rpms/libX11
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Compare commits

merge into: rpms:c8
Branches Tags
rpms:c8
rpms:c9s
rpms:c10s
rpms:c8s
rpms:c9
rpms:c9-beta
rpms:c8-beta
rpms:imports/c10s/libX11-1.8.10-1.el10
rpms:imports/c10s/libX11-1.8.7-8.el10
rpms:imports/c8/libX11-1.6.8-9.el8_10
rpms:imports/c10s/libX11-1.8.7-7.el10
rpms:imports/c8/libX11-1.6.8-8.el8
rpms:imports/c9/libX11-1.7.0-9.el9
rpms:imports/c8/libX11-1.6.8-6.el8
rpms:imports/c9/libX11-1.7.0-8.el9
rpms:imports/c8-beta/libX11-1.6.8-6.el8
rpms:imports/c9-beta/libX11-1.7.0-8.el9
rpms:imports/c9/libX11-1.7.0-7.el9
rpms:imports/c9-beta/libX11-1.7.0-7.el9
rpms:imports/c8/libX11-1.6.8-5.el8
rpms:imports/c8-beta/libX11-1.6.8-5.el8
rpms:imports/c8-beta/libX11-1.6.8-4.el8
rpms:imports/c8-beta/libX11-1.6.8-3.el8
rpms:imports/c8-beta/libX11-1.6.8-2.el8
rpms:imports/c8-beta/libX11-1.6.7-1.el8
rpms:imports/c8s/libX11-1.6.8-5.el8
rpms:imports/c8s/libX11-1.6.8-4.el8
rpms:imports/c8s/libX11-1.6.8-3.el8
rpms:imports/c8/libX11-1.6.8-4.el8
rpms:imports/c8/libX11-1.6.8-3.el8
rpms:imports/c8/libX11-1.6.7-1.el8
...
pull from: rpms:c9s
Branches Tags
rpms:c9s
rpms:c10s
rpms:c8
rpms:c8s
rpms:c9
rpms:c9-beta
rpms:c8-beta
rpms:imports/c10s/libX11-1.8.10-1.el10
rpms:imports/c10s/libX11-1.8.7-8.el10
rpms:imports/c8/libX11-1.6.8-9.el8_10
rpms:imports/c10s/libX11-1.8.7-7.el10
rpms:imports/c8/libX11-1.6.8-8.el8
rpms:imports/c9/libX11-1.7.0-9.el9
rpms:imports/c8/libX11-1.6.8-6.el8
rpms:imports/c9/libX11-1.7.0-8.el9
rpms:imports/c8-beta/libX11-1.6.8-6.el8
rpms:imports/c9-beta/libX11-1.7.0-8.el9
rpms:imports/c9/libX11-1.7.0-7.el9
rpms:imports/c9-beta/libX11-1.7.0-7.el9
rpms:imports/c8/libX11-1.6.8-5.el8
rpms:imports/c8-beta/libX11-1.6.8-5.el8
rpms:imports/c8-beta/libX11-1.6.8-4.el8
rpms:imports/c8-beta/libX11-1.6.8-3.el8
rpms:imports/c8-beta/libX11-1.6.8-2.el8
rpms:imports/c8-beta/libX11-1.6.7-1.el8
rpms:imports/c8s/libX11-1.6.8-5.el8
rpms:imports/c8s/libX11-1.6.8-4.el8
rpms:imports/c8s/libX11-1.6.8-3.el8
rpms:imports/c8/libX11-1.6.8-4.el8
rpms:imports/c8/libX11-1.6.8-3.el8
rpms:imports/c8/libX11-1.6.7-1.el8

No commits in common. "c8" and "c9s" have entirely different histories.
c8 ... c9s

28 changed files with 1103 additions and 797 deletions
Show Stats Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1 @@
SOURCES/libX11-1.6.8.tar.bz2
/libX11-*.tar.bz2

1
.libX11.metadata
View File

@ -1 +0,0 @@
f1ea96fe472a981d378b4f2eec90dcd063f9a407 SOURCES/libX11-1.6.8.tar.bz2

0
SOURCES/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch → 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
View File

0
SOURCES/0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch → 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
View File

0
SOURCES/0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch → 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
View File

0
SOURCES/0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch → 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
View File

0
SOURCES/0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch → 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
View File

43
0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch Normal file
View File

@ -0,0 +1,43 @@
From e92efc63acd7b377faa9e534f4bf52aaa86be2a9 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Tue, 27 Jul 2021 11:46:19 +1000
Subject: [PATCH libX11] makekeys: handle the new _EVDEVK xorgproto symbols
These keys are all defined through a macro in the form:
#define XF86XK_BrightnessAuto _EVDEVK(0x0F4)
The _EVDEVK macro is simply an offset of 0x10081000.
Let's parse these lines correctly so those keysyms end up in our
hashtables.
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
src/util/makekeys.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/src/util/makekeys.c b/src/util/makekeys.c
index e847ef4c..4896cc53 100644
--- a/src/util/makekeys.c
+++ b/src/util/makekeys.c
@@ -78,6 +78,18 @@ parse_line(const char *buf, char *key, KeySym *val, char *prefix)
return 1;
}
+ /* See if we can parse one of the _EVDEVK symbols */
+ i = sscanf(buf, "#define %127s _EVDEVK(0x%lx)", key, val);
+ if (i == 2 && (tmp = strstr(key, "XK_"))) {
+ memcpy(prefix, key, (size_t)(tmp - key));
+ prefix[tmp - key] = '\0';
+ tmp += 3;
+ memmove(key, tmp, strlen(tmp) + 1);
+
+ *val += 0x10081000;
+ return 1;
+ }
+
/* Now try to catch alias (XK_foo XK_bar) definitions, and resolve them
* immediately: if the target is in the form XF86XK_foo, we need to
* canonicalise this to XF86foo before we do the lookup. */
--
2.31.1

200
0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch Normal file
View File

@ -0,0 +1,200 @@
From a91e5a5e6fca25f23c7dd24c6694ab1b80b6030e Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 12 Apr 2024 10:21:41 +0900
Subject: [PATCH libX11 1/7] ximcp: Unmark to fabricate key events with
XKeyEvent serial
_XimProtoKeypressFilter() and _XimProtoKeyreleaseFilter() can
receive XKeyEvent from both the typing on the keyboard and the
callback of XIM_FORWARD_EVENT.
If the filter functions unmark to fabricate XKeyEvent from the typing
on the keyboard during receiving XKeyEvent from the callback of
XIM_FORWARD_EVENT with typing keys very quickly likes an bar code
scanner (or evemu-play), XIM server cannot receive some key events and
it causes the key typing order to get scrambled.
Now XIM client saves the serial in XKeyEvent and the filter functions
unmark to fabricate XKeyEvent from the callback of XIM_FORWARD_EVENT
only.
This and 024d229f are same patches but the regression issues will be
fixed by the later patches.
Closes: #198
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 13e9ac4d458069c81d795f6b4842814d30431b4b)
---
modules/im/ximcp/imDefFlt.c | 8 ++---
modules/im/ximcp/imDefIm.c | 1 +
modules/im/ximcp/imDefLkup.c | 58 ++++++++++++++++++++++++++++++++----
src/xlibi18n/XimintP.h | 17 +++++++++++
4 files changed, 75 insertions(+), 9 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index f89d2cb0..a7948df8 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -142,9 +142,9 @@ _XimProtoKeypressFilter(
{
Xim im = (Xim)ic->core.im;
- if ((ev->keycode == 0) || IS_FABRICATED(im)) {
+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) {
_XimPendingFilter(ic);
- UNMARK_FABRICATED(im);
+ _XimUnfabricateSerial(im, ev->serial);
return NOTFILTERD;
}
@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter(
{
Xim im = (Xim)ic->core.im;
- if (IS_FABRICATED(im)) {
+ if (_XimIsFabricatedSerial(im, ev->serial)) {
_XimPendingFilter(ic);
- UNMARK_FABRICATED(im);
+ _XimUnfabricateSerial(im, ev->serial);
return NOTFILTERD;
}
diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
index ccdf14c1..a231a0ac 100644
--- a/modules/im/ximcp/imDefIm.c
+++ b/modules/im/ximcp/imDefIm.c
@@ -430,6 +430,7 @@ _XimPreConnect(
return False;
im->private.proto.im_window = im_window;
+ im->private.proto.fabricated_serial = 0;
return True;
}
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 18289a80..a6923d5b 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -351,6 +351,54 @@ _XimForwardEvent(
return _XimForwardEventCore(ic, ev, sync);
}
+Bool
+_XimFabricateSerial(
+ Xim im,
+ unsigned long serial)
+{
+ if (!serial)
+ return False;
+ if (serial == im->private.proto.fabricated_serial) {
+ fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
+ return False;
+ }
+ if (im->private.proto.fabricated_serial)
+ fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
+
+ MARK_FABRICATED(im);
+ im->private.proto.fabricated_serial = serial;
+ return True;
+}
+
+Bool
+_XimUnfabricateSerial(
+ Xim im,
+ unsigned long serial)
+{
+ if (!serial)
+ return False;
+ if (!im->private.proto.fabricated_serial) {
+ fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
+ return False;
+ }
+ if (serial != im->private.proto.fabricated_serial)
+ fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
+
+ im->private.proto.fabricated_serial = 0;
+ UNMARK_FABRICATED(im);
+ return True;
+}
+
+Bool
+_XimIsFabricatedSerial(
+ Xim im,
+ unsigned long serial)
+{
+ if (!serial)
+ return False;
+ return (serial == im->private.proto.fabricated_serial);
+}
+
static void
_XimProcEvent(
Display *d,
@@ -365,7 +413,7 @@ _XimProcEvent(
ev->xany.serial |= serial << 16;
ev->xany.send_event = False;
ev->xany.display = d;
- MARK_FABRICATED(ic->core.im);
+ _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial);
return;
}
@@ -727,10 +775,6 @@ _XimCommitRecv(
(void)_XimRespSyncReply(ic, flag);
- if (ic->private.proto.registed_filter_event
- & (KEYPRESS_MASK | KEYRELEASE_MASK))
- MARK_FABRICATED(im);
-
bzero(&ev, sizeof(ev)); /* uninitialized : found when running kterm under valgrind */
ev.type = KeyPress;
@@ -742,6 +786,10 @@ _XimCommitRecv(
ev.time = 0L;
ev.serial = LastKnownRequestProcessed(im->core.display);
+
+ if (ic->private.proto.registed_filter_event
+ & (KEYPRESS_MASK | KEYRELEASE_MASK))
+ _XimFabricateSerial(im, ev.serial);
/* FIXME :
I wish there were COMMENTs (!) about the data passed around.
*/
diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
index 14a7e6d5..7f5b107a 100644
--- a/src/xlibi18n/XimintP.h
+++ b/src/xlibi18n/XimintP.h
@@ -149,6 +149,8 @@ typedef struct _XimProtoPrivateRec {
XimTransRegDispatcher register_dispatcher;
XimTransCallDispatcher call_dispatcher;
XPointer spec;
+
+ unsigned long fabricated_serial;
} XimProtoPrivateRec;
/*
@@ -307,4 +309,19 @@ typedef struct _XicProtoPrivateRec {
#define XIM_MAXIMNAMELEN 64
#define XIM_MAXLCNAMELEN 64
+Bool
+_XimFabricateSerial(
+ Xim im,
+ unsigned long serial);
+
+Bool
+_XimUnfabricateSerial(
+ Xim im,
+ unsigned long serial);
+
+Bool
+_XimIsFabricatedSerial(
+ Xim im,
+ unsigned long serial);
+
#endif /* _XIMINTP_H */
--
2.47.1

0
SOURCES/0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch → 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
View File

158
0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch Normal file
View File

@ -0,0 +1,158 @@
From a1037538b74e4016c3a1c2ebef9b1836811ed687 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 12 Apr 2024 10:21:43 +0900
Subject: [PATCH libX11 2/7] imDefLkup: Commit first info in XimCommitInfo
Xic.private.proto.commit_info can receive multiple XimCommitInfo
when typing keys very quickly like an bar code scanner (or evemu-play)
and the first info in XimCommitInfo should be committed to keep
the typing key order.
This and 041b5291 are same patches but the regression issues will be
fixed by the later patches.
Closes: #198
Fixes: 041b5291 ("imDefLkup: Commit first info in XimCommitInfo")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit c7790072657f9fdbe8cda031776617088c5f11db)
---
modules/im/ximcp/imDefLkup.c | 60 +++++++++++++++++++++++++++++-------
1 file changed, 49 insertions(+), 11 deletions(-)
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index a6923d5b..31205e6b 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -650,18 +650,29 @@ _XimRegCommitInfo(
}
static void
-_XimUnregCommitInfo(
- Xic ic)
+_XimUnregRealCommitInfo(
+ Xic ic,
+ Bool reverse)
{
XimCommitInfo info;
+ XimCommitInfo prev_info = NULL;
- if (!(info = ic->private.proto.commit_info))
+ info = ic->private.proto.commit_info;
+ while (reverse && info) {
+ if (!info->next)
+ break;
+ prev_info = info;
+ info = info->next;
+ }
+ if (!info)
return;
-
Xfree(info->string);
Xfree(info->keysym);
- ic->private.proto.commit_info = info->next;
+ if (prev_info)
+ prev_info->next = info->next;
+ else
+ ic->private.proto.commit_info = info->next;
Xfree(info);
/*
@@ -679,6 +690,20 @@ _XimUnregCommitInfo(
return;
}
+static void
+_XimUnregCommitInfo(
+ Xic ic)
+{
+ _XimUnregRealCommitInfo(ic, False);
+}
+
+static void
+_XimUnregFirstCommitInfo(
+ Xic ic)
+{
+ _XimUnregRealCommitInfo(ic, True);
+}
+
void
_XimFreeCommitInfo(
Xic ic)
@@ -688,6 +713,19 @@ _XimFreeCommitInfo(
return;
}
+static XimCommitInfo
+_XimFirstCommitInfo(
+ Xic ic)
+{
+ XimCommitInfo info = ic->private.proto.commit_info;
+ while (info) {
+ if (!info->next)
+ break;
+ info = info->next;
+ }
+ return info;
+}
+
static Bool
_XimProcKeySym(
Xic ic,
@@ -1082,7 +1120,7 @@ _XimProtoMbLookupString(
state = &tmp_state;
if ((ev->type == KeyPress) && (ev->keycode == 0)) { /* Filter function */
- if (!(info = ic->private.proto.commit_info)) {
+ if (!(info = _XimFirstCommitInfo(ic))) {
*state = XLookupNone;
return 0;
}
@@ -1098,7 +1136,7 @@ _XimProtoMbLookupString(
else
*state = XLookupKeySym;
}
- _XimUnregCommitInfo(ic);
+ _XimUnregFirstCommitInfo(ic);
} else if (ev->type == KeyPress) {
ret = _XimLookupMBText(ic, ev, buffer, bytes, keysym, NULL);
@@ -1145,7 +1183,7 @@ _XimProtoWcLookupString(
state = &tmp_state;
if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
- if (!(info = ic->private.proto.commit_info)) {
+ if (!(info = _XimFirstCommitInfo(ic))) {
*state = XLookupNone;
return 0;
}
@@ -1161,7 +1199,7 @@ _XimProtoWcLookupString(
else
*state = XLookupKeySym;
}
- _XimUnregCommitInfo(ic);
+ _XimUnregFirstCommitInfo(ic);
} else if (ev->type == KeyPress) {
ret = _XimLookupWCText(ic, ev, buffer, bytes, keysym, NULL);
@@ -1208,7 +1246,7 @@ _XimProtoUtf8LookupString(
state = &tmp_state;
if (ev->type == KeyPress && ev->keycode == 0) { /* Filter function */
- if (!(info = ic->private.proto.commit_info)) {
+ if (!(info = _XimFirstCommitInfo(ic))) {
*state = XLookupNone;
return 0;
}
@@ -1224,7 +1262,7 @@ _XimProtoUtf8LookupString(
else
*state = XLookupKeySym;
}
- _XimUnregCommitInfo(ic);
+ _XimUnregFirstCommitInfo(ic);
} else if (ev->type == KeyPress) {
ret = _XimLookupUTF8Text(ic, ev, buffer, bytes, keysym, NULL);
--
2.47.1

0
SOURCES/0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch → 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
View File

65
0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch Normal file
View File

@ -0,0 +1,65 @@
From ed53956985d37c57fcd3587c642ee7ebf653d1af Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 12 Apr 2024 10:50:33 +0900
Subject: [PATCH libX11 3/7] imDefLkup: Mark and unmark fabricated with serial
0
GTK2 applications with GTK_IM_MODULE=xim sets the serial number 0
to the XKeyEvent and the previous _XimFabricateSerial() logic did
not work for the applications.
Now the API marks to fabricate with the serial 0.
Closes: #205
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 1181abd6ffede3ac5663a3a3d4ee66aef1fa553b)
---
modules/im/ximcp/imDefLkup.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 31205e6b..53cf1f87 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -356,8 +356,11 @@ _XimFabricateSerial(
Xim im,
unsigned long serial)
{
- if (!serial)
- return False;
+ /* GTK2 XIM module sets serial=0. */
+ if (!serial) {
+ MARK_FABRICATED(im);
+ return True;
+ }
if (serial == im->private.proto.fabricated_serial) {
fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
return False;
@@ -375,8 +378,11 @@ _XimUnfabricateSerial(
Xim im,
unsigned long serial)
{
- if (!serial)
- return False;
+ /* GTK2 XIM module sets serial=0. */
+ if (!serial) {
+ UNMARK_FABRICATED(im);
+ return True;
+ }
if (!im->private.proto.fabricated_serial) {
fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
return False;
@@ -394,8 +400,9 @@ _XimIsFabricatedSerial(
Xim im,
unsigned long serial)
{
+ /* GTK2 XIM module sets serial=0. */
if (!serial)
- return False;
+ return IS_FABRICATED(im);
return (serial == im->private.proto.fabricated_serial);
}
--
2.47.1

216
0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch Normal file
View File

@ -0,0 +1,216 @@
From 24f2fdba4e5162ebcb011ce41104fb195b163169 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 00:49:14 +0900
Subject: [PATCH libX11 4/7] ximcp: Add fabricated_time in XimProtoPrivate for
timeout
When users type keys quickly, some applications using Steam or Java
do not call XNextEvent() for a key event but _XimFilterKeypress()
and _XimFilterKeyrelease() expect to receive the key events
forwarded by input methods.
Now fabricated_time Time value is added to XimProtoPrivate to check
the timeout value.
Closes: #205
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 5a14178c7cc408f425fe298aeade3dee749b1ca1)
---
modules/im/ximcp/imDefFlt.c | 8 +++---
modules/im/ximcp/imDefIm.c | 2 ++
modules/im/ximcp/imDefLkup.c | 48 ++++++++++++++++++++++++++----------
src/xlibi18n/XimintP.h | 10 +++++---
4 files changed, 47 insertions(+), 21 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index a7948df8..ad8a272b 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -142,9 +142,9 @@ _XimProtoKeypressFilter(
{
Xim im = (Xim)ic->core.im;
- if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev->serial)) {
+ if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev->serial);
+ _XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
@@ -203,9 +203,9 @@ _XimProtoKeyreleaseFilter(
{
Xim im = (Xim)ic->core.im;
- if (_XimIsFabricatedSerial(im, ev->serial)) {
+ if (_XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev->serial);
+ _XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
index a231a0ac..7eba0b34 100644
--- a/modules/im/ximcp/imDefIm.c
+++ b/modules/im/ximcp/imDefIm.c
@@ -431,6 +431,8 @@ _XimPreConnect(
im->private.proto.im_window = im_window;
im->private.proto.fabricated_serial = 0;
+ im->private.proto.fabricated_time = 0;
+ im->private.proto.enable_fabricated_order = True;
return True;
}
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 53cf1f87..6b2d27dc 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -354,14 +354,14 @@ _XimForwardEvent(
Bool
_XimFabricateSerial(
Xim im,
- unsigned long serial)
+ XKeyEvent *event)
{
/* GTK2 XIM module sets serial=0. */
- if (!serial) {
+ if (!event->serial || !im->private.proto.enable_fabricated_order) {
MARK_FABRICATED(im);
return True;
}
- if (serial == im->private.proto.fabricated_serial) {
+ if (event->serial == im->private.proto.fabricated_serial) {
fprintf(stderr, "%s,%d: The key event is already fabricated.\n", __FILE__, __LINE__);
return False;
}
@@ -369,17 +369,18 @@ _XimFabricateSerial(
fprintf(stderr, "%s,%d: Tried to fabricate a wrong key event.\n", __FILE__, __LINE__);
MARK_FABRICATED(im);
- im->private.proto.fabricated_serial = serial;
+ im->private.proto.fabricated_serial = event->serial;
+ im->private.proto.fabricated_time = event->time;
return True;
}
Bool
_XimUnfabricateSerial(
Xim im,
- unsigned long serial)
+ XKeyEvent *event)
{
/* GTK2 XIM module sets serial=0. */
- if (!serial) {
+ if (!event->serial || !im->private.proto.enable_fabricated_order) {
UNMARK_FABRICATED(im);
return True;
}
@@ -387,10 +388,11 @@ _XimUnfabricateSerial(
fprintf(stderr, "%s,%d: The key event is already unfabricated.\n", __FILE__, __LINE__);
return False;
}
- if (serial != im->private.proto.fabricated_serial)
+ if (event->serial != im->private.proto.fabricated_serial)
fprintf(stderr, "%s,%d: Tried to unfabricate a wrong key event.\n", __FILE__, __LINE__);
im->private.proto.fabricated_serial = 0;
+ im->private.proto.fabricated_time = 0;
UNMARK_FABRICATED(im);
return True;
}
@@ -398,12 +400,32 @@ _XimUnfabricateSerial(
Bool
_XimIsFabricatedSerial(
Xim im,
- unsigned long serial)
+ XKeyEvent *event)
{
/* GTK2 XIM module sets serial=0. */
- if (!serial)
- return IS_FABRICATED(im);
- return (serial == im->private.proto.fabricated_serial);
+ if (!event->serial || !im->private.proto.enable_fabricated_order)
+ return IS_FABRICATED(im) ? True : False;
+ if (event->serial == im->private.proto.fabricated_serial)
+ return True;
+ if (!im->private.proto.fabricated_serial)
+ return False;
+ /* Rotate time */
+ if (event->time < im->private.proto.fabricated_time) {
+ if (event->time >= 1000)
+ im->private.proto.fabricated_time = 0;
+ } else if (event->time - im->private.proto.fabricated_time > 1000) {
+ fprintf(stderr,
+ "%s,%d: The application disposed a key event with %ld serial.\n",
+ __FILE__, __LINE__,
+ im->private.proto.fabricated_serial);
+ im->private.proto.enable_fabricated_order = False;
+ if (IS_FABRICATED(im)) {
+ if (event->serial)
+ im->private.proto.fabricated_serial = event->serial;
+ return True;
+ }
+ }
+ return False;
}
static void
@@ -420,7 +442,7 @@ _XimProcEvent(
ev->xany.serial |= serial << 16;
ev->xany.send_event = False;
ev->xany.display = d;
- _XimFabricateSerial((Xim)ic->core.im, ev->xany.serial);
+ _XimFabricateSerial((Xim)ic->core.im, &ev->xkey);
return;
}
@@ -834,7 +856,7 @@ _XimCommitRecv(
if (ic->private.proto.registed_filter_event
& (KEYPRESS_MASK | KEYRELEASE_MASK))
- _XimFabricateSerial(im, ev.serial);
+ _XimFabricateSerial(im, &ev);
/* FIXME :
I wish there were COMMENTs (!) about the data passed around.
*/
diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
index 7f5b107a..715800c7 100644
--- a/src/xlibi18n/XimintP.h
+++ b/src/xlibi18n/XimintP.h
@@ -150,7 +150,9 @@ typedef struct _XimProtoPrivateRec {
XimTransCallDispatcher call_dispatcher;
XPointer spec;
- unsigned long fabricated_serial;
+ unsigned long fabricated_serial;
+ Time fabricated_time;
+ Bool enable_fabricated_order;
} XimProtoPrivateRec;
/*
@@ -312,16 +314,16 @@ typedef struct _XicProtoPrivateRec {
Bool
_XimFabricateSerial(
Xim im,
- unsigned long serial);
+ XKeyEvent *event);
Bool
_XimUnfabricateSerial(
Xim im,
- unsigned long serial);
+ XKeyEvent *event);
Bool
_XimIsFabricatedSerial(
Xim im,
- unsigned long serial);
+ XKeyEvent *event);
#endif /* _XIMINTP_H */
--
2.47.1

168
0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch Normal file
View File

@ -0,0 +1,168 @@
From b3157722535db692d54b8fe7d26d07f94d49daf3 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 01:29:26 +0900
Subject: [PATCH libX11 5/7] Accept anon windows in XFilterEvent to update XIM
state
When input focuses are switched quickly with shortcut keys in a Java
window, the focus is sometimes lost and the Window=0 is assigned in
XFilterEvent() but the XKeyEvent was forwarded by a XIM serer(IBus)
with XIM_FORWARD_EVENT -> XNextEvent() -> XFilterEvent() and the event
needs to be forwarded to the XIM XKeyEvent press and release filters
to update the XIM state with Window=0 likes _XimPendingFilter() and
_XimUnfabricateSerial().
Closes: #205, #206
Fixes: 024d229f ("ximcp: Unmark to fabricate key events with XKeyEvent serial")
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 5a1e62d77b65ba148b1c6d1d22a81dc2b07e7d9e)
---
modules/im/ximcp/imDefFlt.c | 34 ++++++++++++++++++++++++++++++----
src/FilterEv.c | 25 +++++++++++++++++++++++++
2 files changed, 55 insertions(+), 4 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index ad8a272b..76d63e88 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -138,7 +138,8 @@ _XimPendingFilter(
static Bool
_XimProtoKeypressFilter(
Xic ic,
- XKeyEvent *ev)
+ XKeyEvent *ev,
+ Window w)
{
Xim im = (Xim)ic->core.im;
@@ -147,6 +148,9 @@ _XimProtoKeypressFilter(
_XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
+ /* w=0 is used for _XimIsFabricatedSerial() only */
+ if (!w)
+ return NOTFILTERD;
if (IS_NEGLECT_EVENT(ic, KeyPressMask))
return FILTERD;
@@ -193,13 +197,14 @@ _XimFilterKeypress(
XEvent *ev,
XPointer client_data)
{
- return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev );
+ return _XimProtoKeypressFilter((Xic)client_data, (XKeyEvent *)ev, w);
}
static Bool
_XimProtoKeyreleaseFilter(
Xic ic,
- XKeyEvent *ev)
+ XKeyEvent *ev,
+ Window w)
{
Xim im = (Xim)ic->core.im;
@@ -208,6 +213,9 @@ _XimProtoKeyreleaseFilter(
_XimUnfabricateSerial(im, ev);
return NOTFILTERD;
}
+ /* w=0 is used for _XimIsFabricatedSerial() only */
+ if (!w)
+ return NOTFILTERD;
if (IS_NEGLECT_EVENT(ic, KeyReleaseMask))
return FILTERD;
@@ -254,7 +262,7 @@ _XimFilterKeyrelease(
XEvent *ev,
XPointer client_data)
{
- return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev);
+ return _XimProtoKeyreleaseFilter((Xic)client_data, (XKeyEvent *)ev, w);
}
static void
@@ -263,6 +271,11 @@ _XimRegisterKeyPressFilter(
{
if (ic->core.focus_window) {
if (!(ic->private.proto.registed_filter_event & KEYPRESS_MASK)) {
+ _XRegisterFilterByType (ic->core.im->core.display,
+ 0,
+ KeyPress, KeyPress,
+ _XimFilterKeypress,
+ (XPointer)ic);
_XRegisterFilterByType (ic->core.im->core.display,
ic->core.focus_window,
KeyPress, KeyPress,
@@ -280,6 +293,11 @@ _XimRegisterKeyReleaseFilter(
{
if (ic->core.focus_window) {
if (!(ic->private.proto.registed_filter_event & KEYRELEASE_MASK)) {
+ _XRegisterFilterByType (ic->core.im->core.display,
+ 0,
+ KeyRelease, KeyRelease,
+ _XimFilterKeyrelease,
+ (XPointer)ic);
_XRegisterFilterByType (ic->core.im->core.display,
ic->core.focus_window,
KeyRelease, KeyRelease,
@@ -301,6 +319,10 @@ _XimUnregisterKeyPressFilter(
ic->core.focus_window,
_XimFilterKeypress,
(XPointer)ic);
+ _XUnregisterFilter (ic->core.im->core.display,
+ 0,
+ _XimFilterKeypress,
+ (XPointer)ic);
ic->private.proto.registed_filter_event &= ~KEYPRESS_MASK;
}
}
@@ -317,6 +339,10 @@ _XimUnregisterKeyReleaseFilter(
ic->core.focus_window,
_XimFilterKeyrelease,
(XPointer)ic);
+ _XUnregisterFilter (ic->core.im->core.display,
+ 0,
+ _XimFilterKeyrelease,
+ (XPointer)ic);
ic->private.proto.registed_filter_event &= ~KEYRELEASE_MASK;
}
}
diff --git a/src/FilterEv.c b/src/FilterEv.c
index 0a48e548..07845bcc 100644
--- a/src/FilterEv.c
+++ b/src/FilterEv.c
@@ -100,6 +100,31 @@ XFilterEvent(
}
}
}
+ for (p = ev->xany.display->im_filters; p != NULL; p = p->next) {
+ /* Java sometimes calls XFilterEvent() with window=0 and ev come from
+ * XNextEvent() when users type some keys quickly and switch multiple
+ * input focuses in a Java window with the keys.
+ * But XKeyEvent filters need to receive the event with window=0 for
+ * _XimPendingFilter() and _XimUnfabricateSerial() to clear the
+ * fowarded XKeyEvent with XIM_FORWARD_EVENT.
+ *
+ * The case of p->window == 0 is checkekd after all cases of p->window
+ * != 0 are checked because all input contexts share
+ * Display->im_filters but each input context has
+ * Xic->private.proto.registed_filter_event for the filters
+ * and same p->filter could be registerd to Display->im_filters twice
+ * with different p->window.
+ */
+ if (p->window == 0 && window == 0) {
+ if ((mask & p->event_mask) ||
+ (ev->type >= p->start_type && ev->type <= p->end_type)) {
+ UnlockDisplay(ev->xany.display);
+ ret = (*(p->filter))(ev->xany.display, p->window, ev,
+ p->client_data);
+ return(ret);
+ }
+ }
+ }
UnlockDisplay(ev->xany.display);
#endif
return(False);
--
2.47.1

82
0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch Normal file
View File

@ -0,0 +1,82 @@
From 546a51348322d83a57fd9b8c1e42b44fbe970368 Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 01:29:34 +0900
Subject: [PATCH libX11 6/7] ximcp: Unmark fabricated with serial 0 and Xic
commit_info
GTK2 XIM resets the XKeyEvent serial to 0 even if _XimCommitRecv()
sets the serial so now checks if the events are sent with
Xic->private.proto.commit_info.
Closes: !246
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 898746f9b1fb384d6d24ed827c836ec8a0b3da3b)
---
modules/im/ximcp/imDefFlt.c | 4 ++--
modules/im/ximcp/imDefLkup.c | 12 +++++++++++-
src/xlibi18n/XimintP.h | 1 +
3 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/modules/im/ximcp/imDefFlt.c b/modules/im/ximcp/imDefFlt.c
index 76d63e88..3dfbf8cd 100644
--- a/modules/im/ximcp/imDefFlt.c
+++ b/modules/im/ximcp/imDefFlt.c
@@ -145,7 +145,7 @@ _XimProtoKeypressFilter(
if ((ev->keycode == 0) || _XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev);
+ _XimUnfabricateSerial(im, ic, ev);
return NOTFILTERD;
}
/* w=0 is used for _XimIsFabricatedSerial() only */
@@ -210,7 +210,7 @@ _XimProtoKeyreleaseFilter(
if (_XimIsFabricatedSerial(im, ev)) {
_XimPendingFilter(ic);
- _XimUnfabricateSerial(im, ev);
+ _XimUnfabricateSerial(im, ic, ev);
return NOTFILTERD;
}
/* w=0 is used for _XimIsFabricatedSerial() only */
diff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c
index 6b2d27dc..326339fe 100644
--- a/modules/im/ximcp/imDefLkup.c
+++ b/modules/im/ximcp/imDefLkup.c
@@ -377,10 +377,20 @@ _XimFabricateSerial(
Bool
_XimUnfabricateSerial(
Xim im,
+ Xic ic,
XKeyEvent *event)
{
+ if (!im->private.proto.enable_fabricated_order) {
+ UNMARK_FABRICATED(im);
+ return True;
+ }
/* GTK2 XIM module sets serial=0. */
- if (!event->serial || !im->private.proto.enable_fabricated_order) {
+ if (!event->serial) {
+ /* _XimCommitRecv() sets event->serial and call _XimFabricateSerial()
+ * but GTK2 XIM always reset event->serial=0 with XFilterEvent().
+ */
+ if (ic && ic->private.proto.commit_info)
+ im->private.proto.fabricated_serial = 0;
UNMARK_FABRICATED(im);
return True;
}
diff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h
index 715800c7..fe52231e 100644
--- a/src/xlibi18n/XimintP.h
+++ b/src/xlibi18n/XimintP.h
@@ -319,6 +319,7 @@ _XimFabricateSerial(
Bool
_XimUnfabricateSerial(
Xim im,
+ Xic ic,
XKeyEvent *event);
Bool
--
2.47.1

58
0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch Normal file
View File

@ -0,0 +1,58 @@
From 9abd669f8826909a715e9b19531fd687800ce44c Mon Sep 17 00:00:00 2001
From: Takao Fujiwara <tfujiwar@redhat.com>
Date: Fri, 26 Apr 2024 01:29:39 +0900
Subject: [PATCH libX11 7/7] imDefIm: Add LIBX11_ENABLE_FABRICATED_ORDER env
If an XIM application does not return the XKeyEvent from XNextEvent()
to XFilterEvent(), a timeout is reached and the behavior is fallen
back to the previous one with a warning messsage and we can ask
the application to send the XKeyEvent to XFilterEvent() but also
libX11 provides LIBX11_ENABLE_FABRICATED_ORDER environment variable.
If the application runs with LIBX11_ENABLE_FABRICATED_ORDER=0, the
previous behavior is available until the application is fixed.
Closes: !246
Part-of: <https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/246>
(cherry picked from commit 90b8fc65da1e773b0091a50be46b23609591e8b7)
---
modules/im/ximcp/imDefIm.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c
index 7eba0b34..f42aa92c 100644
--- a/modules/im/ximcp/imDefIm.c
+++ b/modules/im/ximcp/imDefIm.c
@@ -63,6 +63,8 @@ PERFORMANCE OF THIS SOFTWARE.
#include "Ximint.h"
#include <limits.h>
+#include <stdlib.h>
+#include <strings.h>
int
_XimCheckDataSize(
@@ -400,6 +402,7 @@ _XimPreConnect(
Atom *atoms;
Window im_window = 0;
register int i;
+ const char *env_enable_fabricated_order;
if((imserver = XInternAtom(display, XIM_SERVERS, True)) == (Atom)None)
return False;
@@ -433,6 +436,13 @@ _XimPreConnect(
im->private.proto.fabricated_serial = 0;
im->private.proto.fabricated_time = 0;
im->private.proto.enable_fabricated_order = True;
+ env_enable_fabricated_order = getenv("LIBX11_ENABLE_FABRICATED_ORDER");
+ if (env_enable_fabricated_order && *env_enable_fabricated_order) {
+ if (!strncasecmp(env_enable_fabricated_order, "0", 2) ||
+ !strncasecmp(env_enable_fabricated_order, "false", 6)) {
+ im->private.proto.enable_fabricated_order = False;
+ }
+ }
return True;
}
--
2.47.1

166
SOURCES/0001-Avoid-recursing-through-_XError-due-to-sequence-adju.patch
View File

@ -1,166 +0,0 @@
From 8c92ef59890c6d6e2be456658d3b9c145eda8629 Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@keithp.com>
Date: Sat, 7 Nov 2020 22:22:47 -0800
Subject: [PATCH libX11] Avoid recursing through _XError due to sequence
adjustment
This patch is based on research done by Dmitry Osipenko to uncover the
cause of a large class of Xlib lockups.
_XError must unlock and re-lock the display around the call to the
user error handler function. When re-locking the display, two
functions are called to ensure that the display is ready to generate a request:
_XIDHandler(dpy);
_XSeqSyncFunction(dpy);
The first ensures that there is at least one XID available to use
(possibly calling _xcb_generate_id to do so). The second makes sure a
reply is received at least every 65535 requests to keep sequence
numbers in sync (possibly generating a GetInputFocus request and
synchronously awaiting the reply).
If the second of these does generate a GetInputFocus request and wait
for the reply, then a pending error will cause recursion into _XError,
which deadlocks the display.
One seemingly easy fix is to have _XError avoid those calls by
invoking InternalLockDisplay instead of LockDisplay. That function
does everything that LockDisplay does *except* call those final two
functions which may end up receiving an error.
However, that doesn't protect the system from applications which call
some legal Xlib function from within their error handler. Any Xlib
function which cannot generate protocol or wait for events is valid,
including many which invoke LockDisplay.
What we need to do is make LockDisplay skip these two function calls
precisely when it is called from within the _XError context for the
same display.
This patch accomplishes this by creating a list of threads in the
display which are in _XError, and then having LockDisplay check the
current thread against those list elements.
Inspired-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Tested-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
(cherry picked from commit 30ccef3a48029bf4fc31d4abda2d2778d0ad6277)
---
include/X11/Xlibint.h | 2 ++
src/OpenDis.c | 1 +
src/XlibInt.c | 10 ++++++++++
src/locking.c | 12 ++++++++++++
src/locking.h | 12 ++++++++++++
5 files changed, 37 insertions(+)
diff --git a/include/X11/Xlibint.h b/include/X11/Xlibint.h
index 6b95bcf7..09078e3f 100644
--- a/include/X11/Xlibint.h
+++ b/include/X11/Xlibint.h
@@ -202,6 +202,8 @@ struct _XDisplay
unsigned long last_request_read_upper32bit;
unsigned long request_upper32bit;
#endif
+
+ struct _XErrorThreadInfo *error_threads;
};
#define XAllocIDs(dpy,ids,n) (*(dpy)->idlist_alloc)(dpy,ids,n)
diff --git a/src/OpenDis.c b/src/OpenDis.c
index 82723578..85901168 100644
--- a/src/OpenDis.c
+++ b/src/OpenDis.c
@@ -201,6 +201,7 @@ XOpenDisplay (
X_DPY_SET_LAST_REQUEST_READ(dpy, 0);
dpy->default_screen = iscreen; /* Value returned by ConnectDisplay */
dpy->last_req = (char *)&_dummy_request;
+ dpy->error_threads = NULL;
/* Initialize the display lock */
if (InitDisplayLock(dpy) != 0) {
diff --git a/src/XlibInt.c b/src/XlibInt.c
index 4e45e62b..8771b791 100644
--- a/src/XlibInt.c
+++ b/src/XlibInt.c
@@ -1482,6 +1482,11 @@ int _XError (
if (_XErrorFunction != NULL) {
int rtn_val;
#ifdef XTHREADS
+ struct _XErrorThreadInfo thread_info = {
+ .error_thread = xthread_self(),
+ .next = dpy->error_threads
+ }, **prev;
+ dpy->error_threads = &thread_info;
if (dpy->lock)
(*dpy->lock->user_lock_display)(dpy);
UnlockDisplay(dpy);
@@ -1491,6 +1496,11 @@ int _XError (
LockDisplay(dpy);
if (dpy->lock)
(*dpy->lock->user_unlock_display)(dpy);
+
+ /* unlink thread_info from the list */
+ for (prev = &dpy->error_threads; *prev != &thread_info; prev = &(*prev)->next)
+ ;
+ *prev = thread_info.next;
#endif
return rtn_val;
} else {
diff --git a/src/locking.c b/src/locking.c
index 9f4fe067..bcadc857 100644
--- a/src/locking.c
+++ b/src/locking.c
@@ -453,6 +453,9 @@ static void _XLockDisplay(
XTHREADS_FILE_LINE_ARGS
)
{
+#ifdef XTHREADS
+ struct _XErrorThreadInfo *ti;
+#endif
#ifdef XTHREADS_WARN
_XLockDisplayWarn(dpy, file, line);
#else
@@ -460,6 +463,15 @@ static void _XLockDisplay(
#endif
if (dpy->lock->locking_level > 0)
_XDisplayLockWait(dpy);
+#ifdef XTHREADS
+ /*
+ * Skip the two function calls below which may generate requests
+ * when LockDisplay is called from within _XError.
+ */
+ for (ti = dpy->error_threads; ti; ti = ti->next)
+ if (ti->error_thread == xthread_self())
+ return;
+#endif
_XIDHandler(dpy);
_XSeqSyncFunction(dpy);
}
diff --git a/src/locking.h b/src/locking.h
index 5251a60c..59fc866e 100644
--- a/src/locking.h
+++ b/src/locking.h
@@ -149,6 +149,18 @@ typedef struct _LockInfoRec {
xmutex_t lock;
} LockInfoRec;
+/* A list of threads currently invoking error handlers on this display
+ * LockDisplay operates differently for these threads, avoiding
+ * generating any requests or reading any events as that can cause
+ * recursion into the error handling code, which will deadlock the
+ * thread.
+ */
+struct _XErrorThreadInfo
+{
+ struct _XErrorThreadInfo *next;
+ xthread_t error_thread;
+};
+
/* XOpenDis.c */
extern int (*_XInitDisplayLock_fn)(Display *dpy);
extern void (*_XFreeDisplayLock_fn)(Display *dpy);
--
2.43.0

64
SOURCES/0001-Fix-XTS-regression-in-XCopyColormapAndFree.patch
View File

@ -1,64 +0,0 @@
From a515545065ce6e1924de4bc50aaae7ec9b48cfad Mon Sep 17 00:00:00 2001
From: Adam Jackson <ajax@redhat.com>
Date: Wed, 11 Dec 2019 11:53:11 -0500
Subject: [PATCH libX11] Fix XTS regression in XCopyColormapAndFree
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
XCopyColormapAndFree/5 threw an assertion:
520|4 5 00014017 1 2|Assertion XCopyColormapAndFree-5.(A)
520|4 5 00014017 1 3|When a colourmap argument does not name a valid colourmap,
520|4 5 00014017 1 4|then a BadColor error occurs.
520|4 5 00014017 1 5|METH: Create a bad colourmap by creating and freeing a colourmap.
520|4 5 00014017 1 6|METH: Call test function using bad colourmap as the colourmap argument.
520|4 5 00014017 1 7|METH: Verify that a BadColor error occurs.
520|4 5 00014017 1 8|unexpected signal 6 (SIGABRT) received
220|4 5 2 15:05:53|UNRESOLVED
410|4 5 1 15:05:53|IC End
510|4|system 0: Abandoning testset: caught unexpected signal 11 (SIGSEGV)
More specifically:
lt-XCopyColormapAndFree: xcb_io.c:533: _XAllocID: Assertion `ret != inval_id' failed.
This bug was introduced (by following my advice, d'oh) in:
commit 99a2cf1aa0b58391078d5d3edf0a7dab18c7745d
Author: Tapani Pälli <tapani.palli@intel.com>
Date: Mon May 13 08:29:49 2019 +0300
Protect colormap add/removal with display lock
In that patch we moved the call to _XcmsCopyCmapRecAndFree inside the
display lock. The problem is said routine has side effects, including
trying to implicitly create a colormap in some cases. Since we don't run
the XID handler until SyncHandle() we would see inconsistent internal
xlib state, triggering the above assert.
Fix this by dropping and re-taking the display lock before calling into
XCMS.
---
src/CopyCmap.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/CopyCmap.c b/src/CopyCmap.c
index b4954b01..b37aba73 100644
--- a/src/CopyCmap.c
+++ b/src/CopyCmap.c
@@ -53,6 +53,11 @@ Colormap XCopyColormapAndFree(
mid = req->mid = XAllocID(dpy);
req->srcCmap = src_cmap;
+ /* re-lock the display to keep XID handling in sync */
+ UnlockDisplay(dpy);
+ SyncHandle();
+ LockDisplay(dpy);
+
#if XCMS
_XcmsCopyCmapRecAndFree(dpy, src_cmap, mid);
#endif
--
2.23.0

37
SOURCES/0001-Fix-an-integer-overflow-in-init_om.patch
View File

@ -1,37 +0,0 @@
From 2c67fab8415a1d32395de87f056bc5f3b37fedb0 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Thu, 13 Aug 2020 18:02:58 +0200
Subject: [PATCH] Fix an integer overflow in init_om()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
CVE-2020-14363
This can lead to a double free later, as reported by Jayden Rivers.
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit acdaaadcb3d85c61fd43669fc5dddf0f8c3f911d)
Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
---
modules/om/generic/omGeneric.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/modules/om/generic/omGeneric.c b/modules/om/generic/omGeneric.c
index 22f826ec..bcfb9ab8 100644
--- a/modules/om/generic/omGeneric.c
+++ b/modules/om/generic/omGeneric.c
@@ -1908,7 +1908,8 @@ init_om(
char **required_list;
XOrientation *orientation;
char **value, buf[BUFSIZ], *bufptr;
- int count = 0, num = 0, length = 0;
+ int count = 0, num = 0;
+ unsigned int length = 0;
_XlcGetResource(lcd, "XLC_FONTSET", "on_demand_loading", &value, &count);
if (count > 0 && _XlcCompareISOLatin1(*value, "True") == 0)
--
2.28.0

63
SOURCES/0001-Fix-poll_for_response-race-condition.patch
View File

@ -1,63 +0,0 @@
From 77f8517710a724fa1f29de8ad806692782f962bd Mon Sep 17 00:00:00 2001
From: Frediano Ziglio <fziglio@redhat.com>
Date: Wed, 29 Jan 2020 09:06:54 +0000
Subject: [PATCH libX11] Fix poll_for_response race condition
In poll_for_response is it possible that event replies are skipped
and a more up to date message reply is returned.
This will cause next poll_for_event call to fail aborting the program.
This was proved using some slow ssh tunnel or using some program
to slow down server replies (I used a combination of xtrace and strace).
How the race happens:
- program enters into poll_for_response;
- poll_for_event is called but the server didn't still send the reply;
- pending_requests is not NULL because we send a request (see call
to append_pending_request in _XSend);
- xcb_poll_for_reply64 is called from poll_for_response;
- xcb_poll_for_reply64 will read from server, at this point
server reply with an event (say sequence N) and the reply to our
last request (say sequence N+1);
- xcb_poll_for_reply64 returns the reply for the request we asked;
- last_request_read is set to N+1 sequence in poll_for_response;
- poll_for_response returns the response to the request;
- poll_for_event is called (for instance from another poll_for_response);
- event with sequence N is retrieved;
- the N sequence is widen, however, as the "new" number computed from
last_request_read is less than N the number is widened to N + 2^32
(assuming last_request_read is still contained in 32 bit);
- poll_for_event enters the nested if statement as req is NULL;
- we compare the widen N (which now does not fit into 32 bit) with
request (which fits into 32 bit) hitting the throw_thread_fail_assert.
I propose to change the widen to not go too far from the wide number
instead of supposing the result is always bigger than the wide number
passed.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
---
src/xcb_io.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/src/xcb_io.c b/src/xcb_io.c
index 6a12d150..2aacbda3 100644
--- a/src/xcb_io.c
+++ b/src/xcb_io.c
@@ -201,12 +201,10 @@ static int handle_error(Display *dpy, xError *err, Bool in_XReply)
}
/* Widen a 32-bit sequence number into a 64bit (uint64_t) sequence number.
- * Treating the comparison as a 1 and shifting it avoids a conditional branch.
*/
static void widen(uint64_t *wide, unsigned int narrow)
{
- uint64_t new = (*wide & ~((uint64_t)0xFFFFFFFFUL)) | narrow;
- *wide = new + (((uint64_t)(new < *wide)) << 32);
+ *wide += (int32_t) (narrow - *wide);
}
/* Thread-safety rules:
--
2.23.0

411
SOURCES/CVE-2021-31535.patch
View File

@ -1,411 +0,0 @@
From 2714e4478c1262c94de6295cce605c14572968d3 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Fri, 19 Feb 2021 15:30:39 +0100
Subject: [PATCH libX11] Reject string longer than USHRT_MAX before sending
them on the wire
The X protocol uses CARD16 values to represent the length so
this would overflow.
CVE-2021-31535
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
[mustard: backported 10 1.6.8 by merging the warning fixes from
upstream commimt 84427130 first - ajax]
---
src/Font.c | 10 ++++++----
src/FontInfo.c | 5 ++++-
src/FontNames.c | 5 ++++-
src/GetColor.c | 6 +++++-
src/LoadFont.c | 6 +++++-
src/LookupCol.c | 6 ++++--
src/ParseCol.c | 7 +++++--
src/QuExt.c | 7 ++++++-
src/SetFPath.c | 12 +++++++++---
src/SetHints.c | 9 ++++++++-
src/StNColor.c | 5 ++++-
src/StName.c | 11 ++++++++---
12 files changed, 68 insertions(+), 21 deletions(-)
diff --git a/src/Font.c b/src/Font.c
index 09d2ae91..1cd89cca 100644
--- a/src/Font.c
+++ b/src/Font.c
@@ -102,12 +102,14 @@ XFontStruct *XLoadQueryFont(
XF86BigfontCodes *extcodes = _XF86BigfontCodes(dpy);
#endif
+ if (strlen(name) >= USHRT_MAX)
+ return NULL;
if (_XF86LoadQueryLocaleFont(dpy, name, &font_result, (Font *)0))
return font_result;
LockDisplay(dpy);
GetReq(OpenFont, req);
seq = dpy->request; /* Can't use extended sequence number here */
- nbytes = req->nbytes = name ? strlen(name) : 0;
+ nbytes = req->nbytes = (CARD16) (name ? strlen(name) : 0);
req->fid = fid = XAllocID(dpy);
req->length += (nbytes+3)>>2;
Data (dpy, name, nbytes);
@@ -662,8 +664,8 @@ int _XF86LoadQueryLocaleFont(
if (!name)
return 0;
- l = strlen(name);
- if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-')
+ l = (int) strlen(name);
+ if (l < 2 || name[l - 1] != '*' || name[l - 2] != '-' || l >= USHRT_MAX)
return 0;
charset = NULL;
/* next three lines stolen from _XkbGetCharset() */
@@ -679,7 +681,7 @@ int _XF86LoadQueryLocaleFont(
return 0;
if (_XlcNCompareISOLatin1(name + l - 2 - (p - charset), charset, p - charset))
return 0;
- if (strlen(p + 1) + l - 1 >= sizeof(buf) - 1)
+ if (strlen(p + 1) + (size_t) l - 1 >= sizeof(buf) - 1)
return 0;
strcpy(buf, name);
strcpy(buf + l - 1, p + 1);
diff --git a/src/FontInfo.c b/src/FontInfo.c
index f870e431..6644b3fa 100644
--- a/src/FontInfo.c
+++ b/src/FontInfo.c
@@ -58,10 +58,13 @@ XFontStruct **info) /* RETURN */
register xListFontsReq *req;
int j;
+ if (strlen(pattern) >= USHRT_MAX)
+ return NULL;
+
LockDisplay(dpy);
GetReq(ListFontsWithInfo, req);
req->maxNames = maxNames;
- nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+ nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
req->length += (nbytes + 3) >> 2;
_XSend (dpy, pattern, nbytes);
/* use _XSend instead of Data, since subsequent _XReply will flush buffer */
diff --git a/src/FontNames.c b/src/FontNames.c
index b78792d6..458d80c9 100644
--- a/src/FontNames.c
+++ b/src/FontNames.c
@@ -51,10 +51,13 @@ int *actualCount) /* RETURN */
register xListFontsReq *req;
unsigned long rlen = 0;
+ if (strlen(pattern) >= USHRT_MAX)
+ return NULL;
+
LockDisplay(dpy);
GetReq(ListFonts, req);
req->maxNames = maxNames;
- nbytes = req->nbytes = pattern ? strlen (pattern) : 0;
+ nbytes = req->nbytes = pattern ? (CARD16) strlen (pattern) : 0;
req->length += (nbytes + 3) >> 2;
_XSend (dpy, pattern, nbytes);
/* use _XSend instead of Data, since following _XReply will flush buffer */
diff --git a/src/GetColor.c b/src/GetColor.c
index cd0eb9f6..c8178067 100644
--- a/src/GetColor.c
+++ b/src/GetColor.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -48,6 +49,9 @@ XColor *exact_def) /* RETURN */
XcmsColor cmsColor_exact;
Status ret;
+ if (strlen(colorname) >= USHRT_MAX)
+ return (0);
+
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
@@ -83,7 +87,7 @@ XColor *exact_def) /* RETURN */
GetReq(AllocNamedColor, req);
req->cmap = cmap;
- nbytes = req->nbytes = strlen(colorname);
+ nbytes = req->nbytes = (CARD16) strlen(colorname);
req->length += (nbytes + 3) >> 2; /* round up to mult of 4 */
_XSend(dpy, colorname, nbytes);
diff --git a/src/LoadFont.c b/src/LoadFont.c
index f547976b..3996436f 100644
--- a/src/LoadFont.c
+++ b/src/LoadFont.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include "Xlibint.h"
Font
@@ -38,12 +39,15 @@ XLoadFont (
Font fid;
register xOpenFontReq *req;
+ if (strlen(name) >= USHRT_MAX)
+ return (0);
+
if (_XF86LoadQueryLocaleFont(dpy, name, (XFontStruct **)0, &fid))
return fid;
LockDisplay(dpy);
GetReq(OpenFont, req);
- nbytes = req->nbytes = name ? strlen(name) : 0;
+ nbytes = req->nbytes = name ? (CARD16) strlen(name) : 0;
req->fid = fid = XAllocID(dpy);
req->length += (nbytes+3)>>2;
Data (dpy, name, nbytes);
diff --git a/src/LookupCol.c b/src/LookupCol.c
index f7f969f5..cd9b1368 100644
--- a/src/LookupCol.c
+++ b/src/LookupCol.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,6 +47,9 @@ XLookupColor (
XcmsCCC ccc;
XcmsColor cmsColor_exact;
+ n = (int) strlen (spec);
+ if (n >= USHRT_MAX)
+ return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms and i18n approach to Parse Color
@@ -77,8 +81,6 @@ XLookupColor (
* Xcms and i18n methods failed, so lets pass it to the server
* for parsing.
*/
-
- n = strlen (spec);
LockDisplay(dpy);
GetReq (LookupColor, req);
req->cmap = cmap;
diff --git a/src/ParseCol.c b/src/ParseCol.c
index e997b1b8..7a84a17b 100644
--- a/src/ParseCol.c
+++ b/src/ParseCol.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,7 +47,9 @@ XParseColor (
XcmsColor cmsColor;
if (!spec) return(0);
- n = strlen (spec);
+ n = (int) strlen (spec);
+ if (n >= USHRT_MAX)
+ return(0);
if (*spec == '#') {
/*
* RGB
@@ -119,7 +122,7 @@ XParseColor (
LockDisplay(dpy);
GetReq (LookupColor, req);
req->cmap = cmap;
- req->nbytes = n = strlen(spec);
+ req->nbytes = (CARD16) (n = (int) strlen(spec));
req->length += (n + 3) >> 2;
Data (dpy, spec, (long)n);
if (!_XReply (dpy, (xReply *) &reply, 0, xTrue)) {
diff --git a/src/QuExt.c b/src/QuExt.c
index 4e230e77..4cb99fcf 100644
--- a/src/QuExt.c
+++ b/src/QuExt.c
@@ -27,6 +27,8 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
+#include <stdbool.h>
#include "Xlibint.h"
Bool
@@ -40,9 +42,12 @@ XQueryExtension(
xQueryExtensionReply rep;
register xQueryExtensionReq *req;
+ if (strlen(name) >= USHRT_MAX)
+ return false;
+
LockDisplay(dpy);
GetReq(QueryExtension, req);
- req->nbytes = name ? strlen(name) : 0;
+ req->nbytes = name ? (CARD16) strlen(name) : 0;
req->length += (req->nbytes+(unsigned)3)>>2;
_XSend(dpy, name, (long)req->nbytes);
(void) _XReply (dpy, (xReply *)&rep, 0, xTrue);
diff --git a/src/SetFPath.c b/src/SetFPath.c
index 60aaef01..13fce49e 100644
--- a/src/SetFPath.c
+++ b/src/SetFPath.c
@@ -26,6 +26,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
+#include <limits.h>
#endif
#include "Xlibint.h"
@@ -48,7 +49,12 @@ XSetFontPath (
GetReq (SetFontPath, req);
req->nFonts = ndirs;
for (i = 0; i < ndirs; i++) {
- n += safestrlen (directories[i]) + 1;
+ n = (int) ((size_t) n + (safestrlen (directories[i]) + 1));
+ if (n >= USHRT_MAX) {
+ UnlockDisplay(dpy);
+ SyncHandle();
+ return 0;
+ }
}
nbytes = (n + 3) & ~3;
req->length += nbytes >> 2;
@@ -59,9 +65,9 @@ XSetFontPath (
char *tmp = p;
for (i = 0; i < ndirs; i++) {
- register int length = safestrlen (directories[i]);
+ register int length = (int) safestrlen (directories[i]);
*p = length;
- memcpy (p + 1, directories[i], length);
+ memcpy (p + 1, directories[i], (size_t)length);
p += length + 1;
}
Data (dpy, tmp, nbytes);
diff --git a/src/SetHints.c b/src/SetHints.c
index bc46498a..61cb0684 100644
--- a/src/SetHints.c
+++ b/src/SetHints.c
@@ -49,6 +49,7 @@ SOFTWARE.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xutil.h>
#include "Xatomtype.h"
@@ -214,6 +215,8 @@ XSetCommand (
register char *buf, *bp;
for (i = 0, nbytes = 0; i < argc; i++) {
nbytes += safestrlen(argv[i]) + 1;
+ if (nbytes >= USHRT_MAX)
+ return 1;
}
if ((bp = buf = Xmalloc(nbytes))) {
/* copy arguments into single buffer */
@@ -256,11 +259,13 @@ XSetStandardProperties (
if (name != NULL) XStoreName (dpy, w, name);
+ if (safestrlen(icon_string) >= USHRT_MAX)
+ return 1;
if (icon_string != NULL) {
XChangeProperty (dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace,
(_Xconst unsigned char *)icon_string,
- safestrlen(icon_string));
+ (int)safestrlen(icon_string));
}
if (icon_pixmap != None) {
@@ -298,6 +303,8 @@ XSetClassHint(
len_nm = safestrlen(classhint->res_name);
len_cl = safestrlen(classhint->res_class);
+ if (len_nm + len_cl >= USHRT_MAX)
+ return 1;
if ((class_string = s = Xmalloc(len_nm + len_cl + 2))) {
if (len_nm) {
strcpy(s, classhint->res_name);
diff --git a/src/StNColor.c b/src/StNColor.c
index 8b821c3e..16dc9cbc 100644
--- a/src/StNColor.c
+++ b/src/StNColor.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <stdio.h>
#include "Xlibint.h"
#include "Xcmsint.h"
@@ -46,6 +47,8 @@ int flags) /* DoRed, DoGreen, DoBlue */
XcmsColor cmsColor_exact;
XColor scr_def;
+ if (strlen(name) >= USHRT_MAX)
+ return 0;
#ifdef XCMS
/*
* Let's Attempt to use Xcms approach to Parse Color
@@ -76,7 +79,7 @@ int flags) /* DoRed, DoGreen, DoBlue */
req->cmap = cmap;
req->flags = flags;
req->pixel = pixel;
- req->nbytes = nbytes = strlen(name);
+ req->nbytes = (CARD16) (nbytes = (unsigned) strlen(name));
req->length += (nbytes + 3) >> 2; /* round up to multiple of 4 */
Data(dpy, name, (long)nbytes);
UnlockDisplay(dpy);
diff --git a/src/StName.c b/src/StName.c
index b4048bff..04bb3aa6 100644
--- a/src/StName.c
+++ b/src/StName.c
@@ -27,6 +27,7 @@ in this Software without prior written authorization from The Open Group.
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
+#include <limits.h>
#include <X11/Xlibint.h>
#include <X11/Xatom.h>
@@ -36,9 +37,11 @@ XStoreName (
Window w,
_Xconst char *name)
{
- return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING,
+ if (strlen(name) >= USHRT_MAX)
+ return 0;
+ return XChangeProperty(dpy, w, XA_WM_NAME, XA_STRING, /* */
8, PropModeReplace, (_Xconst unsigned char *)name,
- name ? strlen(name) : 0);
+ name ? (int) strlen(name) : 0);
}
int
@@ -47,7 +50,9 @@ XSetIconName (
Window w,
_Xconst char *icon_name)
{
+ if (strlen(icon_name) >= USHRT_MAX)
+ return 0;
return XChangeProperty(dpy, w, XA_WM_ICON_NAME, XA_STRING, 8,
PropModeReplace, (_Xconst unsigned char *)icon_name,
- icon_name ? strlen(icon_name) : 0);
+ icon_name ? (int) strlen(icon_name) : 0);
}
--
2.30.1

1
commitid Normal file
View File

@ -0,0 +1 @@
a3bdd2b090915fe0163b062f0e6576fe05dd332e

0
SOURCES/dont-forward-keycode-0.patch → dont-forward-keycode-0.patch
View File

6
gating.yaml Normal file
View File

@ -0,0 +1,6 @@
--- !Policy
product_versions:
- rhel-9
decision_context: osci_compose_gate
rules:
- !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional}

141
SPECS/libX11.spec → libX11.spec
View File

@ -4,10 +4,9 @@
Summary: Core X11 protocol client library
Name: libX11
Version: 1.6.8
Release: 9%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
Version: 1.7.0
Release: 11%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
License: MIT
Group: System Environment/Libraries
URL: http://www.x.org
%if 0%{?gitdate}
@ -19,32 +18,34 @@ Source0: https://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.
%endif
Patch2: dont-forward-keycode-0.patch
Patch3: 0001-Fix-XTS-regression-in-XCopyColormapAndFree.patch
Patch4: 0001-Fix-poll_for_response-race-condition.patch
# CVE-2020-14363
Patch5: 0001-Fix-an-integer-overflow-in-init_om.patch
Patch6: CVE-2021-31535.patch
Patch3: 0001-makekeys-handle-the-new-_EVDEVK-xorgproto-symbols.patch
# CVE-2023-3138
Patch7: 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
Patch4: 0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
# CVE-2023-43785
Patch8: 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
Patch5: 0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
# CVE-2023-43786
Patch9: 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
Patch10: 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
Patch11: 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
Patch6: 0001-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
Patch7: 0002-XPutImage-clip-images-to-maximum-height-width-allowe.patch
Patch8: 0003-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
# CVE-2023-43787
Patch12: 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
Patch9: 0001-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
# RHEL-23452
Patch13: 0001-Avoid-recursing-through-_XError-due-to-sequence-adju.patch
# https://issues.redhat.com/browse/RHEL-58298
Patch10: 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
# https://issues.redhat.com/browse/RHEL-58444
Patch14: 0001-imDefLkup-verify-that-a-pointer-isn-t-NULL-before-us.patch
# https://issues.redhat.com/browse/RHEL-69791
Patch11: 0001-ximcp-Unmark-to-fabricate-key-events-with-XKeyEvent-.patch
Patch12: 0002-imDefLkup-Commit-first-info-in-XimCommitInfo.patch
Patch13: 0003-imDefLkup-Mark-and-unmark-fabricated-with-serial-0.patch
Patch14: 0004-ximcp-Add-fabricated_time-in-XimProtoPrivate-for-tim.patch
Patch15: 0005-Accept-anon-windows-in-XFilterEvent-to-update-XIM-st.patch
Patch16: 0006-ximcp-Unmark-fabricated-with-serial-0-and-Xic-commit.patch
Patch17: 0007-imDefIm-Add-LIBX11_ENABLE_FABRICATED_ORDER-env.patch
BuildRequires: make
BuildRequires: xorg-x11-util-macros >= 1.11
BuildRequires: pkgconfig(xproto) >= 7.0.15
BuildRequires: xorg-x11-xtrans-devel >= 1.0.3-4
@ -59,7 +60,6 @@ Core X11 protocol client library.
%package common
Summary: Common data for libX11
Group: System Environment/Libraries
BuildArch: noarch
%description common
@ -67,7 +67,6 @@ libX11 common data
%package devel
Summary: Development files for %{name}
Group: Development/Libraries
Requires: %{name} = %{version}-%{release}
Requires: %{name}-xcb = %{version}-%{release}
@ -76,27 +75,13 @@ X.Org X11 libX11 development package
%package xcb
Summary: XCB interop for libX11
Group: System Environment/Libraries
Conflicts: %{name} < %{version}-%{release}
%description xcb
libX11/libxcb interoperability library
%prep
%setup -q -n %{tarball}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}}
%patch2 -p1 -b .dont-forward-keycode-0
%patch3 -p1 -b .copycolormapandfree
%patch4 -p1 -b .race
%patch5 -p1 -b .fix-an-integer-overflow-in-init_om
%patch6 -p1 -b .cve-2021-31535
%patch7 -p1 -b .cve-2023-3138
%patch8 -p1 -b .cve-2023-43785
%patch9 -p1 -b .cve-2023-43786
%patch10 -p1 -b .xputimage-clip-images-to-maximum-height-width-allowe
%patch11 -p1 -b .xcreatepixmap-trigger-badvalue-error-for-out-of-rang
%patch12 -p1 -b .cve-2023-43787
%patch13 -p1 -b .rhel-23452
%patch14 -p1 -b .rhel-58444
%autosetup -p1 -n %{tarball}-%{?gitdate:%{gitdate}}%{!?gitdate:%{version}}
%build
autoreconf -v --install --force
@ -127,7 +112,7 @@ make %{?_smp_mflags} check
%files
%{_libdir}/libX11.so.6
%{_libdir}/libX11.so.6.3.0
%{_libdir}/libX11.so.6.4.0
%files xcb
%{_libdir}/libX11-xcb.so.1
@ -153,6 +138,7 @@ make %{?_smp_mflags} check
%{_includedir}/X11/Xresource.h
%{_includedir}/X11/Xutil.h
%{_includedir}/X11/cursorfont.h
%{_includedir}/X11/extensions/XKBgeom.h
%{_libdir}/libX11.so
%{_libdir}/libX11-xcb.so
%{_libdir}/pkgconfig/x11.pc
@ -161,39 +147,86 @@ make %{?_smp_mflags} check
%{_mandir}/man5/*.5*
%changelog
* Fri Sep 13 2024 José Expósito <jexposit@redhat.com> - 1.6.8-9
* Fri Dec 13 2024 Olivier Fourdan <ofourdan@redhat.com> - 1.7.0-11
- Backport fixes for XIM input sometimes jumbled (RHEL-69791)
* Fri Sep 13 2024 José Expósito <jexposit@redhat.com> - 1.7.0-10
- Backport NULL check to avoid a crash
Resolves: https://issues.redhat.com/browse/RHEL-58444
Resolves: https://issues.redhat.com/browse/RHEL-58298
* Tue Jan 30 2024 Olivier Fourdan <ofourdan@redhat.com> - 1.6.8-8
- Backport fix for Xlib lockups due to recursive XError (RHEL-23452)
* Wed Oct 11 2023 José Expósito <jexposit@redhat.com> - 1.6.8-7
* Wed Oct 11 2023 José Expósito <jexposit@redhat.com> - 1.7.0-9
- Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
- Fix CVE-2023-43786: stack exhaustion from infinite recursion in
PutSubImage()
- Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
a heap overflow
* Wed Jul 05 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.6.8-6
* Wed Jul 05 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.7.0-8
- CVE fix for: CVE-2023-3138
Resolve: rhbz#2213762
Resolve: rhbz#2213763
* Thu Aug 12 2021 Adam Jackson <ajax@redhat.com> - 1.6.8-5
- Fix CVE-2021-31535 (#1962439)
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.7.0-7
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
* Tue Nov 3 2020 Michel Dänzer <mdaenzer@redhat.com> - 1.6.8-4
- Fix CVE-2020-14363 (#1873923)
* Tue Aug 03 2021 Peter Hutterer <peter.hutterer@redhat.com> - 1.7.0-6
- Parse the EVDEVK keysyms (#1988944)
* Mon Feb 24 2020 Adam Jackson <ajax@redhat.com> - 1.6.8-3
- Fix race condition in poll_for_reponse
* Tue May 04 2021 Peter Hutterer <peter.hutterer@redhat.com> 1.7.0-5
- Rebuild to pick up the new xorgproto keysyms (#1954345)
* Fri Dec 13 2019 Adam Jackson <ajax@redhat.com> - 1.6.8-2
- Fix assertion on error in XCopyColormapAndFree
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.7.0-4
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
* Tue Nov 19 2019 Adam Jackson <ajax@redhat.com> - 1.6.8-1
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1.7.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
* Tue Dec 01 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.7.0-2
- libX11 1.7.0 (with the tarball this time)
* Tue Dec 01 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.7.0-1
- libX11 1.7.0
- switch to using the autosetup rpm macro
* Mon Nov 09 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.6.12-3
- Fix a race-condition in poll_for_response (#1758384)
* Thu Nov 5 11:12:56 AEST 2020 Peter Hutterer <peter.hutterer@redhat.com> - 1.6.12-2
- Add BuildRequires for make
* Wed Aug 26 2020 Peter Hutterer <peter.hutterer@redhat.com> 1.6.12-1
- libX11 1.6.12 (CVE-2020-14363, CVE 2020-14344)
* Fri Jul 31 2020 Adam Jackson <ajax@redhat.com> - 1.6.9-5
- Fix server reply validation issue in XIM (CVE 2020-14344)
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.9-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.9-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Wed Dec 11 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.6.9-2
- handle ssharp in XConvertCase
* Wed Oct 09 2019 Adam Jackson <ajax@redhat.com> - 1.6.9-1
- libX11 1.6.9
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.8-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Thu Jun 20 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.6.8-2
- rebuild to pick up the new xorgproto keysyms
* Thu Jun 20 2019 Peter Hutterer <peter.hutterer@redhat.com> 1.6.8-1
- libX11 1.6.8
* Thu Mar 21 2019 Adam Jackson <ajax@redhat.com> - 1.6.7-3
- Rebuild for xtrans 1.4.0
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.6.7-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Tue Oct 09 2018 Adam Jackson <ajax@redhat.com> - 1.6.7-1
- libX11 1.6.7

17
make-git-snapshot.sh Executable file
View File

@ -0,0 +1,17 @@
#!/bin/sh
DIRNAME=libX11-$( date +%Y%m%d )
rm -rf $DIRNAME
git clone git://git.freedesktop.org/git/xorg/lib/libX11 $DIRNAME
cd $DIRNAME
if [ -z "$1" ]; then
git log | head -1
else
git checkout $1
fi
git log | head -1 | awk '{ print $2 }' > ../commitid
git repack -a -d
cd ..
tar jcf $DIRNAME.tar.bz2 $DIRNAME
rm -rf $DIRNAME

1
sources Normal file
View File

@ -0,0 +1 @@
SHA512 (libX11-1.7.0.tar.bz2) = f661ca90350fd8a94f054b00f12f5122cea068ebff706acfd399462236c189a296a2358d17d16166635101cf56cc19303dd407873a159932d093c9f33556f9fb