD;
}
/* w=0 is used for _XimIsFabricatedSerial() only */
@@ -210,7 +210,7 @@ _XimProtoKeyreleaseFilter(
if (_XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev);
+ _XimUnfabricateSerial(im, ic, ev);
return NOTFILTERD;
}
/* w=0 is used for _XimIsFabricatedSerial() only */
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 6b2d27dc..326339fe 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -377,10 +377,20 @@ _XimFabricateSerial(
Bool
_XimUnfabricateSerial(
Xim im,
+ Xic ic,
XKeyEvent *event)
{
+ if (!im->private.proto.enable_fabricated_order) {
+ UNMARK_FABRICATED(im);
+ return True;
+ }
/* GTK2 XIM module sets serial=0. */
- if (!event->serial || !im->private.proto.enable_fabricated_order) {
+ if (!event->serial) {
+ /* _XimCommitRecv() sets event->serial and call _XimFabricateSerial()
+ * but GTK2 XIM always reset event->serial=0 with XFilterEvent().
+ */
+ if (ic && ic->private.proto.commit_info)
+ im->private.proto.fabricated_serial = 0;
UNMARK_FABRICATED(im);
return True;
}
diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
index 715800c7..fe52231e 100644
--- a/src/xlibi18n/XimintP.h
+++ b/src/xlibi18n/XimintP.h
@@ -319,6 +319,7 @@ _XimFabricateSerial(
Bool
_XimUnfabricateSerial(
Xim im,
+ Xic ic,
XKeyEvent *event);
Bool
--
2.47.1

58
0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch
View File

@ -1,58 +0,0 @@
From 9abd669f8826909a715e9b19531fd687800ce44c Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 01:29:39 +0900
Subject: [PATCH libX11 7/7] imDefIm: Add LIBX11_ENABLE_FABRICATED_ORDER env
If an XIM application does not return the XKeyEvent from XNextEvent()
to XFilterEvent(), a timeout is reached and the behavior is fallen
back to the previous one with a warning messsage and we can ask
the application to send the XKeyEvent to XFilterEvent() but also
libX11 provides LIBX11_ENABLE_FABRICATED_ORDER environment variable.
If the application runs with LIBX11_ENABLE_FABRICATED_ORDER=0, the
previous behavior is available until the application is fixed.
Closes: !246
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 90b8fc65da1e773b0091a50be46b23609591e8b7)
---
modules/im/ximcp/imDefIm.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
index 7eba0b34..f42aa92c 100644
--- a/modules/im/ximcp/imDefIm.c
+++ b/modules/im/ximcp/imDefIm.c
@@ -63,6 +63,8 @@ PERFORMANCE OF THIS SOFTWARE.
#include "Ximint.h"
#include <limits.h>
+#include <stdlib.h>
+#include <strings.h>
int
_XimCheckDataSize(
@@ -400,6 +402,7 @@ _XimPreConnect(
Atom *atoms;
Window im_window = 0;
register int i;
+ const char *env_enable_fabricated_order;
if((imserver = XInternAtom(display, XIM_SERVERS, True)) == (Atom)None)
return False;
@@ -433,6 +436,13 @@ _XimPreConnect(
im->private.proto.fabricated_serial = 0;
im->private.proto.fabricated_time = 0;
im->private.proto.enable_fabricated_order = True;
+ env_enable_fabricated_order = getenv("LIBX11_ENABLE_FABRICATED_ORDER");
+ if (env_enable_fabricated_order && *env_enable_fabricated_order) {
+ if (!strncasecmp(env_enable_fabricated_order, "0", 2) ||
+ !strncasecmp(env_enable_fabricated_order, "false", 6)) {
+ im->private.proto.enable_fabricated_order = False;
+ }
+ }
return True;
}
--
2.47.1

16
dont-forward-keycode-0.patch
View File

@ -1,19 +1,19 @@
diff -up libX11-1.6.3/modules/im/ximcp/imDefFlt.c.jx libX11-1.6.3/modules/im/ximcp/imDefFlt.c
--- libX11-1.6.3/modules/im/ximcp/imDefFlt.c.jx 2015-03-09 18:28:45.000000000 -0400
+++ libX11-1.6.3/modules/im/ximcp/imDefFlt.c 2015-03-10 12:32:31.912149644 -0400
@@ -142,7 +142,7 @@ _XimProtoKeypressFilter(
@@ -143,7 +143,7 @@ _XimProtoKeypressFilter(
{
Xim im = (Xim)ic->core.im;
- if (IS_FABRICATED(im)) {
+ if ((ev->keycode == 0) || IS_FABRICATED(im)) {
- if (_XimIsFabricatedSerial(im, ev)) {
+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
UNMARK_FABRICATED(im);
_XimUnfabricateSerial(im, ic, ev);
return NOTFILTERD;
diff -up libX11-1.6.3/modules/im/ximcp/imDefLkup.c.jx libX11-1.6.3/modules/im/ximcp/imDefLkup.c
--- libX11-1.6.3/modules/im/ximcp/imDefLkup.c.jx 2015-03-09 18:28:45.000000000 -0400
+++ libX11-1.6.3/modules/im/ximcp/imDefLkup.c 2015-03-10 12:32:31.911149637 -0400
@@ -332,6 +332,17 @@ _XimForwardEvent(
@@ -333,6 +333,17 @@ _XimForwardEvent(
XEvent *ev,
Bool sync)
{
@ -31,9 +31,9 @@ diff -up libX11-1.6.3/modules/im/ximcp/imDefLkup.c.jx libX11-1.6.3/modules/im/xi
#ifdef EXT_FORWARD
if (((ev->type == KeyPress) || (ev->type == KeyRelease)))
if (_XimExtForwardKeyEvent(ic, (XKeyEvent *)ev, sync))
@@ -604,6 +615,19 @@ _XimUnregCommitInfo(
Xfree(info->keysym);
ic->private.proto.commit_info = info->next;
@@ -703,6 +714,19 @@ _XimUnregRealCommitInfo(
else
ic->private.proto.commit_info = info->next;
Xfree(info);
+
+ /*

49
libX11.spec
View File

@ -4,9 +4,9 @@
Summary: Core X11 protocol client library
Name: libX11
Version: 1.7.0
Release: 11%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
License: MIT
Version: 1.8.12
Release: 1%{?dist}
License: MIT AND X11
URL: http://www.x.org
%if 0%{?gitdate}
@ -14,37 +14,13 @@ Source0: %{tarball}-%{gitdate}.tar.bz2
Source1: make-git-snapshot.sh
Source2: commitid
%else
Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.bz2
Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.xz
%endif
Patch1: 0001-Lower-autoconf-requirement-to-2.69.patch
Patch2: dont-forward-keycode-0.patch
Patch3: 0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch
# CVE-2023-3138
Patch4: 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
# CVE-2023-43785
Patch5: 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
# CVE-2023-43786
Patch6: 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
Patch7: 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
Patch8: 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
# CVE-2023-43787
Patch9: 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
# https://issues.redhat.com/browse/RHEL-58298
Patch10: 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
# https://issues.redhat.com/browse/RHEL-69791
Patch11: 0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch
Patch12: 0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch
Patch13: 0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch
Patch14: 0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch
Patch15: 0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch
Patch16: 0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch
Patch17: 0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch
BuildRequires: libtool
BuildRequires: make
BuildRequires: xorg-x11-util-macros >= 1.11
BuildRequires: pkgconfig(xproto) >= 7.0.15
@ -119,7 +95,7 @@ make %{?_smp_mflags} check
%{_libdir}/libX11-xcb.so.1.0.0
%files common
%doc AUTHORS COPYING README.md NEWS
%doc AUTHORS COPYING README.md
%{_datadir}/X11/locale/
%{_datadir}/X11/XErrorDB
%dir /var/cache/libX11
@ -147,6 +123,17 @@ make %{?_smp_mflags} check
%{_mandir}/man5/*.5*
%changelog
* Wed Nov 05 2025 RHEL Packaging Agent <jotnar@redhat.com> - 1.8.12-1
- Rebase to version 1.8.12
- Update license to MIT AND X11 (SPDX migration)
- Change source format from .tar.bz2 to .tar.xz
- Add libtool as BuildRequires
- Remove CVE patches (now included upstream)
- Add patch to lower autoconf requirement to 2.69
- Update dont-forward-keycode-0.patch for new codebase
- Remove NEWS from %doc (file not present in 1.8.12)
- Resolves: RHEL-111537
* Fri Dec 13 2024 Olivier Fourdan <ofourdan@redhat.com> - 1.7.0-11
- Backport fixes for XIM input sometimes jumbled (RHEL-69791)

2
sources
View File

@ -1 +1 @@
SHA512 (libX11-1.7.0.tar.bz2) = f661ca90350fd8a94f054b00f12f5122cea068ebff706acfd399462236c189a296a2358d17d16166635101cf56cc19303dd407873a159932d093c9f33556f9fb
SHA512 (libX11-1.8.12.tar.xz) = cb7a284d9081a8b67f7d8568d56dc403a4b787e46ac497b07768d236084c01f80f4ea2ebd814f950ac9738adc3baea3912932fc333858195c4f8217744b6f730