Other security related fixes

Resolves: https://redhat.atlassian.net/browse/RHEL-183891
2026-06-12 13:04:28 +02:00 · 2026-06-12 13:04:28 +02:00 · 16a2beee3b
commit 16a2beee3b
parent 558fc5ded3
54 changed files with 2659 additions and 1 deletions
--- a/0001-dix-Silence-a-compiler-warning-in-doListFontsAndAlia.patch
+++ b/0001-dix-Silence-a-compiler-warning-in-doListFontsAndAlia.patch
@ -0,0 +1,45 @@
+From e710e570b1709d100072a8ab7d05c2aefaf41a1b Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 15 Jun 2026 14:00:19 +0200
+Subject: [PATCH xserver] dix: Silence a compiler warning in
+ doListFontsAndAliases()
+
+Compiler complains that "resolvedlen" might be uninitialized:
+
+| dix/dixfonts.c:559:5: var_decl: Declaring variable "resolvedlen" without initializer.
+| dix/dixfonts.c:674:17: uninit_use: Using uninitialized value "resolvedlen".
+|    672|                    * is complete.
+|    673|                    */
+|    674|->                 if (resolvedlen > XLFDMAXFONTNAMELEN) {
+|    675|                       err = BadFontName;
+|    676|                       goto ContBadFontName;
+
+Most likely a false positive, while immediately after the (newly added)
+test, there was a memcpy() using "resolvedlen" and the compiler did not
+choke on that before.
+
+Either way, initializing "resolvedlen" to 0 is a small price to pay to
+silence the compiler warning and keep us on the safe side.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2237>
+---
+ dix/dixfonts.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dix/dixfonts.c b/dix/dixfonts.c
+index 3c6c9d594..cf2b45d4f 100644
+--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
+@@ -556,7 +556,7 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
+     int err = Successful;
+     FontNamesPtr names = NULL;
+     char *name, *resolved = NULL;
+-    int namelen, resolvedlen;
+    int namelen, resolvedlen = 0;
+     int nnames;
+     int stringLens;
+     int i;
+-- 
+2.54.0
+
--- a/0001-os-avoid-potential-out-of-bounds-access-at-logVHdrMe.patch
+++ b/0001-os-avoid-potential-out-of-bounds-access-at-logVHdrMe.patch
@ -0,0 +1,40 @@
+From 5a3926455d74fe167af612ee11399c0f8cd896b5 Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
+Date: Wed, 17 Sep 2025 17:29:49 +0300
+Subject: [PATCH xserver 01/51] os: avoid potential out-of-bounds access at
+ logVHdrMessageVerb
+
+The LogVHdrMessageVerb function may access an array out of bounds in a
+specific edge case. Specifically, the line:
+
+newline = (buf[len - 1] == '\n');
+
+can result in accessing buf[-1] if len == 0, which is undefined behavior.
+
+Commit adds check to avoid access out of bounds at pointed line.
+
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1841
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit 8d25a8914346824f820490ba7090175dea9428cd)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ os/log.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/os/log.c b/os/log.c
+index cc8219129..71210aee8 100644
+--- a/os/log.c
+++ b/os/log.c
+@@ -827,7 +827,7 @@ LogVHdrMessageVerb(MessageType type, int verb, const char *msg_format,
+     if (size - len == 1)
+         buf[len - 1] = '\n';
+ 
+-    newline = (buf[len - 1] == '\n');
+    newline = (len > 0 && buf[len - 1] == '\n');
+     LogSWrite(verb, buf, len, newline);
+ }
+ 
+-- 
+2.54.0
+
--- a/0001-xkb-fix-int-size-mismatch.patch
+++ b/0001-xkb-fix-int-size-mismatch.patch
@ -0,0 +1,56 @@
+From de8df5f72f7f1673fc1bb7a9c84ba0e7f1d5e562 Mon Sep 17 00:00:00 2001
+From: "Enrico Weigelt, metux IT consult" <info@metux.net>
+Date: Wed, 24 Jan 2024 17:18:16 +0100
+Subject: [PATCH xserver] xkb: fix int size mismatch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+GCC reports:
+
+../xkb/xkb.c: In function ‘_XkbSetMapCheckLength’:
+../xkb/xkb.c:2464:54: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
+ 2464 |     ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
+      |                                                    ~~^
+      |                                                      |
+      |                                                      long int
+      |                                                    %d
+ 2465 |            len, req_len);
+      |            ~~~
+      |            |
+      |            size_t {aka unsigned int}
+../xkb/xkb.c:2464:62: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 3 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
+ 2464 |     ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
+      |                                                            ~~^
+      |                                                              |
+      |                                                              long int
+      |                                                            %d
+ 2465 |            len, req_len);
+      |                 ~~~~~~~
+      |                 |
+      |                 size_t {aka unsigned int}
+
+Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1257>
+(cherry picked from commit bc90c44e60c309564a7feec5d288ecafcbb2a62b)
+---
+ xkb/xkb.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index b240b6f6c..8d52e25df 100644
+--- a/xkb/xkb.c
+++ b/xkb/xkb.c
+@@ -2460,8 +2460,7 @@ _XkbSetMapCheckLength(xkbSetMapReq *req)
+     if (len == req_len)
+         return Success;
+ bad:
+-    ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
+-           len, req_len);
+    ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %zd got %zd\n", len, req_len);
+     return BadLength;
+ }
+ 
+-- 
+2.54.0
+
--- a/0002-dix-avoid-null-ptr-deref-at-doListFontsWithInfo.patch
+++ b/0002-dix-avoid-null-ptr-deref-at-doListFontsWithInfo.patch
@ -0,0 +1,47 @@
+From 27d924f41a04f37ee8a16ba2419a703174c5026c Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
+Date: Wed, 17 Sep 2025 17:25:40 +0300
+Subject: [PATCH xserver 02/51] dix: avoid null ptr deref at
+ doListFontsWithInfo
+
+In the doListFontsWithInfo function in dixfonts.c, when a font alias is
+encountered (err == FontNameAlias), the code saves the current state
+and allocates memory for c->savedName.
+
+If the malloc(namelen + 1) call fails, c->savedName remains NULL,
+but c->haveSaved is still set to TRUE. Later, when a font is
+successfully resolved (err == Successful), the code uses c->savedName
+without checking if it is NULL, so there is potential null ptr
+dereference. XNFalloc will check result of malloc and stop
+program execution if allocation was failed.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1842
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit dd5c2595a42d3ff0c4f18d9b53d1f6c3fd934fd4)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ dix/dixfonts.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/dix/dixfonts.c b/dix/dixfonts.c
+index 386c38686..b079dcf67 100644
+--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
+@@ -933,9 +933,8 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
+                 c->haveSaved = TRUE;
+                 c->savedNumFonts = numFonts;
+                 free(c->savedName);
+-                c->savedName = malloc(namelen + 1);
+-                if (c->savedName)
+-                    memmove(c->savedName, name, namelen + 1);
+                c->savedName = XNFalloc(namelen + 1);
+                memcpy(c->savedName, name, namelen + 1);
+                 aliascount = 20;
+             }
+             if (namelen > XLFDMAXFONTNAMELEN) {
+-- 
+2.54.0
+
--- a/0003-panoramix-avoid-null-dereference-in-PanoramiXMaybeAd.patch
+++ b/0003-panoramix-avoid-null-dereference-in-PanoramiXMaybeAd.patch
@ -0,0 +1,49 @@
+From 5e657943933a79166d2020ee978abd8afa5fccfe Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 20 Sep 2025 16:35:46 -0700
+Subject: [PATCH xserver 03/51] panoramix: avoid null dereference in
+ PanoramiXMaybeAddDepth()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:748:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘PanoramiXDepths’
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:802:1: enter_function: entry to ‘PanoramiXConsolidate’
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:813:17: branch_true: following ‘true’ branch...
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:814:9: branch_true: ...to here
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:814:9: call_function: calling ‘PanoramiXMaybeAddDepth’ from ‘PanoramiXConsolidate’
+746|       PanoramiXDepths = reallocarray(PanoramiXDepths,
+747|                                      PanoramiXNumDepths, sizeof(DepthRec));
+748|->     PanoramiXDepths[j].depth = pDepth->depth;
+749|       PanoramiXDepths[j].numVids = 0;
+750|       PanoramiXDepths[j].vids = NULL;
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 537b56cccaf1759f9beef9396463b1f412614003)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/panoramiX.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
+index bd9c45b03..00585e3f6 100644
+--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
+@@ -747,8 +747,8 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
+ 
+     j = PanoramiXNumDepths;
+     PanoramiXNumDepths++;
+-    PanoramiXDepths = reallocarray(PanoramiXDepths,
+-                                   PanoramiXNumDepths, sizeof(DepthRec));
+    PanoramiXDepths = XNFreallocarray(PanoramiXDepths,
+                                      PanoramiXNumDepths, sizeof(DepthRec));
+     PanoramiXDepths[j].depth = pDepth->depth;
+     PanoramiXDepths[j].numVids = 0;
+     PanoramiXDepths[j].vids = NULL;
+-- 
+2.54.0
+
--- a/0004-panoramix-avoid-null-dereference-in-PanoramiXConsoli.patch
+++ b/0004-panoramix-avoid-null-dereference-in-PanoramiXConsoli.patch
@ -0,0 +1,71 @@
+From bd7f4a48a5187dd32d3a0791a407432933af0c1d Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 20 Sep 2025 16:45:59 -0700
+Subject: [PATCH xserver 04/51] panoramix: avoid null dereference in
+ PanoramiXConsolidate()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+Error: GCC_ANALYZER_WARNING (CWE-476): [#def5]
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘root’
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:819:12: acquire_memory: this call could return NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: danger: ‘root’ could be NULL: unchecked value from (1)
+818|
+819|       root = malloc(sizeof(PanoramiXRes));
+820|->     root->type = XRT_WINDOW;
+821|       defmap = malloc(sizeof(PanoramiXRes));
+822|       defmap->type = XRT_COLORMAP;
+Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
+
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘defmap’
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:821:14: acquire_memory: this call could return NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: danger: ‘defmap’ could be NULL: unchecked value from (1)
+820|       root->type = XRT_WINDOW;
+821|       defmap = malloc(sizeof(PanoramiXRes));
+822|->     defmap->type = XRT_COLORMAP;
+823|       saver = malloc(sizeof(PanoramiXRes));
+824|       saver->type = XRT_WINDOW;
+
+Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘saver’
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:823:13: acquire_memory: this call could return NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: danger: ‘saver’ could be NULL: unchecked value from (1)
+822|       defmap->type = XRT_COLORMAP;
+823|       saver = malloc(sizeof(PanoramiXRes));
+824|->     saver->type = XRT_WINDOW;
+825|
+826|       FOR_NSCREENS(i) {
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 23c103d41f35cc030b0c0e973f7f3bcb8d9902a0)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/panoramiX.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
+index 00585e3f6..2029b353d 100644
+--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
+@@ -820,11 +820,11 @@ PanoramiXConsolidate(void)
+     for (i = 0; i < pScreen->numVisuals; i++)
+         PanoramiXMaybeAddVisual(pVisual++);
+ 
+-    root = malloc(sizeof(PanoramiXRes));
+    root = XNFcallocarray(1, sizeof(PanoramiXRes));
+     root->type = XRT_WINDOW;
+-    defmap = malloc(sizeof(PanoramiXRes));
+    defmap = XNFcallocarray(1, sizeof(PanoramiXRes));
+     defmap->type = XRT_COLORMAP;
+-    saver = malloc(sizeof(PanoramiXRes));
+    saver = XNFcallocarray(1, sizeof(PanoramiXRes));
+     saver->type = XRT_WINDOW;
+ 
+     FOR_NSCREENS(i) {
+-- 
+2.54.0
+
--- a/0005-Xext-shm-avoid-null-dereference-in-ShmInitScreenPriv.patch
+++ b/0005-Xext-shm-avoid-null-dereference-in-ShmInitScreenPriv.patch
@ -0,0 +1,43 @@
+From 70c8842c14764e0cfb343cbe4c29acfedb4b0bc3 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 12:18:49 -0700
+Subject: [PATCH xserver 05/51] Xext/shm: avoid null dereference in
+ ShmInitScreenPriv()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/shm.c:213:23: acquire_memory: this call could return NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/shm.c:214:9: danger: ‘screen_priv’ could be NULL: unchecked value from [(19)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/18)
+#  212|       if (!screen_priv) {
+#  213|           screen_priv = calloc(1, sizeof(ShmScrPrivateRec));
+#  214|->         screen_priv->CloseScreen = pScreen->CloseScreen;
+#  215|           dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, screen_priv);
+#  216|           pScreen->CloseScreen = ShmCloseScreen;
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 87e53afd9c7f52a8fa3d1fed22db5380742cc7b7)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/shm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xext/shm.c b/Xext/shm.c
+index 24c6b1087..2b23a15fe 100644
+--- a/Xext/shm.c
+++ b/Xext/shm.c
+@@ -210,7 +210,7 @@ ShmInitScreenPriv(ScreenPtr pScreen)
+     ShmScrPrivateRec *screen_priv = ShmGetScreenPriv(pScreen);
+ 
+     if (!screen_priv) {
+-        screen_priv = calloc(1, sizeof(ShmScrPrivateRec));
+        screen_priv = XNFcallocarray(1, sizeof(ShmScrPrivateRec));
+         screen_priv->CloseScreen = pScreen->CloseScreen;
+         dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, screen_priv);
+         pScreen->CloseScreen = ShmCloseScreen;
+-- 
+2.54.0
+
--- a/0006-Xext-sync-avoid-null-dereference-if-SysCounterGetPri.patch
+++ b/0006-Xext-sync-avoid-null-dereference-if-SysCounterGetPri.patch
@ -0,0 +1,90 @@
+From 03aeaee358fc6a34a851f875d37df405240879c1 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 15:26:19 -0700
+Subject: [PATCH xserver 06/51] Xext/sync: avoid null dereference if
+ SysCounterGetPrivate() returns NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2664:9: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
+# 2662|           SyncCounter *counter = pCounter;
+# 2663|           IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+# 2664|->         deviceid = priv->deviceid;
+# 2665|       }
+# 2666|       else
+
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2677:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
+# 2675|       SyncCounter *counter = pCounter;
+# 2676|       IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+# 2677|->     int64_t *less = priv->value_less;
+# 2678|       int64_t *greater = priv->value_greater;
+# 2679|       int64_t idle, old_idle;
+
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2767:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
+# 2765|       SyncCounter *counter = pCounter;
+# 2766|       IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+# 2767|->     int64_t *less = priv->value_less;
+# 2768|       int64_t *greater = priv->value_greater;
+# 2769|       int64_t idle;
+
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2800:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
+# 2798|       SyncCounter *counter = pCounter;
+# 2799|       IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+# 2800|->     int64_t *less = priv->value_less;
+# 2801|       int64_t *greater = priv->value_greater;
+# 2802|       Bool registered = (less || greater);
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 0211de37b340eccfc0bad6a3ea13b27810b11a30)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/sync.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index c3d160327..09a14ac3c 100644
+--- a/Xext/sync.c
+++ b/Xext/sync.c
+@@ -2695,9 +2695,11 @@ IdleTimeQueryValue(void *pCounter, int64_t *pValue_return)
+     int deviceid;
+     CARD32 idle;
+ 
+    *pValue_return = 0;
+     if (pCounter) {
+         SyncCounter *counter = pCounter;
+         IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+        BUG_RETURN(priv == NULL);
+         deviceid = priv->deviceid;
+     }
+     else
+@@ -2711,6 +2713,7 @@ IdleTimeBlockHandler(void *pCounter, void *wt)
+ {
+     SyncCounter *counter = pCounter;
+     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+    BUG_RETURN(priv == NULL);
+     int64_t *less = priv->value_less;
+     int64_t *greater = priv->value_greater;
+     int64_t idle, old_idle;
+@@ -2801,6 +2804,7 @@ IdleTimeWakeupHandler(void *pCounter, int rc)
+ {
+     SyncCounter *counter = pCounter;
+     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+    BUG_RETURN(priv == NULL);
+     int64_t *less = priv->value_less;
+     int64_t *greater = priv->value_greater;
+     int64_t idle;
+@@ -2834,6 +2838,7 @@ IdleTimeBracketValues(void *pCounter, int64_t *pbracket_less,
+ {
+     SyncCounter *counter = pCounter;
+     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+    BUG_RETURN(priv == NULL);
+     int64_t *less = priv->value_less;
+     int64_t *greater = priv->value_greater;
+     Bool registered = (less || greater);
+-- 
+2.54.0
+
--- a/0007-Xext-sync-avoid-null-dereference-in-init_system_idle.patch
+++ b/0007-Xext-sync-avoid-null-dereference-in-init_system_idle.patch
@ -0,0 +1,47 @@
+From 2d2fcd6c83bbc174d1ae178388e7ae0d8297da56 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 15:40:22 -0700
+Subject: [PATCH xserver 07/51] Xext/sync: avoid null dereference in
+ init_system_idle_counter()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2835:33: acquire_memory: this call could return NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2837:28: danger: ‘priv’ could be NULL: unchecked value from [(30)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/29)
+# 2835|           IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
+# 2836|
+# 2837|->         priv->value_less = priv->value_greater = NULL;
+# 2838|           priv->deviceid = deviceid;
+# 2839|
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 304d21854d349b21dd8deb8a8f319637f17bd4a8)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/sync.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 09a14ac3c..8fd7e947e 100644
+--- a/Xext/sync.c
+++ b/Xext/sync.c
+@@ -2876,8 +2876,10 @@ init_system_idle_counter(const char *name, int deviceid)
+     if (idle_time_counter != NULL) {
+         IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
+ 
+-        priv->value_less = priv->value_greater = NULL;
+-        priv->deviceid = deviceid;
+        if (priv) {
+            priv->value_less = priv->value_greater = NULL;
+            priv->deviceid = deviceid;
+        }
+ 
+         idle_time_counter->pSysCounterInfo->private = priv;
+     }
+-- 
+2.54.0
+
--- a/0008-Xext-sync-Avoid-dereference-of-invalid-pointer-if-ma.patch
+++ b/0008-Xext-sync-Avoid-dereference-of-invalid-pointer-if-ma.patch
@ -0,0 +1,43 @@
+From 010a613e860e2ff47665535cd4821e3b5e03548a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 16:04:50 -0700
+Subject: [PATCH xserver 08/51] Xext/sync: Avoid dereference of invalid pointer
+ if malloc() failed
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported incorrectly in #1817 as:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2835:33: acquire_memory: allocated here
+xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2843:12: danger: ‘priv’ leaks here; was allocated at [(30)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/29)
+
+but the "leak" is really saving the pointer in an uninitalized pointer in
+a structure that was already freed when the malloc of the SysCounterInfo
+struct failed in SyncCreateSystemCounter(), because it returned the address
+of the freed struct instead of NULL to indicate failure.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 6034ce11b6cd31d42df0f5781f70d3073d91f95b)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/sync.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 8fd7e947e..89a1af13b 100644
+--- a/Xext/sync.c
+++ b/Xext/sync.c
+@@ -1025,7 +1025,7 @@ SyncCreateSystemCounter(const char *name,
+         psci = malloc(sizeof(SysCounterInfo));
+         if (!psci) {
+             FreeResource(pCounter->sync.id, RT_NONE);
+-            return pCounter;
+            return NULL;
+         }
+         pCounter->pSysCounterInfo = psci;
+         psci->pCounter = pCounter;
+-- 
+2.54.0
+
--- a/0009-Xext-vidmode-avoid-null-dereference-if-VidModeCreate.patch
+++ b/0009-Xext-vidmode-avoid-null-dereference-if-VidModeCreate.patch
@ -0,0 +1,45 @@
+From 0e8e24610bd8135ec0855c8a25b903f012eaad1a Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 16:20:37 -0700
+Subject: [PATCH xserver 09/51] Xext/vidmode: avoid null dereference if
+ VidModeCreateMode() allocation fails
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+xwayland-24.1.6/redhat-linux-build/../Xext/vidmode.c:96:5: warning[-Wanalyzer-null-argument]: use of NULL ‘VidModeCreateMode()’ where non-null expected
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 5e62aaaf57b18136969699fd073e123edfb1aa70)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/vidmode.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Xext/vidmode.c b/Xext/vidmode.c
+index 6e4a7c709..2f996e9e9 100644
+--- a/Xext/vidmode.c
+++ b/Xext/vidmode.c
+@@ -808,6 +808,8 @@ ProcVidModeModModeLine(ClientPtr client)
+         return BadValue;
+ 
+     modetmp = VidModeCreateMode();
+    if (modetmp == NULL)
+        return BadAlloc;
+     VidModeCopyMode(mode, modetmp);
+ 
+     VidModeSetModeValue(modetmp, VIDMODE_H_DISPLAY, stuff->hdisplay);
+@@ -951,6 +953,8 @@ ProcVidModeValidateModeLine(ClientPtr client)
+         return BadValue;
+ 
+     modetmp = VidModeCreateMode();
+    if (modetmp == NULL)
+        return BadAlloc;
+     VidModeCopyMode(mode, modetmp);
+ 
+     VidModeSetModeValue(modetmp, VIDMODE_H_DISPLAY, stuff->hdisplay);
+-- 
+2.54.0
+
--- a/0010-Xext-xres-avoid-null-dereference-in-ProcXResQueryCli.patch
+++ b/0010-Xext-xres-avoid-null-dereference-in-ProcXResQueryCli.patch
@ -0,0 +1,38 @@
+From ae00a059dcfdc8c1de23f8e9310bd140679aba09 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 17:10:20 -0700
+Subject: [PATCH xserver 10/51] Xext/xres: avoid null dereference in
+ ProcXResQueryClients()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/xres.c:233:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘current_clients’
+xwayland-24.1.6/redhat-linux-build/../Xext/xres.c:228:23: acquire_memory: this call could return NULL
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 3da60c96a9c3ea26404313eb490e46847b04949c)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/xres.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Xext/xres.c b/Xext/xres.c
+index 7a7aabc9b..4ef8aa04f 100644
+--- a/Xext/xres.c
+++ b/Xext/xres.c
+@@ -224,6 +224,8 @@ ProcXResQueryClients(ClientPtr client)
+     REQUEST_SIZE_MATCH(xXResQueryClientsReq);
+ 
+     current_clients = xallocarray(currentMaxClients, sizeof(int));
+    if (current_clients == NULL)
+        return BadAlloc;
+ 
+     num_clients = 0;
+     for (i = 0; i < currentMaxClients; i++) {
+-- 
+2.54.0
+
--- a/0011-Xext-xselinux-add-fast-path-to-ProcSELinuxListSelect.patch
+++ b/0011-Xext-xselinux-add-fast-path-to-ProcSELinuxListSelect.patch
@ -0,0 +1,38 @@
+From 63511dd097c5ff8e57f34c4f8b0af8e441c0ac3c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 17:19:05 -0700
+Subject: [PATCH xserver 11/51] Xext/xselinux: add fast path to
+ ProcSELinuxListSelections()
+
+If there's nothing to send, skip over a bunch of code to make a list
+that won't be used, and hopefully make the code path clearer to both
+humans and static analyzers, who raise errors as seen in #1817 of
+dereferencing NULL pointers when count == 0.
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit d34243606c8d7a01108827ad1ca3216bf81a119d)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/xselinux_ext.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Xext/xselinux_ext.c b/Xext/xselinux_ext.c
+index 1395a563b..9784dca4e 100644
+--- a/Xext/xselinux_ext.c
+++ b/Xext/xselinux_ext.c
+@@ -452,8 +452,10 @@ ProcSELinuxListSelections(ClientPtr client)
+     count = 0;
+     for (pSel = CurrentSelections; pSel; pSel = pSel->next)
+         count++;
+    if (count == 0)
+        return SELinuxSendItemsToClient(client, NULL, 0, 0);
+     items = calloc(count, sizeof(SELinuxListItemRec));
+-    if (count && !items)
+    if (!items)
+         return BadAlloc;
+ 
+     /* Fill in the items and calculate size */
+-- 
+2.54.0
+
--- a/0012-Xext-xselinux-avoid-memory-leak-in-SELinuxAtomToSID.patch
+++ b/0012-Xext-xselinux-avoid-memory-leak-in-SELinuxAtomToSID.patch
@ -0,0 +1,51 @@
+From 50aa84b64bb9c38b4b67a00221ca6ae5e00808cc Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 17:26:47 -0700
+Subject: [PATCH xserver 12/51] Xext/xselinux: avoid memory leak in
+ SELinuxAtomToSID()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:142:13: warning[-Wanalyzer-malloc-leak]: leak of ‘rec’
+xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:133:1: enter_function: entry to ‘SELinuxAtomToSID’
+xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:141:15: acquire_memory: allocated here
+xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:69:12: branch_true: following ‘true’ branch...
+xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:142:13: danger: ‘rec’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
+#  140|       if (!rec) {
+#  141|           rec = calloc(1, sizeof(SELinuxAtomRec));
+#  142|->         if (!rec || !SELinuxArraySet(&arr_atoms, atom, rec))
+#  143|               return BadAlloc;
+#  144|       }
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 21cbc56c43af04a72ee2d77023194f436027eb4d)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/xselinux_label.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/Xext/xselinux_label.c b/Xext/xselinux_label.c
+index 8559385b9..774f1d9cc 100644
+--- a/Xext/xselinux_label.c
+++ b/Xext/xselinux_label.c
+@@ -138,8 +138,12 @@ SELinuxAtomToSID(Atom atom, int prop, SELinuxObjectRec ** obj_rtn)
+     rec = SELinuxArrayGet(&arr_atoms, atom);
+     if (!rec) {
+         rec = calloc(1, sizeof(SELinuxAtomRec));
+-        if (!rec || !SELinuxArraySet(&arr_atoms, atom, rec))
+        if (!rec)
+             return BadAlloc;
+        if (!SELinuxArraySet(&arr_atoms, atom, rec)) {
+            free(rec);
+            return BadAlloc;
+        }
+     }
+ 
+     if (prop) {
+-- 
+2.54.0
+
--- a/0013-Xext-xtest-avoid-null-dereference-in-ProcXTestFakeIn.patch
+++ b/0013-Xext-xtest-avoid-null-dereference-in-ProcXTestFakeIn.patch
@ -0,0 +1,54 @@
+From 3612d6af9cb75895137e89302b633e730171a4d6 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 4 Oct 2025 17:38:32 -0700
+Subject: [PATCH xserver 13/51] Xext/xtest: avoid null dereference in
+ ProcXTestFakeInput()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:383:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:348:9: release_memory: ‘dev’ is NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:383:14: danger: dereference of NULL ‘dev’
+
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:395:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:348:9: release_memory: ‘dev’ is NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:395:14: danger: dereference of NULL ‘dev’
+
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:426:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
+xwayland-24.1.6/redhat-linux-build/../Xext
+/xtest.c:348:9: release_memory: ‘dev’ is NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:426:14: danger: dereference of NULL ‘dev’
+
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:440:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:348:9: release_memory: ‘dev’ is NULL
+xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:440:9: danger: dereference of NULL ‘dev’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 04ef51dae63dc9ef3d28f7d0b78b4504dbb01f66)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xext/xtest.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Xext/xtest.c b/Xext/xtest.c
+index 3b66224be..fe3a868a4 100644
+--- a/Xext/xtest.c
+++ b/Xext/xtest.c
+@@ -318,6 +318,10 @@ ProcXTestFakeInput(ClientPtr client)
+             return BadAccess;
+ 
+         dev = GetXTestDevice(dev);
+
+        /* This can only happen if we passed a slave to GetXTestDevice() */
+        if (!dev)
+            return BadAccess;
+     }
+ 
+ 
+-- 
+2.54.0
+
--- a/0014-Xi-avoid-null-dereference-if-wOtherInputMasks-return.patch
+++ b/0014-Xi-avoid-null-dereference-if-wOtherInputMasks-return.patch
@ -0,0 +1,91 @@
+From 826550e2cfd8a033c4a16dffdd852f2115e7331f Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 5 Oct 2025 15:38:35 -0700
+Subject: [PATCH xserver 14/51] Xi: avoid null dereference if
+ wOtherInputMasks() returns NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The wOtherInputMasks(win) macro will return NULL if
+win->optional is NULL.
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:1390:13:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:1404:13:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:2293:9:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:3244:22:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
+
+xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:3338:9:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 7b7bcf92311db87a0292474dcf2ed9767f4a9abd)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xi/exevents.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/exevents.c b/Xi/exevents.c
+index 1930089d3..7249f492c 100644
+--- a/Xi/exevents.c
+++ b/Xi/exevents.c
+@@ -1331,6 +1331,7 @@ RetrieveTouchDeliveryData(DeviceIntPtr dev, TouchPointInfoPtr ti,
+             else
+                 evtype = GetXI2Type(ev->any.type);
+ 
+            BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE);
+             nt_list_for_each_entry(iclients,
+                                    wOtherInputMasks(*win)->inputClients, next)
+                 if (xi2mask_isset(iclients->xi2mask, dev, evtype))
+@@ -1345,6 +1346,7 @@ RetrieveTouchDeliveryData(DeviceIntPtr dev, TouchPointInfoPtr ti,
+             int xi_type = GetXIType(TouchGetPointerEventType(ev));
+             Mask xi_filter = event_get_filter_from_type(dev, xi_type);
+ 
+            BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE);
+             nt_list_for_each_entry(iclients,
+                                    wOtherInputMasks(*win)->inputClients, next)
+                 if (iclients->mask[dev->id] & xi_filter)
+@@ -2974,13 +2976,18 @@ DeviceEventSuppressForWindow(WindowPtr pWin, ClientPtr client, Mask mask,
+             inputMasks->dontPropagateMask[maskndx] = mask;
+     }
+     else {
+-        if (!inputMasks)
+-            AddExtensionClient(pWin, client, 0, 0);
+-        inputMasks = wOtherInputMasks(pWin);
+        if (!inputMasks) {
+            int ret = AddExtensionClient(pWin, client, 0, 0);
+
+            if (ret != Success)
+                return ret;
+            inputMasks = wOtherInputMasks(pWin);
+            BUG_RETURN_VAL(!inputMasks, BadAlloc);
+        }
+         inputMasks->dontPropagateMask[maskndx] = mask;
+     }
+     RecalculateDeviceDeliverableEvents(pWin);
+-    if (ShouldFreeInputMasks(pWin, FALSE))
+    if (inputMasks && ShouldFreeInputMasks(pWin, FALSE))
+         FreeResource(inputMasks->inputClients->resource, RT_NONE);
+     return Success;
+ }
+@@ -3075,6 +3082,7 @@ XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
+     if (len && !others) {
+         if (AddExtensionClient(win, client, 0, 0) != Success)
+             return BadAlloc;
+        BUG_RETURN_VAL(!wOtherInputMasks(win), BadAlloc);
+         others = wOtherInputMasks(win)->inputClients;
+     }
+ 
+-- 
+2.54.0
+
--- a/0015-Xi-set-value-for-led_values-in-CopySwapKbdFeedback.patch
+++ b/0015-Xi-set-value-for-led_values-in-CopySwapKbdFeedback.patch
@ -0,0 +1,43 @@
+From 5eeb67f1d806c25ef31d2110b21644a59de83815 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 5 Oct 2025 17:12:29 -0700
+Subject: [PATCH xserver 15/51] Xi: set value for led_values in
+ CopySwapKbdFeedback()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(The existing setting of led_mask is probably wrong, but has been set
+ like this since X11R5 and going back as far as the first version in
+ the X Consortium source control archives.)
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xi/getfctl.c:108:9:
+ warning[-Wanalyzer-use-of-uninitialized-value]:
+ use of uninitialized value ‘*k2.led_values’
+108|->         swapl(&k2->led_values);
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 90c8429d3509894f8834ead3b15f2e76657e57a6)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xi/getfctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/Xi/getfctl.c b/Xi/getfctl.c
+index eea0113c1..61f14c5ea 100644
+--- a/Xi/getfctl.c
+++ b/Xi/getfctl.c
+@@ -97,6 +97,7 @@ CopySwapKbdFeedback(ClientPtr client, KbdFeedbackPtr k, char **buf)
+     k2->pitch = k->ctrl.bell_pitch;
+     k2->duration = k->ctrl.bell_duration;
+     k2->led_mask = k->ctrl.leds;
+    k2->led_values = k->ctrl.leds;
+     k2->global_auto_repeat = k->ctrl.autoRepeat;
+     for (i = 0; i < 32; i++)
+         k2->auto_repeats[i] = k->ctrl.autoRepeats[i];
+-- 
+2.54.0
+
--- a/0016-Xi-handle-allocation-failure-in-ProcXGetDeviceDontPr.patch
+++ b/0016-Xi-handle-allocation-failure-in-ProcXGetDeviceDontPr.patch
@ -0,0 +1,41 @@
+From f9d3537883522255d5fa91ea8b63c745286232ee Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 5 Oct 2025 17:32:45 -0700
+Subject: [PATCH xserver 16/51] Xi: handle allocation failure in
+ ProcXGetDeviceDontPropagateList()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xi/getprop.c:163:25:
+ warning[-Wanalyzer-possible-null-dereference]:
+ dereference of possibly-NULL ‘buf’
+xwayland-24.1.6/redhat-linux-build/../Xi/getprop.c:121:19:
+ acquire_memory: this call could return NULL
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 7b18313e2a9d0409ac7465d2f313153013fdf5a3)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xi/getprop.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Xi/getprop.c b/Xi/getprop.c
+index b744f35cb..b53db7306 100644
+--- a/Xi/getprop.c
+++ b/Xi/getprop.c
+@@ -119,6 +119,8 @@ ProcXGetDeviceDontPropagateList(ClientPtr client)
+         if (count) {
+             rep.count = count;
+             buf = xallocarray(rep.count, sizeof(XEventClass));
+            if (buf == NULL)
+                return BadAlloc;
+             rep.length = bytes_to_int32(rep.count * sizeof(XEventClass));
+ 
+             tbuf = buf;
+-- 
+2.54.0
+
--- a/0017-Xi-handle-allocation-failure-in-ProcXListInputDevice.patch
+++ b/0017-Xi-handle-allocation-failure-in-ProcXListInputDevice.patch
@ -0,0 +1,43 @@
+From 4c5a0e203feaae43134264bb3a999453d6f09a2c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 5 Oct 2025 17:37:48 -0700
+Subject: [PATCH xserver 17/51] Xi: handle allocation failure in
+ ProcXListInputDevices()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xi/listdev.c:171:5:
+ warning[-Wanalyzer-possible-null-dereference]:
+ dereference of possibly-NULL ‘dev’
+xwayland-24.1.6/redhat-linux-build/../Xi/listdev.c:379:23:
+ acquire_memory: this call could return NULL
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 19c6195e711d9f9fabbde1bea7a6393c4a4c3cd3)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xi/listdev.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/Xi/listdev.c b/Xi/listdev.c
+index c15e61b37..5b860e92c 100644
+--- a/Xi/listdev.c
+++ b/Xi/listdev.c
+@@ -377,6 +377,10 @@ ProcXListInputDevices(ClientPtr client)
+     /* allocate space for reply */
+     total_length = numdevs * sizeof(xDeviceInfo) + size + namesize;
+     devbuf = (char *) calloc(1, total_length);
+    if (!devbuf) {
+        free(skip);
+        return BadAlloc;
+    }
+     classbuf = devbuf + (numdevs * sizeof(xDeviceInfo));
+     namebuf = classbuf + size;
+     savbuf = devbuf;
+-- 
+2.54.0
+
--- a/0018-Xi-handle-allocation-failure-in-add_master_func.patch
+++ b/0018-Xi-handle-allocation-failure-in-add_master_func.patch
@ -0,0 +1,39 @@
+From d3db315eb5fff0933c16e772081754ee02b48938 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 5 Oct 2025 17:52:39 -0700
+Subject: [PATCH xserver 18/51] Xi: handle allocation failure in
+ add_master_func()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../Xi/xibarriers.c:729:5:
+ warning[-Wanalyzer-null-dereference]:
+ dereference of NULL ‘AllocBarrierDevice()’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 0ee603905387e00a2e3d83ead1de99ca61d641fb)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ Xi/xibarriers.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c
+index cb336f22b..ad82852fe 100644
+--- a/Xi/xibarriers.c
+++ b/Xi/xibarriers.c
+@@ -726,6 +726,8 @@ static void add_master_func(void *res, XID id, void *devid)
+ 
+ 
+     pbd = AllocBarrierDevice();
+    if (!pbd)
+        return;
+     pbd->deviceid = *deviceid;
+ 
+     input_lock();
+-- 
+2.54.0
+
--- a/0019-dix-handle-allocation-failure-in-DeviceFocusEvent.patch
+++ b/0019-dix-handle-allocation-failure-in-DeviceFocusEvent.patch
@ -0,0 +1,39 @@
+From 4f68278ca74892098c6600adc3e6d8901682793e Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 11 Oct 2025 12:59:04 -0700
+Subject: [PATCH xserver 19/51] dix: handle allocation failure in
+ DeviceFocusEvent()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../dix/enterleave.c:786:5:
+ warning[-Wanalyzer-possible-null-dereference]:
+ dereference of possibly-NULL ‘xi2event’
+
+Fixes: 3f37923a7 ("Xi: send XI2 focus events." in Xorg 1.10.0)
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit dedceb52bcbba2431368b53acbbba490ac8ee485)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ dix/enterleave.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dix/enterleave.c b/dix/enterleave.c
+index 78a7dab39..df3ffd224 100644
+--- a/dix/enterleave.c
+++ b/dix/enterleave.c
+@@ -774,6 +774,7 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
+     len = sizeof(xXIFocusInEvent) + btlen * 4;
+ 
+     xi2event = calloc(1, len);
+    BUG_RETURN(xi2event == NULL);
+     xi2event->type = GenericEvent;
+     xi2event->extension = IReqCode;
+     xi2event->evtype = type;
+-- 
+2.54.0
+
--- a/0020-dix-avoid-null-dereference-if-wOtherInputMasks-retur.patch
+++ b/0020-dix-avoid-null-dereference-if-wOtherInputMasks-retur.patch
@ -0,0 +1,54 @@
+From 69599f57afd64ff1289dbbd29e5e108435b7ffc2 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 11 Oct 2025 16:16:12 -0700
+Subject: [PATCH xserver 20/51] dix: avoid null dereference if
+ wOtherInputMasks() returns NULL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The wOtherInputMasks(win) macro will return NULL if
+win->optional is NULL.
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../dix/gestures.c:242:9:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
+xwayland-24.1.6/redhat-linux-build/../dix/touch.c:765:9:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
+xwayland-24.1.6/redhat-linux-build/../dix/touch.c:782:9:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 15496a5e3d5407a2b480d8c726b012455f7898bb)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ dix/touch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/touch.c b/dix/touch.c
+index 37902bd05..5c5c21303 100644
+--- a/dix/touch.c
+++ b/dix/touch.c
+@@ -797,6 +797,8 @@ TouchAddRegularListener(DeviceIntPtr dev, TouchPointInfoPtr ti,
+     inputMasks = wOtherInputMasks(win);
+ 
+     if (mask & EVENT_XI2_MASK) {
+        BUG_RETURN_VAL(!inputMasks, FALSE);
+
+         nt_list_for_each_entry(iclients, inputMasks->inputClients, next) {
+             if (!xi2mask_isset(iclients->xi2mask, dev, evtype))
+                 continue;
+@@ -814,6 +816,8 @@ TouchAddRegularListener(DeviceIntPtr dev, TouchPointInfoPtr ti,
+         int xitype = GetXIType(TouchGetPointerEventType(ev));
+         Mask xi_filter = event_get_filter_from_type(dev, xitype);
+ 
+        BUG_RETURN_VAL(!inputMasks, FALSE);
+
+         nt_list_for_each_entry(iclients, inputMasks->inputClients, next) {
+             if (!(iclients->mask[dev->id] & xi_filter))
+                 continue;
+-- 
+2.54.0
+
--- a/0021-dix-assert-that-size-of-buffers-to-swap-is-a-multipl.patch
+++ b/0021-dix-assert-that-size-of-buffers-to-swap-is-a-multipl.patch
@ -0,0 +1,62 @@
+From 98988e606948fb88290fe51ab8aed599c2dc7b42 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 11 Oct 2025 18:26:55 -0700
+Subject: [PATCH xserver 21/51] dix: assert that size of buffers to swap is a
+ multiple of the swap size
+
+If we're swapping 4-byte integers or 2-byte integers, make sure the size
+of the buffer doesn't have any bytes left over, since we won't correctly
+handle those bytes.
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../dix/swaprep.c:99:22:
+ warning[-Wanalyzer-allocation-size]:
+ allocated buffer size is not a multiple of the pointee's size
+
+xwayland-24.1.6/redhat-linux-build/../dix/swaprep.c:146:22:
+ warning[-Wanalyzer-allocation-size]:
+ allocated buffer size is not a multiple of the pointee's size
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit cf49354b6060b71ae41febe67327278fbcb7c74a)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ dix/swaprep.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/dix/swaprep.c b/dix/swaprep.c
+index 08344d7f7..04279e5f4 100644
+--- a/dix/swaprep.c
+++ b/dix/swaprep.c
+@@ -48,6 +48,8 @@ SOFTWARE.
+ #include <dix-config.h>
+ #endif
+ 
+#include <assert.h>
+
+ #include <X11/X.h>
+ #include <X11/Xproto.h>
+ #include "misc.h"
+@@ -95,6 +97,8 @@ CopySwap32Write(ClientPtr pClient, int size, CARD32 *pbuf)
+     CARD32 *from, *to, *fromLast, *toLast;
+     CARD32 tmpbuf[1];
+ 
+    assert((bufsize % sizeof(CARD32)) == 0);
+
+     /* Allocate as big a buffer as we can... */
+     while (!(pbufT = malloc(bufsize))) {
+         bufsize >>= 1;
+@@ -142,6 +146,8 @@ CopySwap16Write(ClientPtr pClient, int size, short *pbuf)
+     short *from, *to, *fromLast, *toLast;
+     short tmpbuf[2];
+ 
+    assert((bufsize % sizeof(short)) == 0);
+
+     /* Allocate as big a buffer as we can... */
+     while (!(pbufT = malloc(bufsize))) {
+         bufsize >>= 1;
+-- 
+2.54.0
+
--- a/0022-dix-handle-allocation-failure-in-ChangeWindowDeviceC.patch
+++ b/0022-dix-handle-allocation-failure-in-ChangeWindowDeviceC.patch
@ -0,0 +1,42 @@
+From 28c7d5470a1d4241594d2629952427767e3b88ce Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 12 Oct 2025 09:48:15 -0700
+Subject: [PATCH xserver 22/51] dix: handle allocation failure in
+ ChangeWindowDeviceCursor()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../dix/window.c:3495:9:
+ warning[-Wanalyzer-possible-null-dereference]:
+ dereference of possibly-NULL ‘pNewNode’
+xwayland-24.1.6/redhat-linux-build/../dix/window.c:3494:20:
+ acquire_memory: this call could return NULL
+
+Fixes: 95e1a8805 ("Xi: Adding ChangeDeviceCursor request" in xorg 1.10.0)
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit c9fa8a8da161e1c37058a342ba5495ce627d0985)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
+---
+ dix/window.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/dix/window.c b/dix/window.c
+index 8789a5ece..219e8c470 100644
+--- a/dix/window.c
+++ b/dix/window.c
+@@ -3510,6 +3510,8 @@ ChangeWindowDeviceCursor(WindowPtr pWin, DeviceIntPtr pDev, CursorPtr pCursor)
+             return Success;
+ 
+         pNewNode = malloc(sizeof(DevCursNodeRec));
+        if (!pNewNode)
+            return BadAlloc;
+         pNewNode->dev = pDev;
+         pNewNode->next = pWin->optional->deviceCursors;
+         pWin->optional->deviceCursors = pNewNode;
+-- 
+2.54.0
+
--- a/0023-xfree86-Fix-builds-with-gcc-Wpedantic.patch
+++ b/0023-xfree86-Fix-builds-with-gcc-Wpedantic.patch
@ -0,0 +1,42 @@
+From 6fda4afcb9f5ebcaa7ebb91a4e55a19c4a64cf4d Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 10 Aug 2025 11:20:01 -0700
+Subject: [PATCH xserver 23/51] xfree86: Fix builds with gcc -Wpedantic
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+../hw/xfree86/loader/loadmod.c:85:33: warning: ISO C forbids empty
+ initializer braces before C23 [-Wpedantic]
+   85 | static int ModuleDuplicated[] = { };
+      |                                 ^
+../hw/xfree86/loader/loadmod.c:85:12: error: zero or negative size array
+ ‘ModuleDuplicated’
+   85 | static int ModuleDuplicated[] = { };
+      |            ^~~~~~~~~~~~~~~~
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit d03c84b57f1455b20518781026777b938194b2a4)
+(cherry picked from commit 3e0f37c95c92829e338a910379440ba9b4f4170d)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ hw/xfree86/loader/loadmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
+index 342c7b800..6f7c6d93c 100644
+--- a/hw/xfree86/loader/loadmod.c
+++ b/hw/xfree86/loader/loadmod.c
+@@ -82,7 +82,7 @@ const ModuleVersions LoaderVersionInfo = {
+     ABI_EXTENSION_VERSION,
+ };
+ 
+-static int ModuleDuplicated[] = { };
+static int ModuleDuplicated[] = { 0 };
+ 
+ static void
+ FreeStringList(char **paths)
+-- 
+2.54.0
+
--- a/0024-dix-set-errorValue-correctly-when-XID-lookup-fails-i.patch
+++ b/0024-dix-set-errorValue-correctly-when-XID-lookup-fails-i.patch
@ -0,0 +1,52 @@
+From 82a58016e202f10e87b2d629f6ae3a6bcfca80cb Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 7 Dec 2025 15:57:53 -0800
+Subject: [PATCH xserver 24/51] dix: set errorValue correctly when XID lookup
+ fails in ChangeGCXIDs()
+
+dixLookupResourceByType always overwrites the pointer passed in as the
+first arg, so we shouldn't use the union it's in after that to get the
+requested XID value to put in the errorValue.
+
+Closes: #1857
+Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.")
+Reported-by: Mouse <mouse@Rodents-Montreal.ORG>
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit ac42c39145849588544ad10812e5a8ae76bf1114)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ dix/gc.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/dix/gc.c b/dix/gc.c
+index 4ccbd3b54..717998cfd 100644
+--- a/dix/gc.c
+++ b/dix/gc.c
+@@ -441,6 +441,7 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32)
+         vals[i].val = pC32[i];
+     for (i = 0; i < ARRAY_SIZE(xidfields); ++i) {
+         int offset, rc;
+        XID id;
+ 
+         if (!(mask & xidfields[i].mask))
+             continue;
+@@ -449,11 +450,13 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32)
+             vals[offset].ptr = NullPixmap;
+             continue;
+         }
+-        rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val,
+        /* save the id, since dixLookupResourceByType overwrites &vals[offset] */
+        id = vals[offset].val;
+        rc = dixLookupResourceByType(&vals[offset].ptr, id,
+                                      xidfields[i].type, client,
+                                      xidfields[i].access_mode);
+         if (rc != Success) {
+-            client->errorValue = vals[offset].val;
+            client->errorValue = id;
+             return rc;
+         }
+     }
+-- 
+2.54.0
+
--- a/0025-os-avoid-closing-null-fd-at-Fopen.patch
+++ b/0025-os-avoid-closing-null-fd-at-Fopen.patch
@ -0,0 +1,40 @@
+From 1542f1bb8de1d4ccd32047a15740c8dd1002502b Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+Date: Wed, 17 Dec 2025 11:52:16 +0300
+Subject: [PATCH xserver 25/51] os: avoid closing null fd at Fopen
+
+In `Fopen` function variable `iop` may store NULL as a result of `fopen`
+call. In this case, if later privileges couldn't be restored (`seteuid`
+call fails), further `fclose(iop)` call will cause runtime error.
+
+This commit adds check `iop` for NULL before calling `fclose` to prevent
+potential NULL pointer dereference.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit f83807647e171def9244a7f1d8d9af8e8e79f847)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ os/utils.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/os/utils.c b/os/utils.c
+index 2ba1c8013..0a9f36fcd 100644
+--- a/os/utils.c
+++ b/os/utils.c
+@@ -1589,7 +1589,9 @@ Fopen(const char *file, const char *type)
+     iop = fopen(file, type);
+ 
+     if (seteuid(euid) == -1) {
+-        fclose(iop);
+        if (iop) {
+            fclose(iop);
+        }
+         return NULL;
+     }
+     return iop;
+-- 
+2.54.0
+
--- a/0026-render-fix-multiple-mem-leaks-on-err-paths.patch
+++ b/0026-render-fix-multiple-mem-leaks-on-err-paths.patch
@ -0,0 +1,50 @@
+From 7ad37a32bc5ad5d385bfd65755d58f10f1c10013 Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+Date: Thu, 5 Feb 2026 16:07:43 +0300
+Subject: [PATCH xserver 26/51] render: fix multiple mem leaks on err paths
+
+Free nested allocations when initialization fails.
+Several code paths returned early on error without releasing
+memory owned by embedded structures, leading to leaks.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit 809402414e4b84ad5c084221c7b4da9bd2c5d55d)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ render/picture.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/render/picture.c b/render/picture.c
+index a53f3b560..f6729eaef 100644
+--- a/render/picture.c
+++ b/render/picture.c
+@@ -911,6 +911,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2,
+ 
+     initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
+     if (*error) {
+        free(pPicture->pSourcePict);
+         free(pPicture);
+         return 0;
+     }
+@@ -956,6 +957,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner,
+ 
+     initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
+     if (*error) {
+        free(pPicture->pSourcePict);
+         free(pPicture);
+         return 0;
+     }
+@@ -994,6 +996,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle,
+ 
+     initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
+     if (*error) {
+        free(pPicture->pSourcePict);
+         free(pPicture);
+         return 0;
+     }
+-- 
+2.54.0
+
--- a/0027-dix-avoid-null-ptr-deref-at-doListFontsAndAliases.patch
+++ b/0027-dix-avoid-null-ptr-deref-at-doListFontsAndAliases.patch
@ -0,0 +1,52 @@
+From d977ac58df2837014b4b1745113d03937cf6bf2f Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+Date: Wed, 17 Dec 2025 11:15:27 +0300
+Subject: [PATCH xserver 27/51] dix: avoid null ptr deref at
+ doListFontsAndAliases
+
+In the `doListFontsAndAliases` function in dixfonts.c, when a font alias
+is encountered (`err == FontNameAlias`) as a result of
+`list_next_font_or_alias` call, the code allocates memory for
+`resolved` variable (`resolvedlen + 1` bytes) for storing target font
+name. In this case, if the `malloc(resolvedlen + 1)` call fails,
+`resolved` remains NULL.
+
+Later, when check (`else if (err == FontNameAlias)`) is TRUE, the code
+uses `memcpy` to copy nullable `resolved` into `tmp_pattern` without
+checking if `resolved` is NULL, so there is a potential null ptr
+dereference.
+
+This commit replaces `malloc` with `XNFalloc` for allocating memory for
+`resolved`. `XNFalloc` will internally check result of `malloc` and stop
+program execution if allocation was failed, preventing potential NULL
+dereferencing.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit 0237462d326c78868c83b6eda35a9d35725f3b33)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ dix/dixfonts.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/dix/dixfonts.c b/dix/dixfonts.c
+index b079dcf67..553f4d7d4 100644
+--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
+@@ -639,9 +639,8 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
+                 }
+                 if (err == FontNameAlias) {
+                     free(resolved);
+-                    resolved = malloc(resolvedlen + 1);
+-                    if (resolved)
+-                        memmove(resolved, tmpname, resolvedlen + 1);
+                    resolved = XNFalloc(resolvedlen + 1);
+                    memcpy(resolved, tmpname, resolvedlen + 1);
+                 }
+             }
+ 
+-- 
+2.54.0
+
--- a/0028-randr-clear-primary-screen-s-primaryOutput-when-the-.patch
+++ b/0028-randr-clear-primary-screen-s-primaryOutput-when-the-.patch
@ -0,0 +1,59 @@
+From 361a7e40f294e471d4b2f9bfb7a250fb84d8564b Mon Sep 17 00:00:00 2001
+From: hongao <hongao@uniontech.com>
+Date: Wed, 15 May 2024 14:35:23 +0800
+Subject: [PATCH xserver 28/51] randr: clear primary screen's primaryOutput
+ when the output is deleted
+
+This fix use after free when a pluggable gpu screen (such as displaylink)
+was set as primary screen and unpluged.
+
+gdb backtrace:
+ #0 OssigHandler (signo=11, sip=0x7fff2e0a50f0, unused=0x7fff2e0a4fc0) at ../../../../os/osinit.c:138
+ #1 <signal handler called>
+ #2 rrGetscreenResources (client=0x3195160, query=0) at ../../../../randr/rrscreen.c:577
+ #3 0x0000000000562bae in ProcRRGetscreenResourcesCurrent (client=0x3195160) at ../../../../randr/rrscreen.c:652
+ #4 OxOOOOB0000054de63 in ProcRRDispatch (client=0x3195160) at ../../../../randr/randr.c:717
+ #5 0x00000000004322c6 in Dispatch () at ../../../../dix/dispatch.c:485
+ #6 0x0900900990443139 in dix_main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/main.c:276
+ #7 0X0000000000421d9a in main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/stubmain.c:34
+
+Signed-off-by: hongao <hongao@uniontech.com>
+(cherry picked from commit 1443fd34ea37e8c7cedfac446e4a34205c5fbbb0)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ randr/rroutput.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/randr/rroutput.c b/randr/rroutput.c
+index e52ad7671..d98446ab1 100644
+--- a/randr/rroutput.c
+++ b/randr/rroutput.c
+@@ -374,6 +374,8 @@ RROutputDestroyResource(void *value, XID pid)
+ {
+     RROutputPtr output = (RROutputPtr) value;
+     ScreenPtr pScreen = output->pScreen;
+    ScreenPtr primary;
+    rrScrPrivPtr primarysp;
+     int m;
+ 
+     if (pScreen) {
+@@ -394,6 +396,15 @@ RROutputDestroyResource(void *value, XID pid)
+         if (pScrPriv->primaryOutput == output)
+             pScrPriv->primaryOutput = NULL;
+ 
+        if (pScreen->isGPU) {
+            primary = pScreen->current_master;
+            if (primary) {
+                primarysp = rrGetScrPriv(primary);
+                if (primarysp->primaryOutput == output)
+                    primarysp->primaryOutput = NULL;
+            }
+        }
+
+         for (i = 0; i < pScrPriv->numOutputs; i++) {
+             if (pScrPriv->outputs[i] == output) {
+                 memmove(pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
+-- 
+2.54.0
+
--- a/0029-Make-xf86CompatOutput-return-NULL-when-there-are-no-.patch
+++ b/0029-Make-xf86CompatOutput-return-NULL-when-there-are-no-.patch
@ -0,0 +1,31 @@
+From 8b532c093256aea097867ec12afab459076f28a3 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu.herrb@laas.fr>
+Date: Sun, 31 Oct 2021 11:28:28 +0100
+Subject: [PATCH xserver 29/51] Make xf86CompatOutput() return NULL when there
+ are no privates
+
+Some drivers (mach64 w/o DRI for instance) don't initialize privates.
+
+Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
+(cherry picked from commit 80eeff3ebac772e25c9107199989e677457dbe06)
+---
+ hw/xfree86/modes/xf86Crtc.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
+index 1d1124a1b..2ab16322b 100644
+--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
+@@ -839,6 +839,9 @@ xf86CompatOutput(ScrnInfoPtr pScrn)
+ {
+     xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
+ 
+    if (xf86CrtcConfigPrivateIndex == -1)
+        return NULL;
+
+     if (config->compat_output < 0)
+         return NULL;
+     return config->output[config->compat_output];
+-- 
+2.54.0
+
--- a/0030-Better-fix-for-xf86CompatOut-when-there-are-no-priva.patch
+++ b/0030-Better-fix-for-xf86CompatOut-when-there-are-no-priva.patch
@ -0,0 +1,37 @@
+From c739165b8d2782ea9059494c482aa1854dfb74f3 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Sun, 5 Dec 2021 21:59:12 +0100
+Subject: [PATCH xserver 30/51] Better fix for xf86CompatOut() when there are
+ no privates
+
+XF86_CRTC_CONFIG_PTR() will derefence privates[-1] in this case.
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+(cherry picked from commit 75d70612888f18339703315549db781a22c0cb23)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ hw/xfree86/modes/xf86Crtc.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
+index 2ab16322b..2b0fb687c 100644
+--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
+@@ -837,11 +837,11 @@ extern _X_EXPORT int xf86CrtcConfigPrivateIndex;
+ static _X_INLINE xf86OutputPtr
+ xf86CompatOutput(ScrnInfoPtr pScrn)
+ {
+-    xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
+    xf86CrtcConfigPtr config;
+ 
+     if (xf86CrtcConfigPrivateIndex == -1)
+         return NULL;
+-
+    config = XF86_CRTC_CONFIG_PTR(pScrn);
+     if (config->compat_output < 0)
+         return NULL;
+     return config->output[config->compat_output];
+-- 
+2.54.0
+
--- a/0031-xf86-check-return-value-of-XF86_CRTC_CONFIG_PTR-in-x.patch
+++ b/0031-xf86-check-return-value-of-XF86_CRTC_CONFIG_PTR-in-x.patch
@ -0,0 +1,35 @@
+From 33ce204fd96b7f46f97da73f3144eca384584513 Mon Sep 17 00:00:00 2001
+From: Benjamin Valentin <benjamin.valentin@ml-pa.com>
+Date: Mon, 27 Dec 2021 14:53:22 +0100
+Subject: [PATCH xserver 31/51] xf86: check return value of
+ XF86_CRTC_CONFIG_PTR in xf86CompatOutput()
+
+If privates[xf86CrtcConfigPrivateIndex].ptr is NULL, this will cause
+a segfault.
+
+Possible fix for !1241
+
+Signed-off-by: Benjamin Valentin <benjamin.valentin@ml-pa.com>
+(cherry picked from commit 907c501926775fdbc9a8bfcfd3d64ac3d5502775)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ hw/xfree86/modes/xf86Crtc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
+index 2b0fb687c..d8cba59fd 100644
+--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
+@@ -842,7 +842,7 @@ xf86CompatOutput(ScrnInfoPtr pScrn)
+     if (xf86CrtcConfigPrivateIndex == -1)
+         return NULL;
+     config = XF86_CRTC_CONFIG_PTR(pScrn);
+-    if (config->compat_output < 0)
+    if ((config == NULL) || (config->compat_output < 0))
+         return NULL;
+     return config->output[config->compat_output];
+ }
+-- 
+2.54.0
+
--- a/0032-os-include-assert.h-in-ospoll.c.patch
+++ b/0032-os-include-assert.h-in-ospoll.c.patch
@ -0,0 +1,48 @@
+From 4df75d6f5a98cdefc52d459ad9f6fce3ba5f642b Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 14 Mar 2026 17:06:28 -0700
+Subject: [PATCH xserver 32/51] os: include <assert.h> in ospoll.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes build failure in mingw-cross-build:
+
+../os/ospoll.c: In function ‘ospoll_destroy’:
+../os/ospoll.c:266:9: error: implicit declaration of function ‘assert’
+ [-Werror=implicit-function-declaration]
+  266 |         assert (ospoll->num == 0);
+      |         ^~~~~~
+../os/ospoll.c:59:1: note: ‘assert’ is defined in header ‘<assert.h>’;
+ did you forget to ‘#include <assert.h>’?
+   58 | #include "xserver_poll.h"
+  +++ |+#include <assert.h>
+   59 | #define POLL            1
+../os/ospoll.c:266:9: warning: nested extern declaration of ‘assert’
+ [-Wnested-externs]
+  266 |         assert (ospoll->num == 0);
+      |         ^~~~~~
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 7f8570bfa16bd41e4536385b46742cc316546529)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ os/ospoll.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/os/ospoll.c b/os/ospoll.c
+index c68aabc87..387ead4e0 100644
+--- a/os/ospoll.c
+++ b/os/ospoll.c
+@@ -26,6 +26,7 @@
+ 
+ #include <X11/X.h>
+ #include <X11/Xproto.h>
+#include <assert.h>
+ #include <stdlib.h>
+ #include <unistd.h>
+ #include "misc.h"               /* for typedef of pointer */
+-- 
+2.54.0
+
--- a/0033-os-make-FormatInt64-handle-LONG_MIN-correctly.patch
+++ b/0033-os-make-FormatInt64-handle-LONG_MIN-correctly.patch
@ -0,0 +1,49 @@
+From 77d1f03ec166c3c4e12b05dd51aa0ad41d18694c Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 19 Dec 2025 17:10:43 -0800
+Subject: [PATCH xserver 33/51] os: make FormatInt64() handle LONG_MIN
+ correctly
+
+When compiling with gcc 15.2.0 using -O3 -m64 on Solaris SPARC & x64,
+we'd get a test failure of:
+
+Assertion failed: strcmp(logmsg, expected) == 0,
+ file ../test/signal-logging.c, line 339, function logging_format
+
+because 'num *= 1' produced a value that was out of the range of the
+int64_t it was being stored in.  (Compiling with -O2 worked fine with
+the same compiler/configuration/platform though.)
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 7f68b588657ea14050971efa86682e55e2c7e21b)
+(cherry picked from commit 3eac9393d734a1aa8342179f98e30569da70db95)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ os/utils.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/os/utils.c b/os/utils.c
+index 0a9f36fcd..7130c27aa 100644
+--- a/os/utils.c
+++ b/os/utils.c
+@@ -2084,12 +2084,14 @@ xstrtokenize(const char *str, const char *separators)
+ void
+ FormatInt64(int64_t num, char *string)
+ {
+    uint64_t unum = num;
+
+     if (num < 0) {
+         string[0] = '-';
+-        num *= -1;
+        unum = num * -1;
+         string++;
+     }
+-    FormatUInt64(num, string);
+    FormatUInt64(unum, string);
+ }
+ 
+ /* Format a number into a string in a signal safe manner. The string should be
+-- 
+2.54.0
+
--- a/0034-os-use-close-on-exec-for-X-server-socket-to-prevent-.patch
+++ b/0034-os-use-close-on-exec-for-X-server-socket-to-prevent-.patch
@ -0,0 +1,31 @@
+From aa5e76a3983061b9471334b3619d207b41d91d13 Mon Sep 17 00:00:00 2001
+From: Twaik Yont <9674930+twaik@users.noreply.github.com>
+Date: Thu, 10 Apr 2025 17:55:58 +0300
+Subject: [PATCH xserver 34/51] os: use close-on-exec for X server socket to
+ prevent fd leaks
+
+In most typical Linux X servers (like Xvfb, Xephyr, or Xwayland), no child process outlives the server, so this issue rarely arises. However, in embedded X servers (based on Xvfb or Kdrive) or in custom Xorg modules, the server might launch a long-running command with regular fork+exec calls. If the X server crashes or exits while that command is still running (for example, it spawns a tombstone generator or any process that hangs or turns to zombie), the file descriptor associated with the abstract socket can remain open in the child process. This leads to the kernel refusing to allow another X server to bind the same socket until the child process terminates (because there is no explicit way to unlink abstract socket, unlike Unix socket). By marking the file descriptor as close-on-exec, we ensure it is automatically closed in child processes, preserving the ability of a new X server process to bind the socket immediately.
+
+Signed-off-by: Twaik Yont <9674930+twaik@users.noreply.github.com>
+(cherry picked from commit 5568b0f83f388a295f42d49411ced17387043794)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ os/connection.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/os/connection.c b/os/connection.c
+index 32d2cda2a..406f8763e 100644
+--- a/os/connection.c
+++ b/os/connection.c
+@@ -283,6 +283,7 @@ CreateWellKnownSockets(void)
+         int fd = _XSERVTransGetConnectionNumber(ListenTransConns[i]);
+ 
+         ListenTransFds[i] = fd;
+        _XSERVTransSetOption(ListenTransConns[i], TRANS_CLOSEONEXEC, 0);
+         SetNotifyFd(fd, QueueNewConnections, X_NOTIFY_READ, NULL);
+ 
+         if (!_XSERVTransIsLocal(ListenTransConns[i]))
+-- 
+2.54.0
+
--- a/0035-xf86bigfont-fix-Wimplicit-function-declaration-error.patch
+++ b/0035-xf86bigfont-fix-Wimplicit-function-declaration-error.patch
@ -0,0 +1,45 @@
+From 438c50a04248e7dcbd1f500bd5787034157b82c7 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 10 Aug 2025 09:43:33 -0700
+Subject: [PATCH xserver 35/51] xf86bigfont: fix
+ -Wimplicit-function-declaration error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Build breaks with gcc 14 & later when xf86bigfont is enabled:
+
+../Xext/xf86bigfont.c: In function ‘XFree86BigfontExtensionInit’:
+../Xext/xf86bigfont.c:709:28: error: implicit declaration of function
+ ‘xfont2_allocate_font_private_index’;
+ did you mean ‘AllocateFontPrivateIndex’? [-Wimplicit-function-declaration]
+  709 |         FontShmdescIndex = xfont2_allocate_font_private_index();
+      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+      |                            AllocateFontPrivateIndex
+
+Fixes: 05a793f5b ("dix: Switch to the libXfont2 API (v2)")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 0617f6075b6a867c90912ccaf9de2200d06a5419)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ Xext/xf86bigfont.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/Xext/xf86bigfont.c b/Xext/xf86bigfont.c
+index 529595bb7..13f7fbf10 100644
+--- a/Xext/xf86bigfont.c
+++ b/Xext/xf86bigfont.c
+@@ -58,6 +58,9 @@
+ 
+ #include <X11/X.h>
+ #include <X11/Xproto.h>
+#include <X11/fonts/fontstruct.h>
+#include <X11/fonts/libxfont2.h>
+
+ #include "misc.h"
+ #include "os.h"
+ #include "dixstruct.h"
+-- 
+2.54.0
+
--- a/0036-glamor-handle-potential-NULL-return-from-GetPictureS.patch
+++ b/0036-glamor-handle-potential-NULL-return-from-GetPictureS.patch
@ -0,0 +1,88 @@
+From 5a2199f57a361100edbab68d2feee192c51fc682 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 25 Oct 2025 15:33:40 -0700
+Subject: [PATCH xserver 36/51] glamor: handle potential NULL return from
+ GetPictureScreenIfSet()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Unlike GetPictureScreen(), GetPictureScreenIfSet() checks if the
+private key is registered, and returns NULL if it is not.
+
+Reported in #1817:
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor.c:926:5:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ps’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 69b48423bd66f04bac8a633004ebc8e6e691756f)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor.c | 38 +++++++++++++++++++++-----------------
+ 1 file changed, 21 insertions(+), 17 deletions(-)
+
+diff --git a/glamor/glamor.c b/glamor/glamor.c
+index abefef614..236c45d6d 100644
+--- a/glamor/glamor.c
+++ b/glamor/glamor.c
+@@ -711,23 +711,25 @@ glamor_init(ScreenPtr screen, unsigned int flags)
+     glamor_priv->saved_procs.bitmap_to_region = screen->BitmapToRegion;
+     screen->BitmapToRegion = glamor_bitmap_to_region;
+ 
+-    glamor_priv->saved_procs.composite = ps->Composite;
+-    ps->Composite = glamor_composite;
+    if (ps) {
+        glamor_priv->saved_procs.composite = ps->Composite;
+        ps->Composite = glamor_composite;
+ 
+-    glamor_priv->saved_procs.trapezoids = ps->Trapezoids;
+-    ps->Trapezoids = glamor_trapezoids;
+        glamor_priv->saved_procs.trapezoids = ps->Trapezoids;
+        ps->Trapezoids = glamor_trapezoids;
+ 
+-    glamor_priv->saved_procs.triangles = ps->Triangles;
+-    ps->Triangles = glamor_triangles;
+        glamor_priv->saved_procs.triangles = ps->Triangles;
+        ps->Triangles = glamor_triangles;
+ 
+-    glamor_priv->saved_procs.addtraps = ps->AddTraps;
+-    ps->AddTraps = glamor_add_traps;
+        glamor_priv->saved_procs.addtraps = ps->AddTraps;
+        ps->AddTraps = glamor_add_traps;
+ 
+-    glamor_priv->saved_procs.composite_rects = ps->CompositeRects;
+-    ps->CompositeRects = glamor_composite_rectangles;
+        glamor_priv->saved_procs.composite_rects = ps->CompositeRects;
+        ps->CompositeRects = glamor_composite_rectangles;
+ 
+-    glamor_priv->saved_procs.glyphs = ps->Glyphs;
+-    ps->Glyphs = glamor_composite_glyphs;
+        glamor_priv->saved_procs.glyphs = ps->Glyphs;
+        ps->Glyphs = glamor_composite_glyphs;
+    }
+ 
+     glamor_init_vbo(screen);
+     glamor_init_gradient_shader(screen);
+@@ -784,11 +786,13 @@ glamor_close_screen(ScreenPtr screen)
+     screen->BitmapToRegion = glamor_priv->saved_procs.bitmap_to_region;
+     screen->BlockHandler = glamor_priv->saved_procs.block_handler;
+ 
+-    ps->Composite = glamor_priv->saved_procs.composite;
+-    ps->Trapezoids = glamor_priv->saved_procs.trapezoids;
+-    ps->Triangles = glamor_priv->saved_procs.triangles;
+-    ps->CompositeRects = glamor_priv->saved_procs.composite_rects;
+-    ps->Glyphs = glamor_priv->saved_procs.glyphs;
+    if (ps) {
+        ps->Composite = glamor_priv->saved_procs.composite;
+        ps->Trapezoids = glamor_priv->saved_procs.trapezoids;
+        ps->Triangles = glamor_priv->saved_procs.triangles;
+        ps->CompositeRects = glamor_priv->saved_procs.composite_rects;
+        ps->Glyphs = glamor_priv->saved_procs.glyphs;
+    }
+ 
+     screen_pixmap = screen->GetScreenPixmap(screen);
+     glamor_pixmap_destroy_fbo(screen_pixmap);
+-- 
+2.54.0
+
--- a/0037-glamor-handle-allocation-failure-in-glamor_create_pi.patch
+++ b/0037-glamor-handle-allocation-failure-in-glamor_create_pi.patch
@ -0,0 +1,45 @@
+From 557660af8831f2395e40ad9019104d2119d3cb20 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sat, 25 Oct 2025 16:27:34 -0700
+Subject: [PATCH xserver 37/51] glamor: handle allocation failure in
+ glamor_create_pixmap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported by gcc 15.1:
+
+../glamor/glamor.c: In function ‘glamor_create_pixmap’:
+../glamor/glamor.c:233:23: warning: potential null pointer dereference
+ [-Wnull-dereference]
+  233 |     pixmap_priv->type = GLAMOR_TEXTURE_ONLY;
+      |     ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
+../glamor/glamor.c:228:26: warning: potential null pointer dereference
+ [-Wnull-dereference]
+  228 |     pixmap_priv->is_cbcr = (GLAMOR_CREATE_FORMAT_CBCR & usage) == GLAMOR_CREATE_FORMAT_CBCR;
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit cc647f23679ae2beb7b971aa7d1203375c25bb55)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/glamor/glamor.c b/glamor/glamor.c
+index 236c45d6d..01fb3ac80 100644
+--- a/glamor/glamor.c
+++ b/glamor/glamor.c
+@@ -220,6 +220,9 @@ glamor_create_pixmap(ScreenPtr screen, int w, int h, int depth,
+     else
+         pixmap = fbCreatePixmap(screen, 0, 0, depth, usage);
+ 
+    if (!pixmap)
+        return NullPixmap;
+
+     pixmap_priv = glamor_get_pixmap_private(pixmap);
+ 
+     format = gl_iformat_for_pixmap(pixmap);
+-- 
+2.54.0
+
--- a/0038-glamor-silence-false-positive-in-glamor_validate_gc.patch
+++ b/0038-glamor-silence-false-positive-in-glamor_validate_gc.patch
@ -0,0 +1,41 @@
+From 7a65240a6e20590814c44ab2286108c59446ba1f Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 26 Oct 2025 12:56:13 -0700
+Subject: [PATCH xserver 38/51] glamor: silence false positive in
+ glamor_validate_gc()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We know that if gc->tileIsPixel is false, then gc->tile.pixmap must be
+a valid pixmap, but gcc's static analyzer doesn't and needs to be told.
+
+Silences false positive reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_core.c:205:19:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit a79bdc495eaabd770cec03badd74c3b023877ba1)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor_core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/glamor/glamor_core.c b/glamor/glamor_core.c
+index cb315e2d1..05e37a162 100644
+--- a/glamor/glamor_core.c
+++ b/glamor/glamor_core.c
+@@ -199,6 +199,8 @@ glamor_validate_gc(GCPtr gc, unsigned long changes, DrawablePtr drawable)
+      */
+     if (changes & GCTile) {
+         if (!gc->tileIsPixel) {
+            assert(gc->tile.pixmap != NullPixmap);
+
+             glamor_pixmap_private *pixmap_priv =
+                 glamor_get_pixmap_private(gc->tile.pixmap);
+             if ((!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
+-- 
+2.54.0
+
--- a/0039-glamor-handle-allocation-failures-in-glamor_largepix.patch
+++ b/0039-glamor-handle-allocation-failures-in-glamor_largepix.patch
@ -0,0 +1,93 @@
+From c58f85aaaea2613c3049a6032d75d2422d748c71 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 26 Oct 2025 15:39:47 -0700
+Subject: [PATCH xserver 39/51] glamor: handle allocation failures in
+ glamor_largepixmap.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:130:17:
+ warning[-Wanalyzer-possible-null-dereference]:
+  dereference of possibly-NULL ‘clipped_regions’
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:235:13:
+ warning[-Wanalyzer-possible-null-dereference]:
+  dereference of possibly-NULL ‘result_regions’
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:365:9:
+ warning[-Wanalyzer-possible-null-dereference]:
+  dereference of possibly-NULL ‘clipped_regions’
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:1175:9:
+ warning[-Wanalyzer-possible-null-dereference]:
+  dereference of possibly-NULL ‘source_pixmap_priv’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 84cf20e6ddacbfc62637f156a92d673574c43604)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor_largepixmap.c | 23 +++++++++++++++++++----
+ 1 file changed, 19 insertions(+), 4 deletions(-)
+
+diff --git a/glamor/glamor_largepixmap.c b/glamor/glamor_largepixmap.c
+index f9adb93bc..ba347e3d2 100644
+--- a/glamor/glamor_largepixmap.c
+++ b/glamor/glamor_largepixmap.c
+@@ -77,6 +77,10 @@ __glamor_compute_clipped_regions(int block_w,
+     clipped_regions = calloc((end_block_x - start_block_x + 1)
+                              * (end_block_y - start_block_y + 1),
+                              sizeof(*clipped_regions));
+    if (clipped_regions == NULL) {
+        *n_region = 0;
+        return NULL;
+    }
+ 
+     DEBUGF("startx %d starty %d endx %d endy %d \n",
+            start_x, start_y, end_x, end_y);
+@@ -216,6 +220,11 @@ glamor_compute_clipped_regions_ext(PixmapPtr pixmap,
+                                inner_block_w)
+                             * ((block_h + inner_block_h - 1) /
+                                inner_block_h), sizeof(*result_regions));
+    if (result_regions == NULL) {
+        *n_region = 0;
+        free(clipped_regions);
+        return NULL;
+    }
+     k = 0;
+     for (i = 0; i < *n_region; i++) {
+         x = box_array[clipped_regions[i].block_idx].x1;
+@@ -362,10 +371,14 @@ _glamor_compute_clipped_regions(PixmapPtr pixmap,
+     DEBUGRegionPrint(region);
+     if (glamor_pixmap_priv_is_small(pixmap_priv)) {
+         clipped_regions = calloc(1, sizeof(*clipped_regions));
+-        clipped_regions[0].region = RegionCreate(NULL, 1);
+-        clipped_regions[0].block_idx = 0;
+-        RegionCopy(clipped_regions[0].region, region);
+-        *n_region = 1;
+        if (clipped_regions) {
+            clipped_regions[0].region = RegionCreate(NULL, 1);
+            clipped_regions[0].block_idx = 0;
+            RegionCopy(clipped_regions[0].region, region);
+            *n_region = 1;
+        }
+        else
+            *n_region = 0;
+         return clipped_regions;
+     }
+ 
+@@ -1172,6 +1185,8 @@ glamor_composite_largepixmap_region(CARD8 op,
+         /* XXX self-copy... */
+         need_free_source_pixmap_priv = source_pixmap_priv;
+         source_pixmap_priv = malloc(sizeof(*source_pixmap_priv));
+        if (source_pixmap_priv == NULL)
+            return FALSE;
+         *source_pixmap_priv = *need_free_source_pixmap_priv;
+         need_free_source_pixmap_priv = source_pixmap_priv;
+     }
+-- 
+2.54.0
+
--- a/0040-glamor-avoid-null-dereference-in-glamor_dash_setup.patch
+++ b/0040-glamor-avoid-null-dereference-in-glamor_dash_setup.patch
@ -0,0 +1,38 @@
+From b04a54c567eb0f31bc7d58e47d1adf6b04b3c981 Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Tue, 28 Oct 2025 18:16:00 -0700
+Subject: [PATCH xserver 40/51] glamor: avoid null dereference in
+ glamor_dash_setup()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_dash.c:152:10:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit c6522229b86f9087347b17280b6e5f19345baf9a)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor_dash.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/glamor/glamor_dash.c b/glamor/glamor_dash.c
+index b53ce5c50..ec8bf36bf 100644
+--- a/glamor/glamor_dash.c
+++ b/glamor/glamor_dash.c
+@@ -149,7 +149,7 @@ glamor_dash_setup(DrawablePtr drawable, GCPtr gc)
+     dash_pixmap = glamor_get_dash_pixmap(gc);
+     dash_priv = glamor_get_pixmap_private(dash_pixmap);
+ 
+-    if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv))
+    if (!dash_priv || !GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv))
+         goto bail;
+ 
+     glamor_make_current(glamor_priv);
+-- 
+2.54.0
+
--- a/0041-glamor-avoid-null-dereference-in-glamor_composite_cl.patch
+++ b/0041-glamor-avoid-null-dereference-in-glamor_composite_cl.patch
@ -0,0 +1,38 @@
+From 3ab3771224837193aaae44d95b4f7dd6552c64ad Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 2 Nov 2025 11:23:37 -0800
+Subject: [PATCH xserver 41/51] glamor: avoid null dereference in
+ glamor_composite_clipped_region()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported in #1817:
+
+xwayland-24.1.6/redhat-linux-build/../glamor/glamor_render.c:1577:21:
+ warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
+
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 6a4ec30af49bcbf61cf8ebc3a8f5541abac9024d)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor_render.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/glamor/glamor_render.c b/glamor/glamor_render.c
+index d5737018f..7a037e47c 100644
+--- a/glamor/glamor_render.c
+++ b/glamor/glamor_render.c
+@@ -1465,7 +1465,7 @@ glamor_composite_clipped_region(CARD8 op,
+     if (source
+         && ((!source->pDrawable
+              && (source->pSourcePict->type != SourcePictTypeSolidFill))
+-            || (source->pDrawable
+            || (source->pDrawable && source_pixmap
+                 && !GLAMOR_PIXMAP_PRIV_HAS_FBO(source_pixmap_priv)
+                 && (source_pixmap->drawable.width != width
+                     || source_pixmap->drawable.height != height)))) {
+-- 
+2.54.0
+
--- a/0042-glamor-avoid-double-free-in-glamor_make_pixmap_expor.patch
+++ b/0042-glamor-avoid-double-free-in-glamor_make_pixmap_expor.patch
@ -0,0 +1,49 @@
+From 90358719e7eec514929256d3cf75f2dbe132f97d Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Sun, 2 Nov 2025 12:16:56 -0800
+Subject: [PATCH xserver 42/51] glamor: avoid double free in
+ glamor_make_pixmap_exportable()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reported by gcc 15.1:
+
+../glamor/glamor_egl.c:320:9:
+ warning: double-‘free’ of ‘modifiers’ [CWE-415] [-Wanalyzer-double-free]
+[...]
+           │  732 |│        free(*modifiers);
+           │      |│        ~~~~~~~~~~~~~~~~
+           │      |│        |
+           │      |└───────>(25) ...to here
+           │      |         (26) first ‘free’ here
+[...]
+    │  320 |         free(modifiers);
+    │      |         ~~~~~~~~~~~~~~~
+    │      |         |
+    │      |         (28) ⚠️  second ‘free’ here; first ‘free’ was at (26)
+
+Fixes: cef12efc1 ("glamor: Implement GetSupportedModifiers")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+(cherry picked from commit 3e9baa20f39b0502efdaf48c2ca7e2f58d1e3120)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
+---
+ glamor/glamor_egl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
+index 4120c2e7d..3687eb675 100644
+--- a/glamor/glamor_egl.c
+++ b/glamor/glamor_egl.c
+@@ -680,6 +680,7 @@ glamor_get_modifiers(ScreenPtr screen, uint32_t format,
+     if (!eglQueryDmaBufModifiersEXT(glamor_egl->display, format, num,
+                                     (EGLuint64KHR *) *modifiers, NULL, &num)) {
+         free(*modifiers);
+        *modifiers = NULL;
+         return FALSE;
+     }
+ 
+-- 
+2.54.0
+
--- a/0043-xkb-fix-incorrect-size-check-when-growing-doodads-in.patch
+++ b/0043-xkb-fix-incorrect-size-check-when-growing-doodads-in.patch
@ -0,0 +1,41 @@
+From 0458dead41dbea8b4675c86d7151a62b7efa6237 Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+Date: Tue, 14 Apr 2026 12:06:51 +0300
+Subject: [PATCH xserver 43/51] xkb: fix incorrect size check when growing
+ doodads in a section
+
+In XkbAddGeomDoodad(), when adding a doodad to a specific section
+(section != NULL), there is a comparison between section->num_doodads
+and geom->sz_doodads instead of the section's own section->sz_doodads.
+
+The else branch (global geometry doodads) was already correct.
+
+Compare section->num_doodads against section->sz_doodads to prevent
+a potential out-of-bounds.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit dd8b8cf49d326802c53b01835618a7e3765d91cb)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ xkb/XKBGAlloc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xkb/XKBGAlloc.c b/xkb/XKBGAlloc.c
+index f0cda24fe..9b71f6121 100644
+--- a/xkb/XKBGAlloc.c
+++ b/xkb/XKBGAlloc.c
+@@ -769,7 +769,7 @@ XkbAddGeomDoodad(XkbGeometryPtr geom, XkbSectionPtr section, Atom name)
+             return doodad;
+     }
+     if (section) {
+-        if ((section->num_doodads >= geom->sz_doodads) &&
+        if ((section->num_doodads >= section->sz_doodads) &&
+             (_XkbAllocDoodads(section, 1) != Success)) {
+             return NULL;
+         }
+-- 
+2.54.0
+
--- a/0044-xkb-fix-potential-buff-overflow-in-XkbVModIndexText-.patch
+++ b/0044-xkb-fix-potential-buff-overflow-in-XkbVModIndexText-.patch
@ -0,0 +1,43 @@
+From 6164f19b0df91d77d814ae7ee4e0876f2583cffe Mon Sep 17 00:00:00 2001
+From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+Date: Tue, 14 Apr 2026 13:22:35 +0300
+Subject: [PATCH xserver 44/51] xkb: fix potential buff overflow in
+ XkbVModIndexText for XkbCFile format
+
+len calculation and strncpy limit were off by one when prefixing
+"vmod_" to the virtual modifier name. This could write the final
+NULL one byte past the allocated buffer from tbGetBuffer().
+
+Use proper allocation len for prefix to avoid writing out-of-bounds.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE
+
+Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
+(cherry picked from commit 5dfb435c1d864bf154369cb86d085d4159730378)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ xkb/xkbtext.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
+index 002626450..c2db41f7a 100644
+--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
+@@ -129,11 +129,11 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format)
+ 
+     len = strlen(tmp) + 1;
+     if (format == XkbCFile)
+-        len += 4;
+        len += 5;
+     rtrn = tbGetBuffer(len);
+     if (format == XkbCFile) {
+         strcpy(rtrn, "vmod_");
+-        strncpy(&rtrn[5], tmp, len - 4);
+        strncpy(&rtrn[5], tmp, len - 5);
+     }
+     else
+         strncpy(rtrn, tmp, len);
+-- 
+2.54.0
+
--- a/0045-Xi-add-missing-gesture-grab-type-checks-in-ProcXIPas.patch
+++ b/0045-Xi-add-missing-gesture-grab-type-checks-in-ProcXIPas.patch
@ -0,0 +1,37 @@
+From 085be53420c299c81a1637f9f433c7eb3a472967 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 29 Apr 2026 05:59:12 +0000
+Subject: [PATCH xserver 45/51] Xi: add missing gesture grab type checks in
+ ProcXIPassiveUngrabDevice
+
+ProcXIPassiveUngrabDevice was missing XIGrabtypeGesturePinchBegin and
+XIGrabtypeGestureSwipeBegin from its detail!=0 rejection check. The
+corresponding ProcXIPassiveGrabDevice function correctly includes
+these gesture types.
+
+Assisted-by: Claude:claude-claude-opus-4-6
+(cherry picked from commit 90954812496770f4903a024cb610404a8dd882ad)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ Xi/xipassivegrab.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
+index bf9b09482..dca9f1a4e 100644
+--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
+@@ -317,7 +317,9 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
+ 
+     if ((stuff->grab_type == XIGrabtypeEnter ||
+          stuff->grab_type == XIGrabtypeFocusIn ||
+-         stuff->grab_type == XIGrabtypeTouchBegin) && stuff->detail != 0) {
+         stuff->grab_type == XIGrabtypeTouchBegin ||
+         stuff->grab_type == XIGrabtypeGesturePinchBegin ||
+         stuff->grab_type == XIGrabtypeGestureSwipeBegin) && stuff->detail != 0) {
+         client->errorValue = stuff->detail;
+         return BadValue;
+     }
+-- 
+2.54.0
+
--- a/0046-xkb-Fix-out-of-bounds-array-access-in-_CheckSetShape.patch
+++ b/0046-xkb-Fix-out-of-bounds-array-access-in-_CheckSetShape.patch
@ -0,0 +1,52 @@
+From 2cafacd074770724046ee3add86467dd6a71e72e Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Sat, 18 Apr 2026 07:34:51 +1000
+Subject: [PATCH xserver 46/51] xkb: Fix out-of-bounds array access in
+ _CheckSetShapes()
+
+The primaryNdx and approxNdx fields in the shape wire description are
+attacker-controlled CARD8 values from the client request. They are used
+to index into the shape->outlines[] array, but were only checked against
+XkbNoShape (0xff) and never validated against the actual number of
+outlines (shapeWire->nOutlines).
+
+Assisted-by: Claude:claude-claude-opus-4-6
+(cherry picked from commit 86a321ad98213957bbb56f295417b0939326718b)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ xkb/xkb.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 887b87b07..c1ec0c516 100644
+--- a/xkb/xkb.c
+++ b/xkb/xkb.c
+@@ -5566,10 +5566,22 @@ _CheckSetShapes(XkbGeometryPtr geom,
+                 ol->num_points = olWire->nPoints;
+                 olWire = (xkbOutlineWireDesc *)ptWire;
+             }
+-            if (shapeWire->primaryNdx != XkbNoShape)
+            if (shapeWire->primaryNdx != XkbNoShape) {
+                if (shapeWire->primaryNdx >= shapeWire->nOutlines) {
+                    client->errorValue = _XkbErrCode3(0x08, shapeWire->primaryNdx,
+                                                      shapeWire->nOutlines);
+                    return BadValue;
+                }
+                 shape->primary = &shape->outlines[shapeWire->primaryNdx];
+-            if (shapeWire->approxNdx != XkbNoShape)
+            }
+            if (shapeWire->approxNdx != XkbNoShape) {
+                if (shapeWire->approxNdx >= shapeWire->nOutlines) {
+                    client->errorValue = _XkbErrCode3(0x08, shapeWire->approxNdx,
+                                                      shapeWire->nOutlines);
+                    return BadValue;
+                }
+                 shape->approx = &shape->outlines[shapeWire->approxNdx];
+            }
+             shapeWire = (xkbShapeWireDesc *) olWire;
+         }
+         wire = (char *) shapeWire;
+-- 
+2.54.0
+
--- a/0047-xkb-Fix-off-by-one-in-color-index-validation-in-_Che.patch
+++ b/0047-xkb-Fix-off-by-one-in-color-index-validation-in-_Che.patch
@ -0,0 +1,41 @@
+From b81807ab582993a0a45ccb4feb28dccf88ac3fed Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Sat, 18 Apr 2026 07:35:15 +1000
+Subject: [PATCH xserver 47/51] xkb: Fix off-by-one in color index validation
+ in _CheckSetGeom()
+
+The bounds checks for baseColorNdx and labelColorNdx in _CheckSetGeom()
+use '>' instead of '>=' when comparing against req->nColors. Since
+nColors is a count and valid indices are 0 to nColors-1, an index equal
+to nColors is one past the end of the array.
+
+Assisted-by: Claude:claude-claude-opus-4-6
+(cherry picked from commit 6b6e8020b902e48e3330f9a54cd439a51988bc50)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ xkb/xkb.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index c1ec0c516..c6e2bf40c 100644
+--- a/xkb/xkb.c
+++ b/xkb/xkb.c
+@@ -5631,12 +5631,12 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
+         client->errorValue = _XkbErrCode3(0x01, 2, req->nColors);
+         return BadValue;
+     }
+-    if (req->baseColorNdx > req->nColors) {
+    if (req->baseColorNdx >= req->nColors) {
+         client->errorValue =
+             _XkbErrCode3(0x03, req->nColors, req->baseColorNdx);
+         return BadMatch;
+     }
+-    if (req->labelColorNdx > req->nColors) {
+    if (req->labelColorNdx >= req->nColors) {
+         client->errorValue =
+             _XkbErrCode3(0x03, req->nColors, req->labelColorNdx);
+         return BadMatch;
+-- 
+2.54.0
+
--- a/0048-xkb-Fix-off-by-one-and-NULL-dereferences-in-_CheckSe.patch
+++ b/0048-xkb-Fix-off-by-one-and-NULL-dereferences-in-_CheckSe.patch
@ -0,0 +1,55 @@
+From a1b025ef5278cd9e404136e9b4ef9aa769112533 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Sat, 18 Apr 2026 07:35:53 +1000
+Subject: [PATCH xserver 48/51] xkb: Fix off-by-one and NULL dereferences in
+ _CheckSetOverlay()
+
+Off-by-one in rowUnder validation: the bounds check uses '>' instead
+of '>=' when comparing rWire->rowUnder against section->num_rows.
+Since num_rows is a count and valid indices are 0 to num_rows-1,
+rowUnder == num_rows passes the check but is one past the valid range.
+XkbAddGeomOverlayRow() uses this as an array index, causing an
+out-of-bounds read on section->rows[].
+
+And throw in two alloc checks while we're at it.
+
+Assisted-by: Claude:claude-claude-opus-4-6
+(cherry picked from commit ed19312c4bda0a8f66b236348ffc553e5d8d2a09)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ xkb/xkb.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index c6e2bf40c..b2c2dfa24 100644
+--- a/xkb/xkb.c
+++ b/xkb/xkb.c
+@@ -5362,6 +5362,8 @@ _CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
+     }
+     CHK_ATOM_ONLY(olWire->name);
+     ol = XkbAddGeomOverlay(section, olWire->name, olWire->nRows);
+    if (!ol)
+        return BadAlloc;
+     rWire = (xkbOverlayRowWireDesc *) &olWire[1];
+     for (r = 0; r < olWire->nRows; r++) {
+         register int k;
+@@ -5371,12 +5373,14 @@ _CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
+         if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
+             return BadLength;
+ 
+-        if (rWire->rowUnder > section->num_rows) {
+        if (rWire->rowUnder >= section->num_rows) {
+             client->errorValue = _XkbErrCode4(0x20, r, section->num_rows,
+                                               rWire->rowUnder);
+             return BadMatch;
+         }
+         row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys);
+        if (!row)
+            return BadAlloc;
+         kWire = (xkbOverlayKeyWireDesc *) &rWire[1];
+         for (k = 0; k < rWire->nKeys; k++, kWire++) {
+             if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
+-- 
+2.54.0
+
--- a/0049-xkb-Add-bounds-check-for-action-data-in-CheckKeyActi.patch
+++ b/0049-xkb-Add-bounds-check-for-action-data-in-CheckKeyActi.patch
@ -0,0 +1,50 @@
+From fa79e0f32fbdae0591fe07307ea4bf3ff2541fc2 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Sat, 18 Apr 2026 07:38:14 +1000
+Subject: [PATCH xserver 49/51] xkb: Add bounds check for action data in
+ CheckKeyActions()
+
+CheckKeyActions() validates the per-key action count bytes individually
+but does not verify that the computed total action data region falls
+within the request buffer before advancing the wire pointer past it.
+
+After the loop, the function calculates the final wire position as
+wire + nActs * sizeof(XkbAnyAction), where nActs is the sum of per-key
+action counts read from the request. The upstream length validation in
+_XkbSetMapCheckLength() uses req->totalActs from the request header,
+not the computed nActs. If a crafted request provides a totalActs value
+that passes the length check but per-key action counts that sum to a
+different nActs, the wire pointer could advance past the actual request
+buffer.
+
+The subsequent SetKeyActions() function uses memcpy to read from this
+potentially out-of-bounds region, which could leak heap data or cause
+a crash.
+
+Assisted-by: Claude:claude-claude-opus-4-6
+(cherry picked from commit a439a7340ad976983ef34eca4f537831b38e191f)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ xkb/xkb.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index b2c2dfa24..fc0476056 100644
+--- a/xkb/xkb.c
+++ b/xkb/xkb.c
+@@ -1863,6 +1863,11 @@ CheckKeyActions(ClientPtr client,
+     if (req->nKeyActs % 4)
+         wire += 4 - (req->nKeyActs % 4);
+     *wireRtrn = (CARD8 *) (((XkbAnyAction *) wire) + nActs);
+    if (nActs > 0 &&
+        !_XkbCheckRequestBounds(client, req, wire, *wireRtrn)) {
+        *nActsRtrn = _XkbErrCode2(0x25, nActs);
+        return 0;
+    }
+     *nActsRtrn = nActs;
+     return 1;
+ }
+-- 
+2.54.0
+
--- a/0050-present-actually-return-the-created-notifies.patch
+++ b/0050-present-actually-return-the-created-notifies.patch
@ -0,0 +1,35 @@
+From 698d94109a7839785857b9b6295df37e26b58337 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 6 May 2026 11:45:15 +1000
+Subject: [PATCH xserver 50/51] present: actually return the created notifies
+
+present_create_notifies() creates an array of notifies but never returns
+them to the caller, despite them being passed individually to
+present_add_window_notify(). The caller proceeds with a NULL notifies
+array, eventually causing an OOB in present_vblank_notify() when
+vblank->notifies is NULL.
+
+Reported-by: Feng Ning, Innora Pte. Ltd.
+(cherry picked from commit f70cc16c6831c9faa14c1f2a8588c6efb6ede263)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ present/present_notify.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/present/present_notify.c b/present/present_notify.c
+index 924de380a..69dfe62b4 100644
+--- a/present/present_notify.c
+++ b/present/present_notify.c
+@@ -96,6 +96,8 @@ present_create_notifies(ClientPtr client, int num_notifies, xPresentNotify *x_no
+ 
+         added++;
+     }
+
+    *p_notifies = notifies;
+     return Success;
+ 
+ bail:
+-- 
+2.54.0
+
--- a/0051-glx-reject-negative-size-in-FeedbackBuffer-and-Selec.patch
+++ b/0051-glx-reject-negative-size-in-FeedbackBuffer-and-Selec.patch
@ -0,0 +1,70 @@
+From 0eb7bf6f31e0af293f3b92b6ed11d5e3bb998302 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 17 Apr 2026 12:02:13 +1000
+Subject: [PATCH xserver 51/51] glx: reject negative size in FeedbackBuffer and
+ SelectBuffer requests
+
+Assisted-by: Claude:claude-claude-opus-4-6
+(cherry picked from commit 54860e6c7f513739adf225a7998004f230db81a0)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
+---
+ glx/single2.c     | 8 ++++++++
+ glx/single2swap.c | 8 ++++++++
+ 2 files changed, 16 insertions(+)
+
+diff --git a/glx/single2.c b/glx/single2.c
+index 36a01f0cb..948d00f1d 100644
+--- a/glx/single2.c
+++ b/glx/single2.c
+@@ -61,6 +61,10 @@ __glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
+     pc += __GLX_SINGLE_HDR_SIZE;
+     size = *(GLsizei *) (pc + 0);
+     type = *(GLenum *) (pc + 4);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
+     if (cx->feedbackBufSize < size) {
+         cx->feedbackBuf = reallocarray(cx->feedbackBuf,
+                                        (size_t) size, __GLX_SIZE_FLOAT32);
+@@ -91,6 +95,10 @@ __glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
+ 
+     pc += __GLX_SINGLE_HDR_SIZE;
+     size = *(GLsizei *) (pc + 0);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
+     if (cx->selectBufSize < size) {
+         cx->selectBuf = reallocarray(cx->selectBuf,
+                                      (size_t) size, __GLX_SIZE_CARD32);
+diff --git a/glx/single2swap.c b/glx/single2swap.c
+index b140946ba..fdc093900 100644
+--- a/glx/single2swap.c
+++ b/glx/single2swap.c
+@@ -62,6 +62,10 @@ __glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
+     __GLX_SWAP_INT(pc + 4);
+     size = *(GLsizei *) (pc + 0);
+     type = *(GLenum *) (pc + 4);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
+     if (cx->feedbackBufSize < size) {
+         cx->feedbackBuf = reallocarray(cx->feedbackBuf,
+                                        (size_t) size, __GLX_SIZE_FLOAT32);
+@@ -96,6 +100,10 @@ __glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
+     pc += __GLX_SINGLE_HDR_SIZE;
+     __GLX_SWAP_INT(pc + 0);
+     size = *(GLsizei *) (pc + 0);
+    if (size < 0) {
+        cl->client->errorValue = size;
+        return BadValue;
+    }
+     if (cx->selectBufSize < size) {
+         cx->selectBuf = reallocarray(cx->selectBuf,
+                                      (size_t) size, __GLX_SIZE_CARD32);
+-- 
+2.54.0
+
--- a/xorg-x11-server.spec
+++ b/xorg-x11-server.spec
@ -42,7 +42,7 @@
 Summary:   X.Org X11 X server
 Name:      xorg-x11-server
 Version:   1.20.11
-Release:   36%{?gitdate:.%{gitdate}}%{?dist}
+Release:   37%{?gitdate:.%{gitdate}}%{?dist}
 URL:       http://www.x.org
 License:   MIT

@ -276,6 +276,62 @@ Patch10087: 0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch
 # CVE-2026-50264 - DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write
 Patch10088: 0008-dri2-Use-booleans-for-fake-front-buffer-tracking-in-.patch
 Patch10089: 0009-dri2-Deduplicate-attachments-in-do_get_buffer.patch
+# Other security related fixes
+Patch10090: 0001-os-avoid-potential-out-of-bounds-access-at-logVHdrMe.patch
+Patch10091: 0002-dix-avoid-null-ptr-deref-at-doListFontsWithInfo.patch
+Patch10092: 0003-panoramix-avoid-null-dereference-in-PanoramiXMaybeAd.patch
+Patch10093: 0004-panoramix-avoid-null-dereference-in-PanoramiXConsoli.patch
+Patch10094: 0005-Xext-shm-avoid-null-dereference-in-ShmInitScreenPriv.patch
+Patch10095: 0006-Xext-sync-avoid-null-dereference-if-SysCounterGetPri.patch
+Patch10096: 0007-Xext-sync-avoid-null-dereference-in-init_system_idle.patch
+Patch10097: 0008-Xext-sync-Avoid-dereference-of-invalid-pointer-if-ma.patch
+Patch10098: 0009-Xext-vidmode-avoid-null-dereference-if-VidModeCreate.patch
+Patch10099: 0010-Xext-xres-avoid-null-dereference-in-ProcXResQueryCli.patch
+Patch10100: 0011-Xext-xselinux-add-fast-path-to-ProcSELinuxListSelect.patch
+Patch10101: 0012-Xext-xselinux-avoid-memory-leak-in-SELinuxAtomToSID.patch
+Patch10102: 0013-Xext-xtest-avoid-null-dereference-in-ProcXTestFakeIn.patch
+Patch10103: 0014-Xi-avoid-null-dereference-if-wOtherInputMasks-return.patch
+Patch10104: 0015-Xi-set-value-for-led_values-in-CopySwapKbdFeedback.patch
+Patch10105: 0016-Xi-handle-allocation-failure-in-ProcXGetDeviceDontPr.patch
+Patch10106: 0017-Xi-handle-allocation-failure-in-ProcXListInputDevice.patch
+Patch10107: 0018-Xi-handle-allocation-failure-in-add_master_func.patch
+Patch10108: 0019-dix-handle-allocation-failure-in-DeviceFocusEvent.patch
+Patch10109: 0020-dix-avoid-null-dereference-if-wOtherInputMasks-retur.patch
+Patch10110: 0021-dix-assert-that-size-of-buffers-to-swap-is-a-multipl.patch
+Patch10111: 0022-dix-handle-allocation-failure-in-ChangeWindowDeviceC.patch
+Patch10112: 0023-xfree86-Fix-builds-with-gcc-Wpedantic.patch
+Patch10113: 0024-dix-set-errorValue-correctly-when-XID-lookup-fails-i.patch
+Patch10114: 0025-os-avoid-closing-null-fd-at-Fopen.patch
+Patch10115: 0026-render-fix-multiple-mem-leaks-on-err-paths.patch
+Patch10116: 0027-dix-avoid-null-ptr-deref-at-doListFontsAndAliases.patch
+Patch10117: 0028-randr-clear-primary-screen-s-primaryOutput-when-the-.patch
+Patch10118: 0029-Make-xf86CompatOutput-return-NULL-when-there-are-no-.patch
+Patch10119: 0030-Better-fix-for-xf86CompatOut-when-there-are-no-priva.patch
+Patch10120: 0031-xf86-check-return-value-of-XF86_CRTC_CONFIG_PTR-in-x.patch
+Patch10121: 0032-os-include-assert.h-in-ospoll.c.patch
+Patch10122: 0033-os-make-FormatInt64-handle-LONG_MIN-correctly.patch
+Patch10123: 0034-os-use-close-on-exec-for-X-server-socket-to-prevent-.patch
+Patch10124: 0035-xf86bigfont-fix-Wimplicit-function-declaration-error.patch
+Patch10125: 0036-glamor-handle-potential-NULL-return-from-GetPictureS.patch
+Patch10126: 0037-glamor-handle-allocation-failure-in-glamor_create_pi.patch
+Patch10127: 0038-glamor-silence-false-positive-in-glamor_validate_gc.patch
+Patch10128: 0039-glamor-handle-allocation-failures-in-glamor_largepix.patch
+Patch10129: 0040-glamor-avoid-null-dereference-in-glamor_dash_setup.patch
+Patch10130: 0041-glamor-avoid-null-dereference-in-glamor_composite_cl.patch
+Patch10131: 0042-glamor-avoid-double-free-in-glamor_make_pixmap_expor.patch
+Patch10132: 0043-xkb-fix-incorrect-size-check-when-growing-doodads-in.patch
+Patch10133: 0044-xkb-fix-potential-buff-overflow-in-XkbVModIndexText-.patch
+Patch10134: 0045-Xi-add-missing-gesture-grab-type-checks-in-ProcXIPas.patch
+Patch10135: 0046-xkb-Fix-out-of-bounds-array-access-in-_CheckSetShape.patch
+Patch10136: 0047-xkb-Fix-off-by-one-in-color-index-validation-in-_Che.patch
+Patch10137: 0048-xkb-Fix-off-by-one-and-NULL-dereferences-in-_CheckSe.patch
+Patch10138: 0049-xkb-Add-bounds-check-for-action-data-in-CheckKeyActi.patch
+Patch10139: 0050-present-actually-return-the-created-notifies.patch
+Patch10140: 0051-glx-reject-negative-size-in-FeedbackBuffer-and-Selec.patch
+# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2237
+Patch10141: 0001-dix-Silence-a-compiler-warning-in-doListFontsAndAlia.patch
+# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1257
+Patch10142: 0001-xkb-fix-int-size-mismatch.patch

 BuildRequires: make
 BuildRequires: systemtap-sdt-devel
@ -686,6 +742,10 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete


 %changelog
+* Fri Jun 12 2026  Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-37
+- Other security related fixes
+  Resolves: https://redhat.atlassian.net/browse/RHEL-183891
+
 * Wed Jun 10 2026  Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-36
 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
               CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,