rpms/xorg-x11-server
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS xorg-x11-server-1.20.11-38.el9

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-24 09:47:58 -04:00
parent 34c62bd3fc
commit eeb316dd83
71 changed files with 4467 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
SOURCES/0001-dix-Silence-a-compiler-warning-in-doListFontsAndAlia.patch Normal file
View File

@ -0,0 +1,45 @@
From e710e570b1709d100072a8ab7d05c2aefaf41a1b Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Mon, 15 Jun 2026 14:00:19 +0200
Subject: [PATCH xserver] dix: Silence a compiler warning in
doListFontsAndAliases()
Compiler complains that "resolvedlen" might be uninitialized:
| dix/dixfonts.c:559:5: var_decl: Declaring variable "resolvedlen" without initializer.
| dix/dixfonts.c:674:17: uninit_use: Using uninitialized value "resolvedlen".
| 672| * is complete.
| 673| */
| 674|-> if (resolvedlen > XLFDMAXFONTNAMELEN) {
| 675| err = BadFontName;
| 676| goto ContBadFontName;
Most likely a false positive, while immediately after the (newly added)
test, there was a memcpy() using "resolvedlen" and the compiler did not
choke on that before.
Either way, initializing "resolvedlen" to 0 is a small price to pay to
silence the compiler warning and keep us on the safe side.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2237>
---
dix/dixfonts.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 3c6c9d594..cf2b45d4f 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -556,7 +556,7 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
int err = Successful;
FontNamesPtr names = NULL;
char *name, *resolved = NULL;
- int namelen, resolvedlen;
+ int namelen, resolvedlen = 0;
int nnames;
int stringLens;
int i;
--
2.54.0

68
SOURCES/0001-dri2-Protect-against-dri2ClientPrivate-assertion-fai.patch Normal file
View File

@ -0,0 +1,68 @@
From 0c6a7750f2ac9158ace8161f94f7e3bd4c9f5263 Mon Sep 17 00:00:00 2001
From: Doug Brown <doug@schmorgal.com>
Date: Mon, 15 Jul 2024 19:44:23 -0700
Subject: [PATCH xserver] dri2: Protect against dri2ClientPrivate assertion
failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
If DRI2ScreenInit hasn't been called yet, DRI2Authenticate and
DRI2CreateDrawable2 cause the X server to crash. This has been observed
to happen on multiple modern Linux distros in various conditions,
including QEMU and VMware VMs. Make these functions more robust in order
to prevent the crash.
This patch was originally provided by Bernhard Übelacker and expanded
upon by Mark Wagner.
Signed-off-by: Doug Brown <doug@schmorgal.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1053
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1534
(cherry picked from commit a0834009cfb10b8982a1f2b47b8ed00de254c2c3)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1824>
---
hw/xfree86/dri2/dri2.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 3397bb50c..3975d40ca 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -356,10 +356,15 @@ DRI2CreateDrawable2(ClientPtr client, DrawablePtr pDraw, XID id,
XID *dri2_id_out)
{
DRI2DrawablePtr pPriv;
- DRI2ClientPtr dri2_client = dri2ClientPrivate(client);
+ DRI2ClientPtr dri2_client;
XID dri2_id;
int rc;
+ if (!dixPrivateKeyRegistered(dri2ScreenPrivateKey))
+ return BadValue;
+
+ dri2_client = dri2ClientPrivate(client);
+
pPriv = DRI2GetDrawable(pDraw);
if (pPriv == NULL)
pPriv = DRI2AllocateDrawable(pDraw);
@@ -1362,9 +1367,14 @@ Bool
DRI2Authenticate(ClientPtr client, ScreenPtr pScreen, uint32_t magic)
{
DRI2ScreenPtr ds;
- DRI2ClientPtr dri2_client = dri2ClientPrivate(client);
+ DRI2ClientPtr dri2_client;
ScreenPtr primescreen;
+ if (!dixPrivateKeyRegistered(dri2ScreenPrivateKey))
+ return FALSE;
+
+ dri2_client = dri2ClientPrivate(client);
+
ds = DRI2GetScreenPrime(pScreen, dri2_client->prime_id);
if (ds == NULL)
return FALSE;
--
2.54.0

40
SOURCES/0001-os-avoid-potential-out-of-bounds-access-at-logVHdrMe.patch Normal file
View File

@ -0,0 +1,40 @@
From 5a3926455d74fe167af612ee11399c0f8cd896b5 Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
Date: Wed, 17 Sep 2025 17:29:49 +0300
Subject: [PATCH xserver 01/51] os: avoid potential out-of-bounds access at
logVHdrMessageVerb
The LogVHdrMessageVerb function may access an array out of bounds in a
specific edge case. Specifically, the line:
newline = (buf[len - 1] == '\n');
can result in accessing buf[-1] if len == 0, which is undefined behavior.
Commit adds check to avoid access out of bounds at pointed line.
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1841
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit 8d25a8914346824f820490ba7090175dea9428cd)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
os/log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/os/log.c b/os/log.c
index cc8219129..71210aee8 100644
--- a/os/log.c
+++ b/os/log.c
@@ -827,7 +827,7 @@ LogVHdrMessageVerb(MessageType type, int verb, const char *msg_format,
if (size - len == 1)
buf[len - 1] = '\n';
- newline = (buf[len - 1] == '\n');
+ newline = (len > 0 && buf[len - 1] == '\n');
LogSWrite(verb, buf, len, newline);
}
--
2.54.0

122
SOURCES/0001-sync-fix-deletion-of-counters-and-fences.patch Normal file
View File

@ -0,0 +1,122 @@
From 2b60d9c28c98f6d2c924c69c0dcbb2aa64b861eb Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 20 Apr 2026 11:16:13 +1000
Subject: [PATCH xserver 1/9] sync: fix deletion of counters and fences
Both FreeCounter() and miSyncDestroyFence() iterate over the trigger list
and invoke the CounterDestroyed callback on each trigger.
The CounterDestroyed callback (e.g. SyncAwaitTriggerFired) may call
FreeResource/FreeAwait, which frees the SyncAwaitUnion containing all
SyncAwait structs in the same Await group.
When multiple conditions in a single Await reference the same sync
object (counter or fence), the first callback frees all SyncAwait
structs while subsequent trigger list nodes still reference them. On the
next iteration, reading ptl->next or ptl->pTrigger dereferences freed
memory, leading to a use-after-free.
We need separate fixes for separate issues here to fix this in one go
- use our null-terminated list macro to make sure our next pointer stays
valid (the code accessed ptl->next after freeing it)
- update the list head before deleting the trigger, eventually this ends
up being NULL anyway but meanwhile the list head is a valid list
during CounterDestroyed
- check if we actually do have a trigger before dereferencing the
callback
- Set all triggers to NULL if they are shared so we don't dereference
potentially freed memory
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30159 (miSyncDestroyFence), ZDI-CAN-30163 (FreeCounter)
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit f5abfb61994471023d8c6470428c8e30c411cc0b)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
Xext/sync.c | 32 +++++++++++++++++++++++++-------
miext/sync/misync.c | 12 ++++++++----
2 files changed, 33 insertions(+), 11 deletions(-)
diff --git a/Xext/sync.c b/Xext/sync.c
index fd2ceb042..0079e85ed 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -1148,9 +1148,12 @@ FreeCounter(void *env, XID id)
SyncTriggerList *ptl, *pnext;
/* tell all the counter's triggers that counter has been destroyed */
- for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) {
- (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
- pnext = ptl->next;
+ nt_list_for_each_entry_safe(ptl, pnext, pCounter->sync.pTriglist, next) {
+ /* Remove it from the list first so CounterDestroyed
+ * callbacks have a valid list to iterate */
+ pCounter->sync.pTriglist = pnext;
+ if (ptl->pTrigger)
+ (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
free(ptl); /* destroy the trigger list as we go */
}
if (IsSystemCounter(pCounter)) {
@@ -1182,13 +1185,28 @@ FreeAwait(void *addr, XID id)
for (numwaits = pAwaitUnion->header.num_waitconditions; numwaits;
numwaits--, pAwait++) {
- /* If the counter is being destroyed, FreeCounter will delete
- * the trigger list itself, so don't do it here.
+ /* If the counter is being destroyed, FreeCounter/miSyncDestroyFence
+ * will delete the trigger list itself, so don't do it here.
+ * However, we must NULL out the pTrigger pointer in the trigger list
+ * node so the destroy loop knows not to dereference it - the backing
+ * SyncAwait memory is about to be freed below.
*/
SyncObject *pSync = pAwait->trigger.pSync;
- if (pSync && !pSync->beingDestroyed)
- SyncDeleteTriggerFromSyncObject(&pAwait->trigger);
+ if (pSync) {
+ if (!pSync->beingDestroyed) {
+ SyncDeleteTriggerFromSyncObject(&pAwait->trigger);
+ } else {
+ SyncTriggerList *ptl;
+
+ nt_list_for_each_entry(ptl, pSync->pTriglist, next) {
+ if (ptl->pTrigger == &pAwait->trigger) {
+ ptl->pTrigger = NULL;
+ break;
+ }
+ }
+ }
+ }
}
free(pAwaitUnion);
return Success;
diff --git a/miext/sync/misync.c b/miext/sync/misync.c
index 0931803f6..6a47d1cdd 100644
--- a/miext/sync/misync.c
+++ b/miext/sync/misync.c
@@ -115,10 +115,14 @@ miSyncDestroyFence(SyncFence * pFence)
SyncScreenPrivPtr pScreenPriv = SYNC_SCREEN_PRIV(pScreen);
SyncTriggerList *ptl, *pNext;
- /* tell all the fence's triggers that the counter has been destroyed */
- for (ptl = pFence->sync.pTriglist; ptl; ptl = pNext) {
- (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
- pNext = ptl->next;
+ /* tell all the fence's triggers that the fence has been destroyed.
+ * Update pTriglist before each callback and free so that FreeAwait
+ * sees a valid list head when scanning for triggers to NULL out.
+ */
+ nt_list_for_each_entry_safe(ptl, pNext, pFence->sync.pTriglist, next) {
+ pFence->sync.pTriglist = pNext;
+ if (ptl->pTrigger)
+ (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger);
free(ptl); /* destroy the trigger list as we go */
}
--
2.54.0

47
SOURCES/0001-xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch Normal file
View File

@ -0,0 +1,47 @@
From 750205e2a8ba90ce532b19a953e8dba221e62648 Mon Sep 17 00:00:00 2001
From: Peter Harris <pharris2@rocketsoftware.com>
Date: Thu, 15 Jan 2026 15:54:09 -0500
Subject: [PATCH xserver 1/6] xkb: fix buffer re-use in _XkbSetCompatMap
If the "compat" buffer has previously been truncated, there will be
unused space in the buffer. The code uses this space, but does not
update the number of valid entries in the buffer.
In the best case, this leads to the new compat entries being ignored. In the
worst case, if there are any "skipped" compat entries, the number of
valid entries will be corrupted, potentially leading to a buffer read
overrun when processing a future request.
Set the number of used "compat" entries when re-using previously
allocated space in the buffer.
CVE-2026-33999, ZDI-CAN-28593
This vulnerability was discovered by:
Jan-Niklas Sohn working with TrendAI Zero Day Initiative
Signed-off-by: Peter Harris <pharris2@rocketsoftware.com>
Acked-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit b024ae1749ee58c6fbf863b9a1f5dc440fee2e1b)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
---
xkb/xkb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index d5f790338..b002da5bc 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -3003,7 +3003,7 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
return BadAlloc;
}
}
- else if (req->truncateSI) {
+ else if (req->truncateSI || req->firstSI + req->nSI > compat->num_si) {
compat->num_si = req->firstSI + req->nSI;
}
sym = &compat->sym_interpret[req->firstSI];
--
2.53.0

56
SOURCES/0001-xkb-fix-int-size-mismatch.patch Normal file
View File

@ -0,0 +1,56 @@
From de8df5f72f7f1673fc1bb7a9c84ba0e7f1d5e562 Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Wed, 24 Jan 2024 17:18:16 +0100
Subject: [PATCH xserver] xkb: fix int size mismatch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
GCC reports:
../xkb/xkb.c: In function ‘_XkbSetMapCheckLength’:
../xkb/xkb.c:2464:54: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 2 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
2464 | ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
| ~~^
| |
| long int
| %d
2465 | len, req_len);
| ~~~
| |
| size_t {aka unsigned int}
../xkb/xkb.c:2464:62: warning: format ‘%ld’ expects argument of type ‘long int’, but argument 3 has type ‘size_t’ {aka ‘unsigned int’} [-Wformat=]
2464 | ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
| ~~^
| |
| long int
| %d
2465 | len, req_len);
| ~~~~~~~
| |
| size_t {aka unsigned int}
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1257>
(cherry picked from commit bc90c44e60c309564a7feec5d288ecafcbb2a62b)
---
xkb/xkb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index b240b6f6c..8d52e25df 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2460,8 +2460,7 @@ _XkbSetMapCheckLength(xkbSetMapReq *req)
if (len == req_len)
return Success;
bad:
- ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %ld got %ld\n",
- len, req_len);
+ ErrorF("[xkb] BOGUS LENGTH in SetMap: expected %zd got %zd\n", len, req_len);
return BadLength;
}
--
2.54.0

47
SOURCES/0002-dix-avoid-null-ptr-deref-at-doListFontsWithInfo.patch Normal file
View File

@ -0,0 +1,47 @@
From 27d924f41a04f37ee8a16ba2419a703174c5026c Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <mdmitrichenko@astralinux.ru>
Date: Wed, 17 Sep 2025 17:25:40 +0300
Subject: [PATCH xserver 02/51] dix: avoid null ptr deref at
doListFontsWithInfo
In the doListFontsWithInfo function in dixfonts.c, when a font alias is
encountered (err == FontNameAlias), the code saves the current state
and allocates memory for c->savedName.
If the malloc(namelen + 1) call fails, c->savedName remains NULL,
but c->haveSaved is still set to TRUE. Later, when a font is
successfully resolved (err == Successful), the code uses c->savedName
without checking if it is NULL, so there is potential null ptr
dereference. XNFalloc will check result of malloc and stop
program execution if allocation was failed.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1842
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit dd5c2595a42d3ff0c4f18d9b53d1f6c3fd934fd4)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
dix/dixfonts.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 386c38686..b079dcf67 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -933,9 +933,8 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
c->haveSaved = TRUE;
c->savedNumFonts = numFonts;
free(c->savedName);
- c->savedName = malloc(namelen + 1);
- if (c->savedName)
- memmove(c->savedName, name, namelen + 1);
+ c->savedName = XNFalloc(namelen + 1);
+ memcpy(c->savedName, name, namelen + 1);
aliascount = 20;
}
if (namelen > XLFDMAXFONTNAMELEN) {
--
2.54.0

71
SOURCES/0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch Normal file
View File

@ -0,0 +1,71 @@
From 513d92540e8edba52a08f53c461e4e366bb8b385 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 20 Apr 2026 11:17:08 +1000
Subject: [PATCH xserver 2/9] sync: restart trigger list iteration in
SyncChangeCounter after TriggerFired
This is the equivalent check to miSyncTriggerFence() from
commit f19ab94ba9c8 ("miext/sync: Fix use-after-free in miSyncTriggerFence()")
When a trigger fires via SyncAwaitTriggerFired, the resulting
FreeResource/FreeAwait call invokes SyncDeleteTriggerFromSyncObject for
every trigger in the same Await group. This unlinks and frees the
corresponding trigger list nodes - potentially including the node pnext
points to.
Fix by restarting iteration from the list head after a trigger fires, since
TriggerFired may have arbitrarily mutated the list. Triggers that have fired
are removed from the list by FreeAwait, so restarting cannot cause infinite
loops.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30164
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit bdd7bf57af208b1ddf57d4683d67104443b44812)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
Xext/sync.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git a/Xext/sync.c b/Xext/sync.c
index 0079e85ed..69a28ec14 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -718,8 +718,29 @@ SyncChangeCounter(SyncCounter * pCounter, int64_t newval)
/* run through triggers to see if any become true */
for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) {
pnext = ptl->next;
- if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval))
+ if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval)) {
(*ptl->pTrigger->TriggerFired) (ptl->pTrigger);
+ /* TriggerFired may have called SyncDeleteTriggerFromSyncObject
+ * for sibling triggers in the same Await group, freeing their
+ * trigger list nodes - potentially including pnext. Verify
+ * pnext is still on the counter's trigger list; if not,
+ * restart from the list head.
+ *
+ * Unlike miSyncTriggerFence() we cannot use a do/while
+ * restart loop here: counter trigger lists may contain alarm
+ * triggers which are not removed after firing and would cause
+ * an infinite loop when delta is 0.
+ */
+ if (pnext) {
+ SyncTriggerList *tmp;
+ for (tmp = pCounter->sync.pTriglist; tmp; tmp = tmp->next) {
+ if (tmp == pnext)
+ break;
+ }
+ if (!tmp)
+ pnext = pCounter->sync.pTriglist;
+ }
+ }
}
if (IsSystemCounter(pCounter)) {
--
2.54.0

70
SOURCES/0002-xkb-Fix-bounds-check-in-_CheckSetGeom.patch Normal file
View File

@ -0,0 +1,70 @@
From 229b7ab7ee48cf9640d635d7db7e32ce00fcb8be Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Wed, 18 Feb 2026 16:03:11 +0100
Subject: [PATCH xserver 2/6] xkb: Fix bounds check in _CheckSetGeom()
As reported by valgrind:
== Conditional jump or move depends on uninitialised value(s)
== at 0x5CBE66: SrvXkbAddGeomKeyAlias (XKBGAlloc.c:585)
== by 0x5AC7D5: _CheckSetGeom (xkb.c:5607)
== by 0x5AC952: _XkbSetGeometry (xkb.c:5643)
== by 0x5ACB58: ProcXkbSetGeometry (xkb.c:5684)
== by 0x5B0DAC: ProcXkbDispatch (xkb.c:7070)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
== Uninitialised value was created by a heap allocation
== at 0x4840B26: malloc (vg_replace_malloc.c:447)
== by 0x5E13B0: AllocateInputBuffer (io.c:981)
== by 0x5E05CD: InsertFakeRequest (io.c:516)
== by 0x4AA860: NextAvailableClient (dispatch.c:3629)
== by 0x5DE0D7: AllocNewConnection (connection.c:628)
== by 0x5DE2C6: EstablishNewConnections (connection.c:692)
== by 0x5DE600: HandleNotifyFd (connection.c:809)
== by 0x5E2598: ospoll_wait (ospoll.c:660)
== by 0x5DA00C: WaitForSomething (WaitFor.c:208)
== by 0x4A26E5: Dispatch (dispatch.c:493)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
Each key alias entry contains two key names (the alias and the real key
name), each of size XkbKeyNameLength.
The current bounds check only validates the first name, allowing
XkbAddGeomKeyAlias to potentially read uninitialized memory when
accessing the second name at &wire[XkbKeyNameLength].
To fix this, change the value to check to use 2 * XkbKeyNameLength to
validate the bounds.
CVE-2026-34000, ZDI-CAN-28679
This vulnerability was discovered by:
Jan-Niklas Sohn working with TrendAI Zero Day Initiative
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 81b6a34f90b28c32ad499a78a4f391b7c06daea2)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
---
xkb/xkb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index b002da5bc..9cd2afdb8 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5602,7 +5602,7 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
}
for (i = 0; i < req->nKeyAliases; i++) {
- if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength))
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 2 * XkbKeyNameLength))
return BadLength;
if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL)
--
2.53.0

103
SOURCES/0003-miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch Normal file
View File

@ -0,0 +1,103 @@
From f6638d751790ee3f5ca672a9db303bbf5b66d020 Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Wed, 18 Feb 2026 16:23:23 +0100
Subject: [PATCH xserver 3/6] miext/sync: Fix use-after-free in
miSyncTriggerFence()
As reported by valgrind:
== Invalid read of size 8
== at 0x568C14: miSyncTriggerFence (misync.c:140)
== by 0x540688: ProcSyncTriggerFence (sync.c:1957)
== by 0x540CCC: ProcSyncDispatch (sync.c:2152)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
== Address 0x17e35488 is 8 bytes inside a block of size 16 free'd
== at 0x4843E43: free (vg_replace_malloc.c:990)
== by 0x53D683: SyncDeleteTriggerFromSyncObject (sync.c:169)
== by 0x53F14D: FreeAwait (sync.c:1208)
== by 0x4DFB06: doFreeResource (resource.c:888)
== by 0x4DFC59: FreeResource (resource.c:918)
== by 0x53E349: SyncAwaitTriggerFired (sync.c:701)
== by 0x568C52: miSyncTriggerFence (misync.c:142)
== by 0x540688: ProcSyncTriggerFence (sync.c:1957)
== by 0x540CCC: ProcSyncDispatch (sync.c:2152)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
== Block was alloc'd at
== at 0x4840B26: malloc (vg_replace_malloc.c:447)
== by 0x5E50E1: XNFalloc (utils.c:1129)
== by 0x53D772: SyncAddTriggerToSyncObject (sync.c:206)
== by 0x53DCA8: SyncInitTrigger (sync.c:414)
== by 0x5409C7: ProcSyncAwaitFence (sync.c:2089)
== by 0x540D04: ProcSyncDispatch (sync.c:2160)
== by 0x4A28C5: Dispatch (dispatch.c:553)
== by 0x4B0B24: dix_main (main.c:274)
== by 0x42915E: main (stubmain.c:34)
When walking the list of fences to trigger, miSyncTriggerFence() may
call TriggerFence() for the current trigger, which end up calling the
function SyncAwaitTriggerFired().
SyncAwaitTriggerFired() frees the entire await resource, which removes
all triggers from that await - including pNext which may be another
trigger from the same await attached to the same fence.
On the next iteration, ptl = pNext points to freed memory...
To avoid the issue, we need to restart the iteration from the beginning
of the list each time a trigger fires, since the callback can modify the
list.
CVE-2026-34001, ZDI-CAN-28706
This vulnerability was discovered by:
Jan-Niklas Sohn working with TrendAI Zero Day Initiative
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit f19ab94ba9c891d801231654267556dc7f32b5e0)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
---
miext/sync/misync.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/miext/sync/misync.c b/miext/sync/misync.c
index 0931803f6..9a6fbbd4a 100644
--- a/miext/sync/misync.c
+++ b/miext/sync/misync.c
@@ -131,16 +131,22 @@ miSyncDestroyFence(SyncFence * pFence)
void
miSyncTriggerFence(SyncFence * pFence)
{
- SyncTriggerList *ptl, *pNext;
+ SyncTriggerList *ptl;
+ Bool triggered;
pFence->funcs.SetTriggered(pFence);
/* run through triggers to see if any fired */
- for (ptl = pFence->sync.pTriglist; ptl; ptl = pNext) {
- pNext = ptl->next;
- if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, 0))
- (*ptl->pTrigger->TriggerFired) (ptl->pTrigger);
- }
+ do {
+ triggered = FALSE;
+ for (ptl = pFence->sync.pTriglist; ptl; ptl = ptl->next) {
+ if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, 0)) {
+ (*ptl->pTrigger->TriggerFired) (ptl->pTrigger);
+ triggered = TRUE;
+ break;
+ }
+ }
+ } while (triggered);
}
SyncScreenFuncsPtr
--
2.53.0

49
SOURCES/0003-panoramix-avoid-null-dereference-in-PanoramiXMaybeAd.patch Normal file
View File

@ -0,0 +1,49 @@
From 5e657943933a79166d2020ee978abd8afa5fccfe Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 20 Sep 2025 16:35:46 -0700
Subject: [PATCH xserver 03/51] panoramix: avoid null dereference in
PanoramiXMaybeAddDepth()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:748:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘PanoramiXDepths’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:802:1: enter_function: entry to ‘PanoramiXConsolidate’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:813:17: branch_true: following ‘true’ branch...
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:814:9: branch_true: ...to here
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:814:9: call_function: calling ‘PanoramiXMaybeAddDepth’ from ‘PanoramiXConsolidate’
746| PanoramiXDepths = reallocarray(PanoramiXDepths,
747| PanoramiXNumDepths, sizeof(DepthRec));
748|-> PanoramiXDepths[j].depth = pDepth->depth;
749| PanoramiXDepths[j].numVids = 0;
750| PanoramiXDepths[j].vids = NULL;
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 537b56cccaf1759f9beef9396463b1f412614003)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/panoramiX.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
index bd9c45b03..00585e3f6 100644
--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
@@ -747,8 +747,8 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
j = PanoramiXNumDepths;
PanoramiXNumDepths++;
- PanoramiXDepths = reallocarray(PanoramiXDepths,
- PanoramiXNumDepths, sizeof(DepthRec));
+ PanoramiXDepths = XNFreallocarray(PanoramiXDepths,
+ PanoramiXNumDepths, sizeof(DepthRec));
PanoramiXDepths[j].depth = pDepth->depth;
PanoramiXDepths[j].numVids = 0;
PanoramiXDepths[j].vids = NULL;
--
2.54.0

50
SOURCES/0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch Normal file
View File

@ -0,0 +1,50 @@
From 7841780e7b1d0e0f5f9bb98691eaffece19d06e1 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 20 Apr 2026 11:17:41 +1000
Subject: [PATCH xserver 3/9] xkb: reject key types with num_levels exceeding
XkbMaxShiftLevel
CheckKeyTypes validates incoming key type definitions from XkbSetMap
requests but does not enforce an upper bound on numLevels. A client can set
numLevels up to 255 on a non-canonical key type, which is stored in the
server's type table.
When ChangeKeyboardMapping later triggers XkbUpdateKeyTypesFromCore, the
function XkbKeyTypesForCoreSymbols computes groupsWidth from num_levels and
uses the XKB_OFFSET(g, l) = (g * groupsWidth) + l macro to index into
tsyms[], a stack-allocated buffer of XkbMaxSymsPerKey (252) entries. With
num_levels=255, groupsWidth=255, and indices reach up to 3*255+254 = 1019,
overflowing the 252-element stack buffer by 767 KeySym-sized entries.
Fix by rejecting numLevels values greater than XkbMaxShiftLevel (63) in
CheckKeyTypes, alongside the existing lower-bound check for numLevels < 1.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30160
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit 543e108516428fc8c3bea91d6563ad266f9a801e)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
xkb/xkb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 2139da7ee..f190be5eb 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -1644,7 +1644,7 @@ CheckKeyTypes(ClientPtr client,
}
n = i + req->firstType;
width = wire->numLevels;
- if (width < 1) {
+ if (width < 1 || width > XkbMaxShiftLevel) {
*nMapsRtrn = _XkbErrCode3(0x04, n, width);
return 0;
}
--
2.54.0

71
SOURCES/0004-panoramix-avoid-null-dereference-in-PanoramiXConsoli.patch Normal file
View File

@ -0,0 +1,71 @@
From bd7f4a48a5187dd32d3a0791a407432933af0c1d Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 20 Sep 2025 16:45:59 -0700
Subject: [PATCH xserver 04/51] panoramix: avoid null dereference in
PanoramiXConsolidate()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
Error: GCC_ANALYZER_WARNING (CWE-476): [#def5]
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘root’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:819:12: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: danger: ‘root’ could be NULL: unchecked value from (1)
818|
819| root = malloc(sizeof(PanoramiXRes));
820|-> root->type = XRT_WINDOW;
821| defmap = malloc(sizeof(PanoramiXRes));
822| defmap->type = XRT_COLORMAP;
Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘defmap’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:821:14: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: danger: ‘defmap’ could be NULL: unchecked value from (1)
820| root->type = XRT_WINDOW;
821| defmap = malloc(sizeof(PanoramiXRes));
822|-> defmap->type = XRT_COLORMAP;
823| saver = malloc(sizeof(PanoramiXRes));
824| saver->type = XRT_WINDOW;
Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘saver’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:823:13: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: danger: ‘saver’ could be NULL: unchecked value from (1)
822| defmap->type = XRT_COLORMAP;
823| saver = malloc(sizeof(PanoramiXRes));
824|-> saver->type = XRT_WINDOW;
825|
826| FOR_NSCREENS(i) {
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 23c103d41f35cc030b0c0e973f7f3bcb8d9902a0)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/panoramiX.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
index 00585e3f6..2029b353d 100644
--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
@@ -820,11 +820,11 @@ PanoramiXConsolidate(void)
for (i = 0; i < pScreen->numVisuals; i++)
PanoramiXMaybeAddVisual(pVisual++);
- root = malloc(sizeof(PanoramiXRes));
+ root = XNFcallocarray(1, sizeof(PanoramiXRes));
root->type = XRT_WINDOW;
- defmap = malloc(sizeof(PanoramiXRes));
+ defmap = XNFcallocarray(1, sizeof(PanoramiXRes));
defmap->type = XRT_COLORMAP;
- saver = malloc(sizeof(PanoramiXRes));
+ saver = XNFcallocarray(1, sizeof(PanoramiXRes));
saver->type = XRT_WINDOW;
FOR_NSCREENS(i) {
--
2.54.0

91
SOURCES/0004-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch Normal file
View File

@ -0,0 +1,91 @@
From 5842fd1fcce48ec98bdcce75b804210584ea35e2 Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Wed, 18 Feb 2026 17:02:09 +0100
Subject: [PATCH xserver 4/6] xkb: Fix out-of-bounds read in CheckModifierMap()
As reported by valgrind:
== Conditional jump or move depends on uninitialised value(s)
== at 0x547E5B: CheckModifierMap (xkb.c:1972)
== by 0x54A086: _XkbSetMapChecks (xkb.c:2574)
== by 0x54A845: ProcXkbSetMap (xkb.c:2741)
== by 0x556EF4: ProcXkbDispatch (xkb.c:7048)
== by 0x454A8C: Dispatch (dispatch.c:553)
== by 0x462CEB: dix_main (main.c:274)
== by 0x405EA7: main (stubmain.c:34)
== Uninitialised value was created by a heap allocation
== at 0x4840B26: malloc (vg_replace_malloc.c:447)
== by 0x592D5A: AllocateInputBuffer (io.c:981)
== by 0x591F77: InsertFakeRequest (io.c:516)
== by 0x45CA27: NextAvailableClient (dispatch.c:3629)
== by 0x58FA81: AllocNewConnection (connection.c:628)
== by 0x58FC70: EstablishNewConnections (connection.c:692)
== by 0x58FFAA: HandleNotifyFd (connection.c:809)
== by 0x593F42: ospoll_wait (ospoll.c:660)
== by 0x58B9B6: WaitForSomething (WaitFor.c:208)
== by 0x4548AC: Dispatch (dispatch.c:493)
== by 0x462CEB: dix_main (main.c:274)
== by 0x405EA7: main (stubmain.c:34)
The issue is that the loop in CheckModifierMap() reads from wire without
verifying that the data is within the request bounds.
The req->totalModMapKeys value could exceed the actual data provided,
causing reads of uninitialized memory.
To fix that issue, we add a bounds check using _XkbCheckRequestBounds,
but for that, we need to also pass a ClientPtr parameter, which is not
a problem since CheckModifierMap() is a private, static function.
CVE-2026-34002, ZDI-CAN-28737
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit f056ce1cc96ed9261052c31524162c78e458f98c)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
---
xkb/xkb.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 9cd2afdb8..f47ffbc5d 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -1940,8 +1940,8 @@ CheckKeyExplicit(XkbDescPtr xkb,
}
static int
-CheckModifierMap(XkbDescPtr xkb, xkbSetMapReq * req, CARD8 **wireRtrn,
- int *errRtrn)
+CheckModifierMap(ClientPtr client, XkbDescPtr xkb, xkbSetMapReq * req,
+ CARD8 **wireRtrn, int *errRtrn)
{
register CARD8 *wire = *wireRtrn;
CARD8 *start;
@@ -1965,6 +1965,10 @@ CheckModifierMap(XkbDescPtr xkb, xkbSetMapReq * req, CARD8 **wireRtrn,
}
start = wire;
for (i = 0; i < req->totalModMapKeys; i++, wire += 2) {
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 2)) {
+ *errRtrn = _XkbErrCode3(0x64, req->totalModMapKeys, i);
+ return 0;
+ }
if ((wire[0] < first) || (wire[0] > last)) {
*errRtrn = _XkbErrCode4(0x63, first, last, wire[0]);
return 0;
@@ -2567,7 +2571,7 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
return BadValue;
}
if ((req->present & XkbModifierMapMask) &&
- (!CheckModifierMap(xkb, req, (CARD8 **) &values, &error))) {
+ (!CheckModifierMap(client, xkb, req, (CARD8 **) &values, &error))) {
client->errorValue = error;
return BadValue;
}
--
2.53.0

53
SOURCES/0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch Normal file
View File

@ -0,0 +1,53 @@
From 50b6eeda460f0badea82f689442461fea7f7af2a Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 20 Apr 2026 11:18:13 +1000
Subject: [PATCH xserver 4/9] xkb: clamp nMaps to mapWidths buffer size in
CheckKeyTypes
CheckKeyTypes computes nMaps = firstType + nTypes from client-controlled
request fields when XkbSetMapResizeTypes is set. This value is used to
index mapWidths[], a stack-allocated CARD8 array of XkbMaxLegalKeyCode + 1
(256) elements. No upper bound is enforced on nMaps.
An attacker can first send SetMap(firstType=0, nTypes=255, ResizeTypes) to
set the server's num_types to 255, then send SetMap(firstType=255,
nTypes=10, ResizeTypes). The firstType > num_types check passes because
255 > 255 is false (the check uses > rather than >=). nMaps is then
computed as 265, and the loop writes mapWidths[255..264], overflowing 9
bytes past the stack buffer into adjacent stack variables (symsPerKey[]).
Fix by rejecting requests where firstType + nTypes would exceed the
mapWidths buffer size (XkbMaxLegalKeyCode + 1).
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30161
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit 867b59b33bee669cb412f1314e47c52eacf6e00b)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
xkb/xkb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index f190be5eb..f92ba9c3d 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -1617,6 +1617,11 @@ CheckKeyTypes(ClientPtr client,
*nMapsRtrn = _XkbErrCode4(0x02, req->firstType, req->nTypes, 4);
return 0;
}
+ if (nMaps > XkbMaxLegalKeyCode + 1) {
+ *nMapsRtrn = _XkbErrCode4(0x02, req->firstType, req->nTypes,
+ XkbMaxLegalKeyCode + 1);
+ return 0;
+ }
}
else if (req->present & XkbKeyTypesMask) {
nMaps = xkb->map->num_types;
--
2.54.0

43
SOURCES/0005-Xext-shm-avoid-null-dereference-in-ShmInitScreenPriv.patch Normal file
View File

@ -0,0 +1,43 @@
From 70c8842c14764e0cfb343cbe4c29acfedb4b0bc3 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 12:18:49 -0700
Subject: [PATCH xserver 05/51] Xext/shm: avoid null dereference in
ShmInitScreenPriv()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/shm.c:213:23: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/shm.c:214:9: danger: ‘screen_priv’ could be NULL: unchecked value from [(19)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/18)
# 212| if (!screen_priv) {
# 213| screen_priv = calloc(1, sizeof(ShmScrPrivateRec));
# 214|-> screen_priv->CloseScreen = pScreen->CloseScreen;
# 215| dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, screen_priv);
# 216| pScreen->CloseScreen = ShmCloseScreen;
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 87e53afd9c7f52a8fa3d1fed22db5380742cc7b7)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/shm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Xext/shm.c b/Xext/shm.c
index 24c6b1087..2b23a15fe 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -210,7 +210,7 @@ ShmInitScreenPriv(ScreenPtr pScreen)
ShmScrPrivateRec *screen_priv = ShmGetScreenPriv(pScreen);
if (!screen_priv) {
- screen_priv = calloc(1, sizeof(ShmScrPrivateRec));
+ screen_priv = XNFcallocarray(1, sizeof(ShmScrPrivateRec));
screen_priv->CloseScreen = pScreen->CloseScreen;
dixSetPrivate(&pScreen->devPrivates, shmScrPrivateKey, screen_priv);
pScreen->CloseScreen = ShmCloseScreen;
--
2.54.0

154
SOURCES/0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch Normal file
View File

@ -0,0 +1,154 @@
From f7f8b663c7d19cfbd29c8ea16ca6475d6a5f0af0 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 20 Apr 2026 11:18:48 +1000
Subject: [PATCH xserver 5/9] glx: fix reversed length check in
ChangeDrawableAttributes
The request length validation in __glXDisp_ChangeDrawableAttributes and
__glXDispSwap_ChangeDrawableAttributes uses the wrong comparison direction.
The check tests whether the computed request size is LESS THAN
client->req_len, but should test whether it is GREATER THAN. With the
reversed operator, an undersized request (where numAttribs claims more
attribute pairs than the request actually contains) passes validation.
DoChangeDrawableAttributes then iterates numAttribs attribute pairs starting
from the end of the request header, reading past the actual request data
into adjacent memory. This is an out-of-bounds read that can also cause
an out-of-bounds write when a GLX_EVENT_MASK attribute key is found in the
overread data and its corresponding value is written to pGlxDraw->eventMask.
This patch effectively reverts commit 402b329c3aa8 ("glx: Work around
wrong request lengths sent by mesa"). This was fixed in mesa commit
4324d6fdfbba1 in 2011 (mesa 7.11).
Fixes: 402b329c3aa8 ("glx: Work around wrong request lengths sent by mesa")
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30165
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit 6d459e4daf715bea8abdafa8fb130be2f8a1d145)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
glx/glxcmds.c | 21 +++++----------------
glx/glxcmdsswap.c | 12 +++++-------
2 files changed, 10 insertions(+), 23 deletions(-)
diff --git a/glx/glxcmds.c b/glx/glxcmds.c
index 75e42823c..758308432 100644
--- a/glx/glxcmds.c
+++ b/glx/glxcmds.c
@@ -1122,8 +1122,7 @@ __glXDisp_GetFBConfigsSGIX(__GLXclientState * cl, GLbyte * pc)
ClientPtr client = cl->client;
xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc;
- /* work around mesa bug, don't use REQUEST_SIZE_MATCH */
- REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
+ REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
return DoGetFBConfigs(cl, req->screen);
}
@@ -1344,9 +1343,7 @@ __glXDisp_DestroyPixmap(__GLXclientState * cl, GLbyte * pc)
ClientPtr client = cl->client;
xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc;
- /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set
- * length to 3 instead of 2 */
- REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq);
+ REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq);
return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP);
}
@@ -1495,14 +1492,8 @@ __glXDisp_ChangeDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
client->errorValue = req->numAttribs;
return BadValue;
}
-#if 0
- /* mesa sends an additional 8 bytes */
+
REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
-#else
- if (((sizeof(xGLXChangeDrawableAttributesReq) +
- (req->numAttribs << 3)) >> 2) < client->req_len)
- return BadLength;
-#endif
return DoChangeDrawableAttributes(cl->client, req->drawable,
req->numAttribs, (CARD32 *) (req + 1));
@@ -1569,8 +1560,7 @@ __glXDisp_DestroyWindow(__GLXclientState * cl, GLbyte * pc)
ClientPtr client = cl->client;
xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc;
- /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */
- REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
+ REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW);
}
@@ -1923,8 +1913,7 @@ __glXDisp_GetDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
ClientPtr client = cl->client;
xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *) pc;
- /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */
- REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
+ REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
return DoGetDrawableAttributes(cl, req->drawable);
}
diff --git a/glx/glxcmdsswap.c b/glx/glxcmdsswap.c
index 7d6674470..96382672a 100644
--- a/glx/glxcmdsswap.c
+++ b/glx/glxcmdsswap.c
@@ -235,7 +235,7 @@ __glXDispSwap_GetFBConfigsSGIX(__GLXclientState * cl, GLbyte * pc)
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq);
+ REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq);
__GLX_SWAP_INT(&req->screen);
return __glXDisp_GetFBConfigsSGIX(cl, pc);
@@ -327,7 +327,7 @@ __glXDispSwap_DestroyPixmap(__GLXclientState * cl, GLbyte * pc)
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq);
+ REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq);
__GLX_SWAP_SHORT(&req->length);
__GLX_SWAP_INT(&req->glxpixmap);
@@ -440,9 +440,7 @@ __glXDispSwap_ChangeDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
client->errorValue = req->numAttribs;
return BadValue;
}
- if (((sizeof(xGLXChangeDrawableAttributesReq) +
- (req->numAttribs << 3)) >> 2) < client->req_len)
- return BadLength;
+ REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3);
attribs = (CARD32 *) (req + 1);
__GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1);
@@ -514,7 +512,7 @@ __glXDispSwap_DestroyWindow(__GLXclientState * cl, GLbyte * pc)
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq);
+ REQUEST_SIZE_MATCH(xGLXDestroyWindowReq);
__GLX_SWAP_INT(&req->glxwindow);
@@ -723,7 +721,7 @@ __glXDispSwap_GetDrawableAttributes(__GLXclientState * cl, GLbyte * pc)
__GLX_DECLARE_SWAP_VARIABLES;
- REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq);
+ REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq);
__GLX_SWAP_SHORT(&req->length);
__GLX_SWAP_INT(&req->drawable);
--
2.54.0

112
SOURCES/0005-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch Normal file
View File

@ -0,0 +1,112 @@
From 5d6f378904ec5c7ae22e9ba4afd15e889a0a1df5 Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Mon, 23 Feb 2026 15:52:49 +0100
Subject: [PATCH xserver 5/6] xkb: Add additional bound checking in
CheckKeyTypes()
The function CheckKeyTypes() will loop over the client's request but
won't perform any additional bound checking to ensure that the data
read remains within the request bounds.
As a result, a specifically crafted request may cause CheckKeyTypes() to
read past the request data, as reported by valgrind:
== Invalid read of size 2
== at 0x5A3D1D: CheckKeyTypes (xkb.c:1694)
== by 0x5A6A9C: _XkbSetMapChecks (xkb.c:2515)
== by 0x5A759E: ProcXkbSetMap (xkb.c:2736)
== by 0x5BF832: SProcXkbSetMap (xkbSwap.c:245)
== by 0x5C05ED: SProcXkbDispatch (xkbSwap.c:501)
== by 0x4A20DF: Dispatch (dispatch.c:551)
== by 0x4B03B4: dix_main (main.c:277)
== by 0x428941: main (stubmain.c:34)
== Address is 30 bytes after a block of size 28,672 in arena "client"
==
== Invalid read of size 2
== at 0x5A3AB6: CheckKeyTypes (xkb.c:1669)
== by 0x5A6A9C: _XkbSetMapChecks (xkb.c:2515)
== by 0x5A759E: ProcXkbSetMap (xkb.c:2736)
== by 0x5BF832: SProcXkbSetMap (xkbSwap.c:245)
== by 0x5C05ED: SProcXkbDispatch (xkbSwap.c:501)
== by 0x4A20DF: Dispatch (dispatch.c:551)
== by 0x4B03B4: dix_main (main.c:277)
== by 0x428941: main (stubmain.c:34)
== Address is 2 bytes after a block of size 28,672 alloc'd
== at 0x4848897: realloc (vg_replace_malloc.c:1804)
== by 0x5E357A: ReadRequestFromClient (io.c:336)
== by 0x4A1FAB: Dispatch (dispatch.c:519)
== by 0x4B03B4: dix_main (main.c:277)
== by 0x428941: main (stubmain.c:34)
==
== Invalid write of size 2
== at 0x5A3AD7: CheckKeyTypes (xkb.c:1669)
== by 0x5A6A9C: _XkbSetMapChecks (xkb.c:2515)
== by 0x5A759E: ProcXkbSetMap (xkb.c:2736)
== by 0x5BF832: SProcXkbSetMap (xkbSwap.c:245)
== by 0x5C05ED: SProcXkbDispatch (xkbSwap.c:501)
== by 0x4A20DF: Dispatch (dispatch.c:551)
== by 0x4B03B4: dix_main (main.c:277)
== by 0x428941: main (stubmain.c:34)
== Address is 2 bytes after a block of size 28,672 alloc'd
== at 0x4848897: realloc (vg_replace_malloc.c:1804)
== by 0x5E357A: ReadRequestFromClient (io.c:336)
== by 0x4A1FAB: Dispatch (dispatch.c:519)
== by 0x4B03B4: dix_main (main.c:277)
== by 0x428941: main (stubmain.c:34)
==
To avoid that issue, add additional bounds checking within the loops by
calling _XkbCheckRequestBounds() and report an error if we are to read
past the client's request.
CVE-2026-34003, ZDI-CAN-28736
This vulnerability was discovered by:
Jan-Niklas Sohn working with TrendAI Zero Day Initiative
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit b85b00dd7b9eee05e3c12e7ad1fce4fc6671507b)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
---
xkb/xkb.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index f47ffbc5d..1ee9cfb6f 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -1639,6 +1639,10 @@ CheckKeyTypes(ClientPtr client,
for (i = 0; i < req->nTypes; i++) {
unsigned width;
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
+ *nMapsRtrn = _XkbErrCode3(0x0b, req->nTypes, i);
+ return 0;
+ }
if (client->swapped) {
swaps(&wire->virtualMods);
}
@@ -1664,7 +1668,18 @@ CheckKeyTypes(ClientPtr client,
xkbModsWireDesc *preWire;
mapWire = (xkbKTSetMapEntryWireDesc *) &wire[1];
+ if (!_XkbCheckRequestBounds(client, req, mapWire,
+ &mapWire[wire->nMapEntries])) {
+ *nMapsRtrn = _XkbErrCode3(0x0c, i, wire->nMapEntries);
+ return 0;
+ }
preWire = (xkbModsWireDesc *) &mapWire[wire->nMapEntries];
+ if (wire->preserve &&
+ !_XkbCheckRequestBounds(client, req, preWire,
+ &preWire[wire->nMapEntries])) {
+ *nMapsRtrn = _XkbErrCode3(0x0d, i, wire->nMapEntries);
+ return 0;
+ }
for (n = 0; n < wire->nMapEntries; n++) {
if (client->swapped) {
swaps(&mapWire[n].virtualMods);
--
2.53.0

90
SOURCES/0006-Xext-sync-avoid-null-dereference-if-SysCounterGetPri.patch Normal file
View File

@ -0,0 +1,90 @@
From 03aeaee358fc6a34a851f875d37df405240879c1 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 15:26:19 -0700
Subject: [PATCH xserver 06/51] Xext/sync: avoid null dereference if
SysCounterGetPrivate() returns NULL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2664:9: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
# 2662| SyncCounter *counter = pCounter;
# 2663| IdleCounterPriv *priv = SysCounterGetPrivate(counter);
# 2664|-> deviceid = priv->deviceid;
# 2665| }
# 2666| else
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2677:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
# 2675| SyncCounter *counter = pCounter;
# 2676| IdleCounterPriv *priv = SysCounterGetPrivate(counter);
# 2677|-> int64_t *less = priv->value_less;
# 2678| int64_t *greater = priv->value_greater;
# 2679| int64_t idle, old_idle;
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2767:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
# 2765| SyncCounter *counter = pCounter;
# 2766| IdleCounterPriv *priv = SysCounterGetPrivate(counter);
# 2767|-> int64_t *less = priv->value_less;
# 2768| int64_t *greater = priv->value_greater;
# 2769| int64_t idle;
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2800:14: danger: dereference of NULL ‘SysCounterGetPrivate(pCounter)’
# 2798| SyncCounter *counter = pCounter;
# 2799| IdleCounterPriv *priv = SysCounterGetPrivate(counter);
# 2800|-> int64_t *less = priv->value_less;
# 2801| int64_t *greater = priv->value_greater;
# 2802| Bool registered = (less || greater);
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 0211de37b340eccfc0bad6a3ea13b27810b11a30)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/sync.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/Xext/sync.c b/Xext/sync.c
index c3d160327..09a14ac3c 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -2695,9 +2695,11 @@ IdleTimeQueryValue(void *pCounter, int64_t *pValue_return)
int deviceid;
CARD32 idle;
+ *pValue_return = 0;
if (pCounter) {
SyncCounter *counter = pCounter;
IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+ BUG_RETURN(priv == NULL);
deviceid = priv->deviceid;
}
else
@@ -2711,6 +2713,7 @@ IdleTimeBlockHandler(void *pCounter, void *wt)
{
SyncCounter *counter = pCounter;
IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+ BUG_RETURN(priv == NULL);
int64_t *less = priv->value_less;
int64_t *greater = priv->value_greater;
int64_t idle, old_idle;
@@ -2801,6 +2804,7 @@ IdleTimeWakeupHandler(void *pCounter, int rc)
{
SyncCounter *counter = pCounter;
IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+ BUG_RETURN(priv == NULL);
int64_t *less = priv->value_less;
int64_t *greater = priv->value_greater;
int64_t idle;
@@ -2834,6 +2838,7 @@ IdleTimeBracketValues(void *pCounter, int64_t *pbracket_less,
{
SyncCounter *counter = pCounter;
IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+ BUG_RETURN(priv == NULL);
int64_t *less = priv->value_less;
int64_t *greater = priv->value_greater;
Bool registered = (less || greater);
--
2.54.0

74
SOURCES/0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch Normal file
View File

@ -0,0 +1,74 @@
From 637343690922ccd44bedf4e524357b0593067fa2 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 20 Apr 2026 11:19:20 +1000
Subject: [PATCH xserver 6/9] saver: re-fetch screen private after
CheckScreenPrivate in CreateSaverWindow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
CreateSaverWindow stores pPriv (the ScreenSaverScreenPrivatePtr) in a local
variable via the SetupScreen macro at function entry. When an existing saver
window is being replaced, the function sets pPriv->hasWindow = FALSE and
calls CheckScreenPrivate(). If at this point pPriv->attr is NULL (cleared
by a prior UnsetAttributes call), pPriv->events is NULL, and
pPriv->installedMap is None, then CheckScreenPrivate determines the screen
private is unused, frees it, and sets the screen private pointer to NULL.
The function then continues to dereference the now-freed pPriv on the very
next line (pPriv->attr), resulting in a use-after-free. On glibc 2.34+,
the tcache key at offset 8 within the freed block makes pPriv->attr appear
non-NULL, causing the function to continue operating on garbage data and
eventually crash.
The attack sequence is:
1. SetAttributes (creates pPriv with pPriv->attr set)
2. ForceScreenSaver(Active) (creates saver window, pPriv->hasWindow=TRUE)
3. UnsetAttributes (sets pPriv->attr = NULL)
4. ForceScreenSaver(Active) (re-enters CreateSaverWindow → UAF)
Fix by re-fetching pPriv from the screen private after CheckScreenPrivate
returns, so the subsequent NULL check correctly detects the freed state.
ScreenSaverFreeAttr has the same pattern, force pPriv to NULL there too
even though it has no real effect.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30168
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit ecc634f1b2f7aa473d3a267eada98c4918bf9e05)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
Xext/saver.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/Xext/saver.c b/Xext/saver.c
index c27a66c80..f750ef4cd 100644
--- a/Xext/saver.c
+++ b/Xext/saver.c
@@ -348,6 +348,9 @@ ScreenSaverFreeAttr(void *value, XID id)
dixSaveScreens(serverClient, SCREEN_SAVER_FORCER, ScreenSaverActive);
}
CheckScreenPrivate(pScreen);
+ /* CheckScreenPrivate may have freed pPriv (same pattern as
+ * CreateSaverWindow fix for ZDI-CAN-30168). */
+ pPriv = NULL;
return TRUE;
}
@@ -479,6 +482,8 @@ CreateSaverWindow(ScreenPtr pScreen)
UninstallSaverColormap(pScreen);
pPriv->hasWindow = FALSE;
CheckScreenPrivate(pScreen);
+ /* Re-fetch pPriv since CheckScreenPrivate may have freed it */
+ pPriv = GetScreenPrivate(pScreen);
}
}
--
2.54.0

221
SOURCES/0006-xkb-Add-more-_XkbCheckRequestBounds.patch Normal file
View File

@ -0,0 +1,221 @@
From 7c03d504c2b6ca498e0ff3761b000d77788f0c23 Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Mon, 2 Mar 2026 14:09:57 +0100
Subject: [PATCH xserver 6/6] xkb: Add more _XkbCheckRequestBounds()
Similar to the recent fixes, add more _XkbCheckRequestBounds() to the
functions that loop over the request data, i.e.:
* CheckKeySyms()
* CheckKeyActions()
* CheckKeyBehaviors()
* CheckVirtualMods()
* CheckKeyExplicit()
* CheckVirtualModMap()
* _XkbSetMapChecks()
All these are static functions so we can add the client to the parameters
without breaking any API.
See also:
CVE-2026-34003, ZDI-CAN-28736, CVE-2026-34002, ZDI-CAN-28737
v2: Check for "nSyms != 0" in CheckKeySyms() to avoid false positives.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit d38c563fab5c4a554e0939da39e4d1dadef7cbae)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2178>
---
xkb/xkb.c | 69 ++++++++++++++++++++++++++++++++++++++++++++-----------
1 file changed, 55 insertions(+), 14 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 1ee9cfb6f..f81d20655 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -1752,6 +1752,11 @@ CheckKeySyms(ClientPtr client,
KeySym *pSyms;
register unsigned nG;
+ /* Check we received enough data to read the next xkbSymMapWireDesc */
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
+ *errorRtrn = _XkbErrCode3(0x18, i + req->firstKeySym, i);
+ return 0;
+ }
if (client->swapped) {
swaps(&wire->nSyms);
}
@@ -1790,6 +1795,12 @@ CheckKeySyms(ClientPtr client,
return 0;
}
pSyms = (KeySym *) &wire[1];
+ if (wire->nSyms != 0) {
+ if (!_XkbCheckRequestBounds(client, req, pSyms, &pSyms[wire->nSyms])) {
+ *errorRtrn = _XkbErrCode3(0x19, i + req->firstKeySym, wire->nSyms);
+ return 0;
+ }
+ }
wire = (xkbSymMapWireDesc *) &pSyms[wire->nSyms];
}
@@ -1813,11 +1824,12 @@ CheckKeySyms(ClientPtr client,
}
static int
-CheckKeyActions(XkbDescPtr xkb,
- xkbSetMapReq * req,
- int nTypes,
- CARD8 *mapWidths,
- CARD16 *symsPerKey, CARD8 **wireRtrn, int *nActsRtrn)
+CheckKeyActions(ClientPtr client,
+ XkbDescPtr xkb,
+ xkbSetMapReq * req,
+ int nTypes,
+ CARD8 *mapWidths,
+ CARD16 *symsPerKey, CARD8 **wireRtrn, int *nActsRtrn)
{
int nActs;
CARD8 *wire = *wireRtrn;
@@ -1828,6 +1840,11 @@ CheckKeyActions(XkbDescPtr xkb,
CHK_REQ_KEY_RANGE2(0x21, req->firstKeyAct, req->nKeyActs, req, (*nActsRtrn),
0);
for (nActs = i = 0; i < req->nKeyActs; i++) {
+ /* Check we received enough data to read the next byte on the wire */
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
+ *nActsRtrn = _XkbErrCode3(0x24, i + req->firstKeyAct, i);
+ return 0;
+ }
if (wire[0] != 0) {
if (wire[0] == symsPerKey[i + req->firstKeyAct])
nActs += wire[0];
@@ -1846,7 +1863,8 @@ CheckKeyActions(XkbDescPtr xkb,
}
static int
-CheckKeyBehaviors(XkbDescPtr xkb,
+CheckKeyBehaviors(ClientPtr client,
+ XkbDescPtr xkb,
xkbSetMapReq * req,
xkbBehaviorWireDesc ** wireRtrn, int *errorRtrn)
{
@@ -1872,6 +1890,11 @@ CheckKeyBehaviors(XkbDescPtr xkb,
}
for (i = 0; i < req->totalKeyBehaviors; i++, wire++) {
+ /* Check we received enough data to read the next behavior */
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
+ *errorRtrn = _XkbErrCode3(0x36, first, i);
+ return 0;
+ }
if ((wire->key < first) || (wire->key > last)) {
*errorRtrn = _XkbErrCode4(0x33, first, last, wire->key);
return 0;
@@ -1897,7 +1920,8 @@ CheckKeyBehaviors(XkbDescPtr xkb,
}
static int
-CheckVirtualMods(XkbDescRec * xkb,
+CheckVirtualMods(ClientPtr client,
+ XkbDescRec * xkb,
xkbSetMapReq * req, CARD8 **wireRtrn, int *errorRtrn)
{
register CARD8 *wire = *wireRtrn;
@@ -1909,12 +1933,18 @@ CheckVirtualMods(XkbDescRec * xkb,
if (req->virtualMods & bit)
nMods++;
}
+ /* Check we received enough data for the number of virtual mods expected */
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbPaddedSize(nMods))) {
+ *errorRtrn = _XkbErrCode3(0x37, nMods, i);
+ return 0;
+ }
*wireRtrn = (wire + XkbPaddedSize(nMods));
return 1;
}
static int
-CheckKeyExplicit(XkbDescPtr xkb,
+CheckKeyExplicit(ClientPtr client,
+ XkbDescPtr xkb,
xkbSetMapReq * req, CARD8 **wireRtrn, int *errorRtrn)
{
register CARD8 *wire = *wireRtrn;
@@ -1940,6 +1970,11 @@ CheckKeyExplicit(XkbDescPtr xkb,
}
start = wire;
for (i = 0; i < req->totalKeyExplicit; i++, wire += 2) {
+ /* Check we received enough data to read the next two bytes */
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 2)) {
+ *errorRtrn = _XkbErrCode4(0x54, first, last, i);
+ return 0;
+ }
if ((wire[0] < first) || (wire[0] > last)) {
*errorRtrn = _XkbErrCode4(0x53, first, last, wire[0]);
return 0;
@@ -1995,7 +2030,8 @@ CheckModifierMap(ClientPtr client, XkbDescPtr xkb, xkbSetMapReq * req,
}
static int
-CheckVirtualModMap(XkbDescPtr xkb,
+CheckVirtualModMap(ClientPtr client,
+ XkbDescPtr xkb,
xkbSetMapReq * req,
xkbVModMapWireDesc ** wireRtrn, int *errRtrn)
{
@@ -2019,6 +2055,11 @@ CheckVirtualModMap(XkbDescPtr xkb,
return 0;
}
for (i = 0; i < req->totalVModMapKeys; i++, wire++) {
+ /* Check we received enough data to read the next virtual mod map key */
+ if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) {
+ *errRtrn = _XkbErrCode3(0x74, first, i);
+ return 0;
+ }
if ((wire->key < first) || (wire->key > last)) {
*errRtrn = _XkbErrCode4(0x73, first, last, wire->key);
return 0;
@@ -2562,7 +2603,7 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
}
if ((req->present & XkbKeyActionsMask) &&
- (!CheckKeyActions(xkb, req, nTypes, mapWidths, symsPerKey,
+ (!CheckKeyActions(client, xkb, req, nTypes, mapWidths, symsPerKey,
(CARD8 **) &values, &nActions))) {
client->errorValue = nActions;
return BadValue;
@@ -2570,18 +2611,18 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
if ((req->present & XkbKeyBehaviorsMask) &&
(!CheckKeyBehaviors
- (xkb, req, (xkbBehaviorWireDesc **) &values, &error))) {
+ (client, xkb, req, (xkbBehaviorWireDesc **) &values, &error))) {
client->errorValue = error;
return BadValue;
}
if ((req->present & XkbVirtualModsMask) &&
- (!CheckVirtualMods(xkb, req, (CARD8 **) &values, &error))) {
+ (!CheckVirtualMods(client, xkb, req, (CARD8 **) &values, &error))) {
client->errorValue = error;
return BadValue;
}
if ((req->present & XkbExplicitComponentsMask) &&
- (!CheckKeyExplicit(xkb, req, (CARD8 **) &values, &error))) {
+ (!CheckKeyExplicit(client, xkb, req, (CARD8 **) &values, &error))) {
client->errorValue = error;
return BadValue;
}
@@ -2592,7 +2633,7 @@ _XkbSetMapChecks(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req,
}
if ((req->present & XkbVirtualModMapMask) &&
(!CheckVirtualModMap
- (xkb, req, (xkbVModMapWireDesc **) &values, &error))) {
+ (client, xkb, req, (xkbVModMapWireDesc **) &values, &error))) {
client->errorValue = error;
return BadValue;
}
--
2.53.0

47
SOURCES/0007-Xext-sync-avoid-null-dereference-in-init_system_idle.patch Normal file
View File

@ -0,0 +1,47 @@
From 2d2fcd6c83bbc174d1ae178388e7ae0d8297da56 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 15:40:22 -0700
Subject: [PATCH xserver 07/51] Xext/sync: avoid null dereference in
init_system_idle_counter()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2835:33: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2837:28: danger: ‘priv’ could be NULL: unchecked value from [(30)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/29)
# 2835| IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
# 2836|
# 2837|-> priv->value_less = priv->value_greater = NULL;
# 2838| priv->deviceid = deviceid;
# 2839|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 304d21854d349b21dd8deb8a8f319637f17bd4a8)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/sync.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/Xext/sync.c b/Xext/sync.c
index 09a14ac3c..8fd7e947e 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -2876,8 +2876,10 @@ init_system_idle_counter(const char *name, int deviceid)
if (idle_time_counter != NULL) {
IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
- priv->value_less = priv->value_greater = NULL;
- priv->deviceid = deviceid;
+ if (priv) {
+ priv->value_less = priv->value_greater = NULL;
+ priv->deviceid = deviceid;
+ }
idle_time_counter->pSysCounterInfo->private = priv;
}
--
2.54.0

90
SOURCES/0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch Normal file
View File

@ -0,0 +1,90 @@
From 574f2e975aa8f2942f33b7fa35a33d20f27cdc02 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Wed, 29 Apr 2026 05:40:33 +0000
Subject: [PATCH xserver 7/9] dix: increase XLFDMAXFONTNAMELEN to match
libXfont2's MAXFONTNAMELEN
XLFDMAXFONTNAMELEN was 256 bytes, but libXfont2 defines MAXFONTNAMELEN
as 1024 and allows font names and alias targets up to that length in
fonts.alias files.
doListFontsAndAliases copies the resolved alias target into a
stack-allocated tmp_pattern[XLFDMAXFONTNAMELEN] and then into
c->current.pattern[XLFDMAXFONTNAMELEN] (defined in LFWIstateRec).
doListFontsWithInfo has the same pattern, copying the resolved name into
c->current.pattern[]. With the old 256-byte limit, a fonts.alias entry
with a target name between 257 and 1023 bytes would overflow both
buffers.
An attacker can exploit this by:
1. Creating a font directory with a fonts.alias containing an alias
whose target name exceeds 256 bytes
2. Using SetFontPath to add the malicious directory
3. Calling ListFonts with the alias name to trigger alias resolution
4. The oversized resolved name overflows the 256-byte stack buffer
Increase XLFDMAXFONTNAMELEN from 256 to 1024 to match libXfont2's
MAXFONTNAMELEN, ensuring the server can handle any name the font library
produces.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-30136
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit bb5158f962dc935e58ef8b4b5fcb31be201a6e07)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
dix/dixfonts.c | 8 ++++++++
include/closestr.h | 7 ++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 0ea8678bb..386c38686 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -671,6 +671,10 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
* is BadFontName, indicating the alias resolution
* is complete.
*/
+ if (resolvedlen > XLFDMAXFONTNAMELEN) {
+ err = BadFontName;
+ goto ContBadFontName;
+ }
memmove(tmp_pattern, resolved, resolvedlen);
if (c->haveSaved) {
char *tmpname;
@@ -934,6 +938,10 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
memmove(c->savedName, name, namelen + 1);
aliascount = 20;
}
+ if (namelen > XLFDMAXFONTNAMELEN) {
+ err = BadFontName;
+ goto ContBadFontName;
+ }
memmove(c->current.pattern, name, namelen);
c->current.patlen = namelen;
c->current.max_names = 1;
diff --git a/include/closestr.h b/include/closestr.h
index 60e6f09bc..7567ac6ea 100644
--- a/include/closestr.h
+++ b/include/closestr.h
@@ -57,7 +57,12 @@ typedef struct _OFclosure {
/* ListFontsWithInfo */
-#define XLFDMAXFONTNAMELEN 256
+/* libXfont2 allows font names/aliases up to MAXFONTNAMELEN (1024) bytes in
+ * fonts.alias files. The server's pattern buffers must be large enough to
+ * hold resolved alias targets returned by the font library.
+ * ZDI-CAN-30136
+ */
+#define XLFDMAXFONTNAMELEN 1024
typedef struct _LFWIstate {
char pattern[XLFDMAXFONTNAMELEN];
int patlen;
--
2.54.0

43
SOURCES/0008-Xext-sync-Avoid-dereference-of-invalid-pointer-if-ma.patch Normal file
View File

@ -0,0 +1,43 @@
From 010a613e860e2ff47665535cd4821e3b5e03548a Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 16:04:50 -0700
Subject: [PATCH xserver 08/51] Xext/sync: Avoid dereference of invalid pointer
if malloc() failed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported incorrectly in #1817 as:
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2835:33: acquire_memory: allocated here
xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2843:12: danger: ‘priv’ leaks here; was allocated at [(30)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/29)
but the "leak" is really saving the pointer in an uninitalized pointer in
a structure that was already freed when the malloc of the SysCounterInfo
struct failed in SyncCreateSystemCounter(), because it returned the address
of the freed struct instead of NULL to indicate failure.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 6034ce11b6cd31d42df0f5781f70d3073d91f95b)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/sync.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/Xext/sync.c b/Xext/sync.c
index 8fd7e947e..89a1af13b 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -1025,7 +1025,7 @@ SyncCreateSystemCounter(const char *name,
psci = malloc(sizeof(SysCounterInfo));
if (!psci) {
FreeResource(pCounter->sync.id, RT_NONE);
- return pCounter;
+ return NULL;
}
pCounter->pSysCounterInfo = psci;
psci->pCounter = pCounter;
--
2.54.0

109
SOURCES/0008-dri2-Use-booleans-for-fake-front-buffer-tracking-in-.patch Normal file
View File

@ -0,0 +1,109 @@
From 8cb12cc50d0b1592294ad46594731dc088b493f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
Date: Wed, 13 May 2026 14:29:26 +0200
Subject: [PATCH xserver 8/9] dri2: Use booleans for (fake) front buffer
tracking in do_get_buffers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
This works as intended — the (fake) front buffer needs to be added
only if the client didn't request it in the first place — even if the
client requests the same attachment multiple times. This ensures we
never try to access more than (count + 1) entries of the buffers array.
Fixes: ff6c7764c290 ("DRI2: Implement protocol for DRI2GetBuffersWithFormat")
Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit b7aa65cc3bb11b792ce2a3f511ba9b863acb11c8)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
hw/xfree86/dri2/dri2.c | 37 ++++++++++++++++++-------------------
1 file changed, 18 insertions(+), 19 deletions(-)
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 6619e3aa7..fdf15d9a1 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -560,9 +560,10 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
DRI2DrawablePtr pPriv = DRI2GetDrawable(pDraw);
DRI2ScreenPtr ds;
DRI2BufferPtr *buffers;
- int need_real_front = 0;
- int need_fake_front = 0;
- int have_fake_front = 0;
+ Bool need_real_front = FALSE;
+ Bool have_real_front = FALSE;
+ Bool need_fake_front = FALSE;
+ Bool have_fake_front = FALSE;
int front_format = 0;
int dimensions_match;
int buffers_changed = 0;
@@ -595,34 +596,32 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
if (buffers[i] == NULL)
goto err_out;
- /* If the drawable is a window and the front-buffer is requested,
- * silently add the fake front-buffer to the list of requested
- * attachments. The counting logic in the loop accounts for the case
- * where the client requests both the fake and real front-buffer.
+ /* In certain cases the (fake) front buffer is always needed, so return
+ * it even if the client failed to request it.
+ * The logic in & after the loop accounts for the case where the client
+ * does request the (fake) front buffer, to avoid returning it multiple
+ * times.
*/
if (attachment == DRI2BufferBackLeft) {
- need_real_front++;
+ need_real_front = TRUE;
front_format = format;
}
if (attachment == DRI2BufferFrontLeft) {
- need_real_front--;
+ have_real_front = TRUE;
front_format = format;
- if (pDraw->type == DRAWABLE_WINDOW) {
- need_fake_front++;
- }
+ if (pDraw->type == DRAWABLE_WINDOW)
+ need_fake_front = TRUE;
}
if (pDraw->type == DRAWABLE_WINDOW) {
- if (attachment == DRI2BufferFakeFrontLeft) {
- need_fake_front--;
- have_fake_front = 1;
- }
+ if (attachment == DRI2BufferFakeFrontLeft)
+ have_fake_front = TRUE;
}
}
- if (need_real_front > 0) {
+ if (need_real_front && !have_real_front) {
if (allocate_or_reuse_buffer(pDraw, ds, pPriv, DRI2BufferFrontLeft,
front_format, dimensions_match,
&buffers[i]))
@@ -633,7 +632,7 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
i++;
}
- if (need_fake_front > 0) {
+ if (need_fake_front && !have_fake_front) {
if (allocate_or_reuse_buffer(pDraw, ds, pPriv, DRI2BufferFakeFrontLeft,
front_format, dimensions_match,
&buffers[i]))
@@ -643,7 +642,7 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
goto err_out;
i++;
- have_fake_front = 1;
+ have_fake_front = TRUE;
}
*out_count = i;
--
2.54.0

45
SOURCES/0009-Xext-vidmode-avoid-null-dereference-if-VidModeCreate.patch Normal file
View File

@ -0,0 +1,45 @@
From 0e8e24610bd8135ec0855c8a25b903f012eaad1a Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 16:20:37 -0700
Subject: [PATCH xserver 09/51] Xext/vidmode: avoid null dereference if
VidModeCreateMode() allocation fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/vidmode.c:96:5: warning[-Wanalyzer-null-argument]: use of NULL ‘VidModeCreateMode()’ where non-null expected
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 5e62aaaf57b18136969699fd073e123edfb1aa70)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/vidmode.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Xext/vidmode.c b/Xext/vidmode.c
index 6e4a7c709..2f996e9e9 100644
--- a/Xext/vidmode.c
+++ b/Xext/vidmode.c
@@ -808,6 +808,8 @@ ProcVidModeModModeLine(ClientPtr client)
return BadValue;
modetmp = VidModeCreateMode();
+ if (modetmp == NULL)
+ return BadAlloc;
VidModeCopyMode(mode, modetmp);
VidModeSetModeValue(modetmp, VIDMODE_H_DISPLAY, stuff->hdisplay);
@@ -951,6 +953,8 @@ ProcVidModeValidateModeLine(ClientPtr client)
return BadValue;
modetmp = VidModeCreateMode();
+ if (modetmp == NULL)
+ return BadAlloc;
VidModeCopyMode(mode, modetmp);
VidModeSetModeValue(modetmp, VIDMODE_H_DISPLAY, stuff->hdisplay);
--
2.54.0

140
SOURCES/0009-dri2-Deduplicate-attachments-in-do_get_buffer.patch Normal file
View File

@ -0,0 +1,140 @@
From e674fb65a6662d1951c9d9fba2df429a04b54881 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
Date: Fri, 15 May 2026 17:47:51 +0200
Subject: [PATCH xserver 9/9] dri2: Deduplicate attachments in do_get_buffer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
It was always the intention of the DRI2 protocol that there's at most
one instance of each attachment, and that's how it was implemented in
Mesa.
Since that wasn't enforced though, there might be other clients in the
wild which (e.g. accidentally) request the same attachment multiple
times. So starting to a raise a protocol error in this case now risks
breaking such clients.
Instead, just deduplicate the attachments using a bit-set.
This has a couple of desirable side effects:
* destroy_buffer cannot be called multiple times for the same
DRI2BufferPtr.
* The client cannot cause the server to allocate a buffers array with
more entries than there are attachments (currently 11).
Signed-off-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit 339c279514326134b0878fc23ce6e9520440ce7f)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2229>
---
hw/xfree86/dri2/dri2.c | 36 ++++++++++++++++++++++--------------
1 file changed, 22 insertions(+), 14 deletions(-)
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index fdf15d9a1..6b6a2b9ef 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -560,16 +560,16 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
DRI2DrawablePtr pPriv = DRI2GetDrawable(pDraw);
DRI2ScreenPtr ds;
DRI2BufferPtr *buffers;
+ unsigned attachments_bitset = 0;
Bool need_real_front = FALSE;
- Bool have_real_front = FALSE;
Bool need_fake_front = FALSE;
- Bool have_fake_front = FALSE;
int front_format = 0;
int dimensions_match;
int buffers_changed = 0;
int i;
- if (!pPriv) {
+ if (!pPriv ||
+ count > DRI2BufferHiz + 1) {
*width = pDraw->width;
*height = pDraw->height;
*out_count = 0;
@@ -581,7 +581,10 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
dimensions_match = (pDraw->width == pPriv->width)
&& (pDraw->height == pPriv->height);
- buffers = calloc((count + 1), sizeof(buffers[0]));
+ /* Since we deduplicate attachments in the buffers array, there cannot be
+ * more entries than there are attachments.
+ */
+ buffers = calloc((min(count, DRI2BufferHiz) + 1), sizeof(buffers[0]));
if (!buffers)
goto err_out;
@@ -589,6 +592,14 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
const unsigned attachment = *(attachments++);
const unsigned format = (has_format) ? *(attachments++) : 0;
+ if (attachment > DRI2BufferHiz)
+ goto err_out;
+
+ if (attachments_bitset & (1u << attachment))
+ continue;
+
+ attachments_bitset |= 1u << attachment;
+
if (allocate_or_reuse_buffer(pDraw, ds, pPriv, attachment,
format, dimensions_match, &buffers[i]))
buffers_changed = 1;
@@ -608,20 +619,15 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
}
if (attachment == DRI2BufferFrontLeft) {
- have_real_front = TRUE;
front_format = format;
if (pDraw->type == DRAWABLE_WINDOW)
need_fake_front = TRUE;
}
-
- if (pDraw->type == DRAWABLE_WINDOW) {
- if (attachment == DRI2BufferFakeFrontLeft)
- have_fake_front = TRUE;
- }
}
- if (need_real_front && !have_real_front) {
+ if (need_real_front &&
+ !(attachments_bitset & (1u << DRI2BufferFrontLeft))) {
if (allocate_or_reuse_buffer(pDraw, ds, pPriv, DRI2BufferFrontLeft,
front_format, dimensions_match,
&buffers[i]))
@@ -632,7 +638,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
i++;
}
- if (need_fake_front && !have_fake_front) {
+ if (need_fake_front &&
+ !(attachments_bitset & (1u << DRI2BufferFakeFrontLeft))) {
if (allocate_or_reuse_buffer(pDraw, ds, pPriv, DRI2BufferFakeFrontLeft,
front_format, dimensions_match,
&buffers[i]))
@@ -642,7 +649,7 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
goto err_out;
i++;
- have_fake_front = TRUE;
+ attachments_bitset |= 1u << DRI2BufferFakeFrontLeft;
}
*out_count = i;
@@ -654,7 +661,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
* contents of the real front-buffer. This ensures correct operation of
* applications that call glXWaitX before calling glDrawBuffer.
*/
- if (have_fake_front && buffers_changed) {
+ if (buffers_changed &&
+ (attachments_bitset & (1u << DRI2BufferFakeFrontLeft))) {
BoxRec box;
RegionRec region;
--
2.54.0

38
SOURCES/0010-Xext-xres-avoid-null-dereference-in-ProcXResQueryCli.patch Normal file
View File

@ -0,0 +1,38 @@
From ae00a059dcfdc8c1de23f8e9310bd140679aba09 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 17:10:20 -0700
Subject: [PATCH xserver 10/51] Xext/xres: avoid null dereference in
ProcXResQueryClients()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/xres.c:233:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘current_clients’
xwayland-24.1.6/redhat-linux-build/../Xext/xres.c:228:23: acquire_memory: this call could return NULL
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 3da60c96a9c3ea26404313eb490e46847b04949c)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/xres.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/Xext/xres.c b/Xext/xres.c
index 7a7aabc9b..4ef8aa04f 100644
--- a/Xext/xres.c
+++ b/Xext/xres.c
@@ -224,6 +224,8 @@ ProcXResQueryClients(ClientPtr client)
REQUEST_SIZE_MATCH(xXResQueryClientsReq);
current_clients = xallocarray(currentMaxClients, sizeof(int));
+ if (current_clients == NULL)
+ return BadAlloc;
num_clients = 0;
for (i = 0; i < currentMaxClients; i++) {
--
2.54.0

38
SOURCES/0011-Xext-xselinux-add-fast-path-to-ProcSELinuxListSelect.patch Normal file
View File

@ -0,0 +1,38 @@
From 63511dd097c5ff8e57f34c4f8b0af8e441c0ac3c Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 17:19:05 -0700
Subject: [PATCH xserver 11/51] Xext/xselinux: add fast path to
ProcSELinuxListSelections()
If there's nothing to send, skip over a bunch of code to make a list
that won't be used, and hopefully make the code path clearer to both
humans and static analyzers, who raise errors as seen in #1817 of
dereferencing NULL pointers when count == 0.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit d34243606c8d7a01108827ad1ca3216bf81a119d)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/xselinux_ext.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/Xext/xselinux_ext.c b/Xext/xselinux_ext.c
index 1395a563b..9784dca4e 100644
--- a/Xext/xselinux_ext.c
+++ b/Xext/xselinux_ext.c
@@ -452,8 +452,10 @@ ProcSELinuxListSelections(ClientPtr client)
count = 0;
for (pSel = CurrentSelections; pSel; pSel = pSel->next)
count++;
+ if (count == 0)
+ return SELinuxSendItemsToClient(client, NULL, 0, 0);
items = calloc(count, sizeof(SELinuxListItemRec));
- if (count && !items)
+ if (!items)
return BadAlloc;
/* Fill in the items and calculate size */
--
2.54.0

51
SOURCES/0012-Xext-xselinux-avoid-memory-leak-in-SELinuxAtomToSID.patch Normal file
View File

@ -0,0 +1,51 @@
From 50aa84b64bb9c38b4b67a00221ca6ae5e00808cc Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 17:26:47 -0700
Subject: [PATCH xserver 12/51] Xext/xselinux: avoid memory leak in
SELinuxAtomToSID()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:142:13: warning[-Wanalyzer-malloc-leak]: leak of ‘rec’
xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:133:1: enter_function: entry to ‘SELinuxAtomToSID’
xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:141:15: acquire_memory: allocated here
xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:69:12: branch_true: following ‘true’ branch...
xwayland-24.1.6/redhat-linux-build/../Xext/xselinux_label.c:142:13: danger: ‘rec’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 140| if (!rec) {
# 141| rec = calloc(1, sizeof(SELinuxAtomRec));
# 142|-> if (!rec || !SELinuxArraySet(&arr_atoms, atom, rec))
# 143| return BadAlloc;
# 144| }
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 21cbc56c43af04a72ee2d77023194f436027eb4d)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/xselinux_label.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/Xext/xselinux_label.c b/Xext/xselinux_label.c
index 8559385b9..774f1d9cc 100644
--- a/Xext/xselinux_label.c
+++ b/Xext/xselinux_label.c
@@ -138,8 +138,12 @@ SELinuxAtomToSID(Atom atom, int prop, SELinuxObjectRec ** obj_rtn)
rec = SELinuxArrayGet(&arr_atoms, atom);
if (!rec) {
rec = calloc(1, sizeof(SELinuxAtomRec));
- if (!rec || !SELinuxArraySet(&arr_atoms, atom, rec))
+ if (!rec)
return BadAlloc;
+ if (!SELinuxArraySet(&arr_atoms, atom, rec)) {
+ free(rec);
+ return BadAlloc;
+ }
}
if (prop) {
--
2.54.0

54
SOURCES/0013-Xext-xtest-avoid-null-dereference-in-ProcXTestFakeIn.patch Normal file
View File

@ -0,0 +1,54 @@
From 3612d6af9cb75895137e89302b633e730171a4d6 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 4 Oct 2025 17:38:32 -0700
Subject: [PATCH xserver 13/51] Xext/xtest: avoid null dereference in
ProcXTestFakeInput()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:383:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:348:9: release_memory: ‘dev’ is NULL
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:383:14: danger: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:395:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:348:9: release_memory: ‘dev’ is NULL
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:395:14: danger: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:426:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext
/xtest.c:348:9: release_memory: ‘dev’ is NULL
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:426:14: danger: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:440:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:348:9: release_memory: ‘dev’ is NULL
xwayland-24.1.6/redhat-linux-build/../Xext/xtest.c:440:9: danger: dereference of NULL ‘dev’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 04ef51dae63dc9ef3d28f7d0b78b4504dbb01f66)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xext/xtest.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Xext/xtest.c b/Xext/xtest.c
index 3b66224be..fe3a868a4 100644
--- a/Xext/xtest.c
+++ b/Xext/xtest.c
@@ -318,6 +318,10 @@ ProcXTestFakeInput(ClientPtr client)
return BadAccess;
dev = GetXTestDevice(dev);
+
+ /* This can only happen if we passed a slave to GetXTestDevice() */
+ if (!dev)
+ return BadAccess;
}
--
2.54.0

91
SOURCES/0014-Xi-avoid-null-dereference-if-wOtherInputMasks-return.patch Normal file
View File

@ -0,0 +1,91 @@
From 826550e2cfd8a033c4a16dffdd852f2115e7331f Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 5 Oct 2025 15:38:35 -0700
Subject: [PATCH xserver 14/51] Xi: avoid null dereference if
wOtherInputMasks() returns NULL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The wOtherInputMasks(win) macro will return NULL if
win->optional is NULL.
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:1390:13:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:1404:13:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:2293:9:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:3244:22:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:3338:9:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 7b7bcf92311db87a0292474dcf2ed9767f4a9abd)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xi/exevents.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/Xi/exevents.c b/Xi/exevents.c
index 1930089d3..7249f492c 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -1331,6 +1331,7 @@ RetrieveTouchDeliveryData(DeviceIntPtr dev, TouchPointInfoPtr ti,
else
evtype = GetXI2Type(ev->any.type);
+ BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE);
nt_list_for_each_entry(iclients,
wOtherInputMasks(*win)->inputClients, next)
if (xi2mask_isset(iclients->xi2mask, dev, evtype))
@@ -1345,6 +1346,7 @@ RetrieveTouchDeliveryData(DeviceIntPtr dev, TouchPointInfoPtr ti,
int xi_type = GetXIType(TouchGetPointerEventType(ev));
Mask xi_filter = event_get_filter_from_type(dev, xi_type);
+ BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE);
nt_list_for_each_entry(iclients,
wOtherInputMasks(*win)->inputClients, next)
if (iclients->mask[dev->id] & xi_filter)
@@ -2974,13 +2976,18 @@ DeviceEventSuppressForWindow(WindowPtr pWin, ClientPtr client, Mask mask,
inputMasks->dontPropagateMask[maskndx] = mask;
}
else {
- if (!inputMasks)
- AddExtensionClient(pWin, client, 0, 0);
- inputMasks = wOtherInputMasks(pWin);
+ if (!inputMasks) {
+ int ret = AddExtensionClient(pWin, client, 0, 0);
+
+ if (ret != Success)
+ return ret;
+ inputMasks = wOtherInputMasks(pWin);
+ BUG_RETURN_VAL(!inputMasks, BadAlloc);
+ }
inputMasks->dontPropagateMask[maskndx] = mask;
}
RecalculateDeviceDeliverableEvents(pWin);
- if (ShouldFreeInputMasks(pWin, FALSE))
+ if (inputMasks && ShouldFreeInputMasks(pWin, FALSE))
FreeResource(inputMasks->inputClients->resource, RT_NONE);
return Success;
}
@@ -3075,6 +3082,7 @@ XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client,
if (len && !others) {
if (AddExtensionClient(win, client, 0, 0) != Success)
return BadAlloc;
+ BUG_RETURN_VAL(!wOtherInputMasks(win), BadAlloc);
others = wOtherInputMasks(win)->inputClients;
}
--
2.54.0

43
SOURCES/0015-Xi-set-value-for-led_values-in-CopySwapKbdFeedback.patch Normal file
View File

@ -0,0 +1,43 @@
From 5eeb67f1d806c25ef31d2110b21644a59de83815 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 5 Oct 2025 17:12:29 -0700
Subject: [PATCH xserver 15/51] Xi: set value for led_values in
CopySwapKbdFeedback()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
(The existing setting of led_mask is probably wrong, but has been set
like this since X11R5 and going back as far as the first version in
the X Consortium source control archives.)
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xi/getfctl.c:108:9:
warning[-Wanalyzer-use-of-uninitialized-value]:
use of uninitialized value ‘*k2.led_values’
108|-> swapl(&k2->led_values);
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 90c8429d3509894f8834ead3b15f2e76657e57a6)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xi/getfctl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/Xi/getfctl.c b/Xi/getfctl.c
index eea0113c1..61f14c5ea 100644
--- a/Xi/getfctl.c
+++ b/Xi/getfctl.c
@@ -97,6 +97,7 @@ CopySwapKbdFeedback(ClientPtr client, KbdFeedbackPtr k, char **buf)
k2->pitch = k->ctrl.bell_pitch;
k2->duration = k->ctrl.bell_duration;
k2->led_mask = k->ctrl.leds;
+ k2->led_values = k->ctrl.leds;
k2->global_auto_repeat = k->ctrl.autoRepeat;
for (i = 0; i < 32; i++)
k2->auto_repeats[i] = k->ctrl.autoRepeats[i];
--
2.54.0

41
SOURCES/0016-Xi-handle-allocation-failure-in-ProcXGetDeviceDontPr.patch Normal file
View File

@ -0,0 +1,41 @@
From f9d3537883522255d5fa91ea8b63c745286232ee Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 5 Oct 2025 17:32:45 -0700
Subject: [PATCH xserver 16/51] Xi: handle allocation failure in
ProcXGetDeviceDontPropagateList()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xi/getprop.c:163:25:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘buf’
xwayland-24.1.6/redhat-linux-build/../Xi/getprop.c:121:19:
acquire_memory: this call could return NULL
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 7b18313e2a9d0409ac7465d2f313153013fdf5a3)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xi/getprop.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/Xi/getprop.c b/Xi/getprop.c
index b744f35cb..b53db7306 100644
--- a/Xi/getprop.c
+++ b/Xi/getprop.c
@@ -119,6 +119,8 @@ ProcXGetDeviceDontPropagateList(ClientPtr client)
if (count) {
rep.count = count;
buf = xallocarray(rep.count, sizeof(XEventClass));
+ if (buf == NULL)
+ return BadAlloc;
rep.length = bytes_to_int32(rep.count * sizeof(XEventClass));
tbuf = buf;
--
2.54.0

43
SOURCES/0017-Xi-handle-allocation-failure-in-ProcXListInputDevice.patch Normal file
View File

@ -0,0 +1,43 @@
From 4c5a0e203feaae43134264bb3a999453d6f09a2c Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 5 Oct 2025 17:37:48 -0700
Subject: [PATCH xserver 17/51] Xi: handle allocation failure in
ProcXListInputDevices()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xi/listdev.c:171:5:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘dev’
xwayland-24.1.6/redhat-linux-build/../Xi/listdev.c:379:23:
acquire_memory: this call could return NULL
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 19c6195e711d9f9fabbde1bea7a6393c4a4c3cd3)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xi/listdev.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Xi/listdev.c b/Xi/listdev.c
index c15e61b37..5b860e92c 100644
--- a/Xi/listdev.c
+++ b/Xi/listdev.c
@@ -377,6 +377,10 @@ ProcXListInputDevices(ClientPtr client)
/* allocate space for reply */
total_length = numdevs * sizeof(xDeviceInfo) + size + namesize;
devbuf = (char *) calloc(1, total_length);
+ if (!devbuf) {
+ free(skip);
+ return BadAlloc;
+ }
classbuf = devbuf + (numdevs * sizeof(xDeviceInfo));
namebuf = classbuf + size;
savbuf = devbuf;
--
2.54.0

39
SOURCES/0018-Xi-handle-allocation-failure-in-add_master_func.patch Normal file
View File

@ -0,0 +1,39 @@
From d3db315eb5fff0933c16e772081754ee02b48938 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 5 Oct 2025 17:52:39 -0700
Subject: [PATCH xserver 18/51] Xi: handle allocation failure in
add_master_func()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../Xi/xibarriers.c:729:5:
warning[-Wanalyzer-null-dereference]:
dereference of NULL ‘AllocBarrierDevice()’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 0ee603905387e00a2e3d83ead1de99ca61d641fb)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
Xi/xibarriers.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c
index cb336f22b..ad82852fe 100644
--- a/Xi/xibarriers.c
+++ b/Xi/xibarriers.c
@@ -726,6 +726,8 @@ static void add_master_func(void *res, XID id, void *devid)
pbd = AllocBarrierDevice();
+ if (!pbd)
+ return;
pbd->deviceid = *deviceid;
input_lock();
--
2.54.0

39
SOURCES/0019-dix-handle-allocation-failure-in-DeviceFocusEvent.patch Normal file
View File

@ -0,0 +1,39 @@
From 4f68278ca74892098c6600adc3e6d8901682793e Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 11 Oct 2025 12:59:04 -0700
Subject: [PATCH xserver 19/51] dix: handle allocation failure in
DeviceFocusEvent()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../dix/enterleave.c:786:5:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘xi2event’
Fixes: 3f37923a7 ("Xi: send XI2 focus events." in Xorg 1.10.0)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit dedceb52bcbba2431368b53acbbba490ac8ee485)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
dix/enterleave.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/dix/enterleave.c b/dix/enterleave.c
index 78a7dab39..df3ffd224 100644
--- a/dix/enterleave.c
+++ b/dix/enterleave.c
@@ -774,6 +774,7 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
len = sizeof(xXIFocusInEvent) + btlen * 4;
xi2event = calloc(1, len);
+ BUG_RETURN(xi2event == NULL);
xi2event->type = GenericEvent;
xi2event->extension = IReqCode;
xi2event->evtype = type;
--
2.54.0

54
SOURCES/0020-dix-avoid-null-dereference-if-wOtherInputMasks-retur.patch Normal file
View File

@ -0,0 +1,54 @@
From 69599f57afd64ff1289dbbd29e5e108435b7ffc2 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 11 Oct 2025 16:16:12 -0700
Subject: [PATCH xserver 20/51] dix: avoid null dereference if
wOtherInputMasks() returns NULL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The wOtherInputMasks(win) macro will return NULL if
win->optional is NULL.
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../dix/gestures.c:242:9:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
xwayland-24.1.6/redhat-linux-build/../dix/touch.c:765:9:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
xwayland-24.1.6/redhat-linux-build/../dix/touch.c:782:9:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 15496a5e3d5407a2b480d8c726b012455f7898bb)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
dix/touch.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/dix/touch.c b/dix/touch.c
index 37902bd05..5c5c21303 100644
--- a/dix/touch.c
+++ b/dix/touch.c
@@ -797,6 +797,8 @@ TouchAddRegularListener(DeviceIntPtr dev, TouchPointInfoPtr ti,
inputMasks = wOtherInputMasks(win);
if (mask & EVENT_XI2_MASK) {
+ BUG_RETURN_VAL(!inputMasks, FALSE);
+
nt_list_for_each_entry(iclients, inputMasks->inputClients, next) {
if (!xi2mask_isset(iclients->xi2mask, dev, evtype))
continue;
@@ -814,6 +816,8 @@ TouchAddRegularListener(DeviceIntPtr dev, TouchPointInfoPtr ti,
int xitype = GetXIType(TouchGetPointerEventType(ev));
Mask xi_filter = event_get_filter_from_type(dev, xitype);
+ BUG_RETURN_VAL(!inputMasks, FALSE);
+
nt_list_for_each_entry(iclients, inputMasks->inputClients, next) {
if (!(iclients->mask[dev->id] & xi_filter))
continue;
--
2.54.0

62
SOURCES/0021-dix-assert-that-size-of-buffers-to-swap-is-a-multipl.patch Normal file
View File

@ -0,0 +1,62 @@
From 98988e606948fb88290fe51ab8aed599c2dc7b42 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 11 Oct 2025 18:26:55 -0700
Subject: [PATCH xserver 21/51] dix: assert that size of buffers to swap is a
multiple of the swap size
If we're swapping 4-byte integers or 2-byte integers, make sure the size
of the buffer doesn't have any bytes left over, since we won't correctly
handle those bytes.
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../dix/swaprep.c:99:22:
warning[-Wanalyzer-allocation-size]:
allocated buffer size is not a multiple of the pointee's size
xwayland-24.1.6/redhat-linux-build/../dix/swaprep.c:146:22:
warning[-Wanalyzer-allocation-size]:
allocated buffer size is not a multiple of the pointee's size
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit cf49354b6060b71ae41febe67327278fbcb7c74a)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
dix/swaprep.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/dix/swaprep.c b/dix/swaprep.c
index 08344d7f7..04279e5f4 100644
--- a/dix/swaprep.c
+++ b/dix/swaprep.c
@@ -48,6 +48,8 @@ SOFTWARE.
#include <dix-config.h>
#endif
+#include <assert.h>
+
#include <X11/X.h>
#include <X11/Xproto.h>
#include "misc.h"
@@ -95,6 +97,8 @@ CopySwap32Write(ClientPtr pClient, int size, CARD32 *pbuf)
CARD32 *from, *to, *fromLast, *toLast;
CARD32 tmpbuf[1];
+ assert((bufsize % sizeof(CARD32)) == 0);
+
/* Allocate as big a buffer as we can... */
while (!(pbufT = malloc(bufsize))) {
bufsize >>= 1;
@@ -142,6 +146,8 @@ CopySwap16Write(ClientPtr pClient, int size, short *pbuf)
short *from, *to, *fromLast, *toLast;
short tmpbuf[2];
+ assert((bufsize % sizeof(short)) == 0);
+
/* Allocate as big a buffer as we can... */
while (!(pbufT = malloc(bufsize))) {
bufsize >>= 1;
--
2.54.0

42
SOURCES/0022-dix-handle-allocation-failure-in-ChangeWindowDeviceC.patch Normal file
View File

@ -0,0 +1,42 @@
From 28c7d5470a1d4241594d2629952427767e3b88ce Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 12 Oct 2025 09:48:15 -0700
Subject: [PATCH xserver 22/51] dix: handle allocation failure in
ChangeWindowDeviceCursor()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../dix/window.c:3495:9:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘pNewNode’
xwayland-24.1.6/redhat-linux-build/../dix/window.c:3494:20:
acquire_memory: this call could return NULL
Fixes: 95e1a8805 ("Xi: Adding ChangeDeviceCursor request" in xorg 1.10.0)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit c9fa8a8da161e1c37058a342ba5495ce627d0985)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2077>
---
dix/window.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/dix/window.c b/dix/window.c
index 8789a5ece..219e8c470 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -3510,6 +3510,8 @@ ChangeWindowDeviceCursor(WindowPtr pWin, DeviceIntPtr pDev, CursorPtr pCursor)
return Success;
pNewNode = malloc(sizeof(DevCursNodeRec));
+ if (!pNewNode)
+ return BadAlloc;
pNewNode->dev = pDev;
pNewNode->next = pWin->optional->deviceCursors;
pWin->optional->deviceCursors = pNewNode;
--
2.54.0

42
SOURCES/0023-xfree86-Fix-builds-with-gcc-Wpedantic.patch Normal file
View File

@ -0,0 +1,42 @@
From 6fda4afcb9f5ebcaa7ebb91a4e55a19c4a64cf4d Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 10 Aug 2025 11:20:01 -0700
Subject: [PATCH xserver 23/51] xfree86: Fix builds with gcc -Wpedantic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
../hw/xfree86/loader/loadmod.c:85:33: warning: ISO C forbids empty
initializer braces before C23 [-Wpedantic]
85 | static int ModuleDuplicated[] = { };
| ^
../hw/xfree86/loader/loadmod.c:85:12: error: zero or negative size array
‘ModuleDuplicated’
85 | static int ModuleDuplicated[] = { };
| ^~~~~~~~~~~~~~~~
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit d03c84b57f1455b20518781026777b938194b2a4)
(cherry picked from commit 3e0f37c95c92829e338a910379440ba9b4f4170d)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
hw/xfree86/loader/loadmod.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/xfree86/loader/loadmod.c b/hw/xfree86/loader/loadmod.c
index 342c7b800..6f7c6d93c 100644
--- a/hw/xfree86/loader/loadmod.c
+++ b/hw/xfree86/loader/loadmod.c
@@ -82,7 +82,7 @@ const ModuleVersions LoaderVersionInfo = {
ABI_EXTENSION_VERSION,
};
-static int ModuleDuplicated[] = { };
+static int ModuleDuplicated[] = { 0 };
static void
FreeStringList(char **paths)
--
2.54.0

52
SOURCES/0024-dix-set-errorValue-correctly-when-XID-lookup-fails-i.patch Normal file
View File

@ -0,0 +1,52 @@
From 82a58016e202f10e87b2d629f6ae3a6bcfca80cb Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 7 Dec 2025 15:57:53 -0800
Subject: [PATCH xserver 24/51] dix: set errorValue correctly when XID lookup
fails in ChangeGCXIDs()
dixLookupResourceByType always overwrites the pointer passed in as the
first arg, so we shouldn't use the union it's in after that to get the
requested XID value to put in the errorValue.
Closes: #1857
Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.")
Reported-by: Mouse <mouse@Rodents-Montreal.ORG>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit ac42c39145849588544ad10812e5a8ae76bf1114)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
dix/gc.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/dix/gc.c b/dix/gc.c
index 4ccbd3b54..717998cfd 100644
--- a/dix/gc.c
+++ b/dix/gc.c
@@ -441,6 +441,7 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32)
vals[i].val = pC32[i];
for (i = 0; i < ARRAY_SIZE(xidfields); ++i) {
int offset, rc;
+ XID id;
if (!(mask & xidfields[i].mask))
continue;
@@ -449,11 +450,13 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32)
vals[offset].ptr = NullPixmap;
continue;
}
- rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val,
+ /* save the id, since dixLookupResourceByType overwrites &vals[offset] */
+ id = vals[offset].val;
+ rc = dixLookupResourceByType(&vals[offset].ptr, id,
xidfields[i].type, client,
xidfields[i].access_mode);
if (rc != Success) {
- client->errorValue = vals[offset].val;
+ client->errorValue = id;
return rc;
}
}
--
2.54.0

40
SOURCES/0025-os-avoid-closing-null-fd-at-Fopen.patch Normal file
View File

@ -0,0 +1,40 @@
From 1542f1bb8de1d4ccd32047a15740c8dd1002502b Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Date: Wed, 17 Dec 2025 11:52:16 +0300
Subject: [PATCH xserver 25/51] os: avoid closing null fd at Fopen
In `Fopen` function variable `iop` may store NULL as a result of `fopen`
call. In this case, if later privileges couldn't be restored (`seteuid`
call fails), further `fclose(iop)` call will cause runtime error.
This commit adds check `iop` for NULL before calling `fclose` to prevent
potential NULL pointer dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit f83807647e171def9244a7f1d8d9af8e8e79f847)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
os/utils.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/os/utils.c b/os/utils.c
index 2ba1c8013..0a9f36fcd 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -1589,7 +1589,9 @@ Fopen(const char *file, const char *type)
iop = fopen(file, type);
if (seteuid(euid) == -1) {
- fclose(iop);
+ if (iop) {
+ fclose(iop);
+ }
return NULL;
}
return iop;
--
2.54.0

50
SOURCES/0026-render-fix-multiple-mem-leaks-on-err-paths.patch Normal file
View File

@ -0,0 +1,50 @@
From 7ad37a32bc5ad5d385bfd65755d58f10f1c10013 Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Date: Thu, 5 Feb 2026 16:07:43 +0300
Subject: [PATCH xserver 26/51] render: fix multiple mem leaks on err paths
Free nested allocations when initialization fails.
Several code paths returned early on error without releasing
memory owned by embedded structures, leading to leaks.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit 809402414e4b84ad5c084221c7b4da9bd2c5d55d)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
render/picture.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/render/picture.c b/render/picture.c
index a53f3b560..f6729eaef 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -911,6 +911,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2,
initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
if (*error) {
+ free(pPicture->pSourcePict);
free(pPicture);
return 0;
}
@@ -956,6 +957,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner,
initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
if (*error) {
+ free(pPicture->pSourcePict);
free(pPicture);
return 0;
}
@@ -994,6 +996,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle,
initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
if (*error) {
+ free(pPicture->pSourcePict);
free(pPicture);
return 0;
}
--
2.54.0

52
SOURCES/0027-dix-avoid-null-ptr-deref-at-doListFontsAndAliases.patch Normal file
View File

@ -0,0 +1,52 @@
From d977ac58df2837014b4b1745113d03937cf6bf2f Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Date: Wed, 17 Dec 2025 11:15:27 +0300
Subject: [PATCH xserver 27/51] dix: avoid null ptr deref at
doListFontsAndAliases
In the `doListFontsAndAliases` function in dixfonts.c, when a font alias
is encountered (`err == FontNameAlias`) as a result of
`list_next_font_or_alias` call, the code allocates memory for
`resolved` variable (`resolvedlen + 1` bytes) for storing target font
name. In this case, if the `malloc(resolvedlen + 1)` call fails,
`resolved` remains NULL.
Later, when check (`else if (err == FontNameAlias)`) is TRUE, the code
uses `memcpy` to copy nullable `resolved` into `tmp_pattern` without
checking if `resolved` is NULL, so there is a potential null ptr
dereference.
This commit replaces `malloc` with `XNFalloc` for allocating memory for
`resolved`. `XNFalloc` will internally check result of `malloc` and stop
program execution if allocation was failed, preventing potential NULL
dereferencing.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit 0237462d326c78868c83b6eda35a9d35725f3b33)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
dix/dixfonts.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index b079dcf67..553f4d7d4 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -639,9 +639,8 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
}
if (err == FontNameAlias) {
free(resolved);
- resolved = malloc(resolvedlen + 1);
- if (resolved)
- memmove(resolved, tmpname, resolvedlen + 1);
+ resolved = XNFalloc(resolvedlen + 1);
+ memcpy(resolved, tmpname, resolvedlen + 1);
}
}
--
2.54.0

59
SOURCES/0028-randr-clear-primary-screen-s-primaryOutput-when-the-.patch Normal file
View File

@ -0,0 +1,59 @@
From 361a7e40f294e471d4b2f9bfb7a250fb84d8564b Mon Sep 17 00:00:00 2001
From: hongao <hongao@uniontech.com>
Date: Wed, 15 May 2024 14:35:23 +0800
Subject: [PATCH xserver 28/51] randr: clear primary screen's primaryOutput
when the output is deleted
This fix use after free when a pluggable gpu screen (such as displaylink)
was set as primary screen and unpluged.
gdb backtrace:
#0 OssigHandler (signo=11, sip=0x7fff2e0a50f0, unused=0x7fff2e0a4fc0) at ../../../../os/osinit.c:138
#1 <signal handler called>
#2 rrGetscreenResources (client=0x3195160, query=0) at ../../../../randr/rrscreen.c:577
#3 0x0000000000562bae in ProcRRGetscreenResourcesCurrent (client=0x3195160) at ../../../../randr/rrscreen.c:652
#4 OxOOOOB0000054de63 in ProcRRDispatch (client=0x3195160) at ../../../../randr/randr.c:717
#5 0x00000000004322c6 in Dispatch () at ../../../../dix/dispatch.c:485
#6 0x0900900990443139 in dix_main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/main.c:276
#7 0X0000000000421d9a in main (argc=12, argv=0x7fff2e0a5f78, envp=0x7fff2e0a5fe0) at ../../../../dix/stubmain.c:34
Signed-off-by: hongao <hongao@uniontech.com>
(cherry picked from commit 1443fd34ea37e8c7cedfac446e4a34205c5fbbb0)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
randr/rroutput.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/randr/rroutput.c b/randr/rroutput.c
index e52ad7671..d98446ab1 100644
--- a/randr/rroutput.c
+++ b/randr/rroutput.c
@@ -374,6 +374,8 @@ RROutputDestroyResource(void *value, XID pid)
{
RROutputPtr output = (RROutputPtr) value;
ScreenPtr pScreen = output->pScreen;
+ ScreenPtr primary;
+ rrScrPrivPtr primarysp;
int m;
if (pScreen) {
@@ -394,6 +396,15 @@ RROutputDestroyResource(void *value, XID pid)
if (pScrPriv->primaryOutput == output)
pScrPriv->primaryOutput = NULL;
+ if (pScreen->isGPU) {
+ primary = pScreen->current_master;
+ if (primary) {
+ primarysp = rrGetScrPriv(primary);
+ if (primarysp->primaryOutput == output)
+ primarysp->primaryOutput = NULL;
+ }
+ }
+
for (i = 0; i < pScrPriv->numOutputs; i++) {
if (pScrPriv->outputs[i] == output) {
memmove(pScrPriv->outputs + i, pScrPriv->outputs + i + 1,
--
2.54.0

31
SOURCES/0029-Make-xf86CompatOutput-return-NULL-when-there-are-no-.patch Normal file
View File

@ -0,0 +1,31 @@
From 8b532c093256aea097867ec12afab459076f28a3 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu.herrb@laas.fr>
Date: Sun, 31 Oct 2021 11:28:28 +0100
Subject: [PATCH xserver 29/51] Make xf86CompatOutput() return NULL when there
are no privates
Some drivers (mach64 w/o DRI for instance) don't initialize privates.
Signed-off-by: Matthieu Herrb <matthieu.herrb@laas.fr>
(cherry picked from commit 80eeff3ebac772e25c9107199989e677457dbe06)
---
hw/xfree86/modes/xf86Crtc.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
index 1d1124a1b..2ab16322b 100644
--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
@@ -839,6 +839,9 @@ xf86CompatOutput(ScrnInfoPtr pScrn)
{
xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
+ if (xf86CrtcConfigPrivateIndex == -1)
+ return NULL;
+
if (config->compat_output < 0)
return NULL;
return config->output[config->compat_output];
--
2.54.0

37
SOURCES/0030-Better-fix-for-xf86CompatOut-when-there-are-no-priva.patch Normal file
View File

@ -0,0 +1,37 @@
From c739165b8d2782ea9059494c482aa1854dfb74f3 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Sun, 5 Dec 2021 21:59:12 +0100
Subject: [PATCH xserver 30/51] Better fix for xf86CompatOut() when there are
no privates
XF86_CRTC_CONFIG_PTR() will derefence privates[-1] in this case.
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
(cherry picked from commit 75d70612888f18339703315549db781a22c0cb23)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
hw/xfree86/modes/xf86Crtc.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
index 2ab16322b..2b0fb687c 100644
--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
@@ -837,11 +837,11 @@ extern _X_EXPORT int xf86CrtcConfigPrivateIndex;
static _X_INLINE xf86OutputPtr
xf86CompatOutput(ScrnInfoPtr pScrn)
{
- xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(pScrn);
+ xf86CrtcConfigPtr config;
if (xf86CrtcConfigPrivateIndex == -1)
return NULL;
-
+ config = XF86_CRTC_CONFIG_PTR(pScrn);
if (config->compat_output < 0)
return NULL;
return config->output[config->compat_output];
--
2.54.0

35
SOURCES/0031-xf86-check-return-value-of-XF86_CRTC_CONFIG_PTR-in-x.patch Normal file
View File

@ -0,0 +1,35 @@
From 33ce204fd96b7f46f97da73f3144eca384584513 Mon Sep 17 00:00:00 2001
From: Benjamin Valentin <benjamin.valentin@ml-pa.com>
Date: Mon, 27 Dec 2021 14:53:22 +0100
Subject: [PATCH xserver 31/51] xf86: check return value of
XF86_CRTC_CONFIG_PTR in xf86CompatOutput()
If privates[xf86CrtcConfigPrivateIndex].ptr is NULL, this will cause
a segfault.
Possible fix for !1241
Signed-off-by: Benjamin Valentin <benjamin.valentin@ml-pa.com>
(cherry picked from commit 907c501926775fdbc9a8bfcfd3d64ac3d5502775)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
hw/xfree86/modes/xf86Crtc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/xfree86/modes/xf86Crtc.h b/hw/xfree86/modes/xf86Crtc.h
index 2b0fb687c..d8cba59fd 100644
--- a/hw/xfree86/modes/xf86Crtc.h
+++ b/hw/xfree86/modes/xf86Crtc.h
@@ -842,7 +842,7 @@ xf86CompatOutput(ScrnInfoPtr pScrn)
if (xf86CrtcConfigPrivateIndex == -1)
return NULL;
config = XF86_CRTC_CONFIG_PTR(pScrn);
- if (config->compat_output < 0)
+ if ((config == NULL) || (config->compat_output < 0))
return NULL;
return config->output[config->compat_output];
}
--
2.54.0

48
SOURCES/0032-os-include-assert.h-in-ospoll.c.patch Normal file
View File

@ -0,0 +1,48 @@
From 4df75d6f5a98cdefc52d459ad9f6fce3ba5f642b Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 14 Mar 2026 17:06:28 -0700
Subject: [PATCH xserver 32/51] os: include <assert.h> in ospoll.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Fixes build failure in mingw-cross-build:
../os/ospoll.c: In function ‘ospoll_destroy’:
../os/ospoll.c:266:9: error: implicit declaration of function ‘assert’
[-Werror=implicit-function-declaration]
266 | assert (ospoll->num == 0);
| ^~~~~~
../os/ospoll.c:59:1: note: ‘assert’ is defined in header ‘<assert.h>’;
did you forget to ‘#include <assert.h>’?
58 | #include "xserver_poll.h"
+++ |+#include <assert.h>
59 | #define POLL 1
../os/ospoll.c:266:9: warning: nested extern declaration of ‘assert’
[-Wnested-externs]
266 | assert (ospoll->num == 0);
| ^~~~~~
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 7f8570bfa16bd41e4536385b46742cc316546529)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
os/ospoll.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/os/ospoll.c b/os/ospoll.c
index c68aabc87..387ead4e0 100644
--- a/os/ospoll.c
+++ b/os/ospoll.c
@@ -26,6 +26,7 @@
#include <X11/X.h>
#include <X11/Xproto.h>
+#include <assert.h>
#include <stdlib.h>
#include <unistd.h>
#include "misc.h" /* for typedef of pointer */
--
2.54.0

49
SOURCES/0033-os-make-FormatInt64-handle-LONG_MIN-correctly.patch Normal file
View File

@ -0,0 +1,49 @@
From 77d1f03ec166c3c4e12b05dd51aa0ad41d18694c Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri, 19 Dec 2025 17:10:43 -0800
Subject: [PATCH xserver 33/51] os: make FormatInt64() handle LONG_MIN
correctly
When compiling with gcc 15.2.0 using -O3 -m64 on Solaris SPARC & x64,
we'd get a test failure of:
Assertion failed: strcmp(logmsg, expected) == 0,
file ../test/signal-logging.c, line 339, function logging_format
because 'num *= 1' produced a value that was out of the range of the
int64_t it was being stored in. (Compiling with -O2 worked fine with
the same compiler/configuration/platform though.)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 7f68b588657ea14050971efa86682e55e2c7e21b)
(cherry picked from commit 3eac9393d734a1aa8342179f98e30569da70db95)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
os/utils.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/os/utils.c b/os/utils.c
index 0a9f36fcd..7130c27aa 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -2084,12 +2084,14 @@ xstrtokenize(const char *str, const char *separators)
void
FormatInt64(int64_t num, char *string)
{
+ uint64_t unum = num;
+
if (num < 0) {
string[0] = '-';
- num *= -1;
+ unum = num * -1;
string++;
}
- FormatUInt64(num, string);
+ FormatUInt64(unum, string);
}
/* Format a number into a string in a signal safe manner. The string should be
--
2.54.0

31
SOURCES/0034-os-use-close-on-exec-for-X-server-socket-to-prevent-.patch Normal file
View File

@ -0,0 +1,31 @@
From aa5e76a3983061b9471334b3619d207b41d91d13 Mon Sep 17 00:00:00 2001
From: Twaik Yont <9674930+twaik@users.noreply.github.com>
Date: Thu, 10 Apr 2025 17:55:58 +0300
Subject: [PATCH xserver 34/51] os: use close-on-exec for X server socket to
prevent fd leaks
In most typical Linux X servers (like Xvfb, Xephyr, or Xwayland), no child process outlives the server, so this issue rarely arises. However, in embedded X servers (based on Xvfb or Kdrive) or in custom Xorg modules, the server might launch a long-running command with regular fork+exec calls. If the X server crashes or exits while that command is still running (for example, it spawns a tombstone generator or any process that hangs or turns to zombie), the file descriptor associated with the abstract socket can remain open in the child process. This leads to the kernel refusing to allow another X server to bind the same socket until the child process terminates (because there is no explicit way to unlink abstract socket, unlike Unix socket). By marking the file descriptor as close-on-exec, we ensure it is automatically closed in child processes, preserving the ability of a new X server process to bind the socket immediately.
Signed-off-by: Twaik Yont <9674930+twaik@users.noreply.github.com>
(cherry picked from commit 5568b0f83f388a295f42d49411ced17387043794)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
os/connection.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/os/connection.c b/os/connection.c
index 32d2cda2a..406f8763e 100644
--- a/os/connection.c
+++ b/os/connection.c
@@ -283,6 +283,7 @@ CreateWellKnownSockets(void)
int fd = _XSERVTransGetConnectionNumber(ListenTransConns[i]);
ListenTransFds[i] = fd;
+ _XSERVTransSetOption(ListenTransConns[i], TRANS_CLOSEONEXEC, 0);
SetNotifyFd(fd, QueueNewConnections, X_NOTIFY_READ, NULL);
if (!_XSERVTransIsLocal(ListenTransConns[i]))
--
2.54.0

45
SOURCES/0035-xf86bigfont-fix-Wimplicit-function-declaration-error.patch Normal file
View File

@ -0,0 +1,45 @@
From 438c50a04248e7dcbd1f500bd5787034157b82c7 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 10 Aug 2025 09:43:33 -0700
Subject: [PATCH xserver 35/51] xf86bigfont: fix
-Wimplicit-function-declaration error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Build breaks with gcc 14 & later when xf86bigfont is enabled:
../Xext/xf86bigfont.c: In function ‘XFree86BigfontExtensionInit’:
../Xext/xf86bigfont.c:709:28: error: implicit declaration of function
‘xfont2_allocate_font_private_index’;
did you mean ‘AllocateFontPrivateIndex’? [-Wimplicit-function-declaration]
709 | FontShmdescIndex = xfont2_allocate_font_private_index();
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| AllocateFontPrivateIndex
Fixes: 05a793f5b ("dix: Switch to the libXfont2 API (v2)")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 0617f6075b6a867c90912ccaf9de2200d06a5419)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
Xext/xf86bigfont.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/Xext/xf86bigfont.c b/Xext/xf86bigfont.c
index 529595bb7..13f7fbf10 100644
--- a/Xext/xf86bigfont.c
+++ b/Xext/xf86bigfont.c
@@ -58,6 +58,9 @@
#include <X11/X.h>
#include <X11/Xproto.h>
+#include <X11/fonts/fontstruct.h>
+#include <X11/fonts/libxfont2.h>
+
#include "misc.h"
#include "os.h"
#include "dixstruct.h"
--
2.54.0

88
SOURCES/0036-glamor-handle-potential-NULL-return-from-GetPictureS.patch Normal file
View File

@ -0,0 +1,88 @@
From 5a2199f57a361100edbab68d2feee192c51fc682 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 25 Oct 2025 15:33:40 -0700
Subject: [PATCH xserver 36/51] glamor: handle potential NULL return from
GetPictureScreenIfSet()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Unlike GetPictureScreen(), GetPictureScreenIfSet() checks if the
private key is registered, and returns NULL if it is not.
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../glamor/glamor.c:926:5:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ps’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 69b48423bd66f04bac8a633004ebc8e6e691756f)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor.c | 38 +++++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 17 deletions(-)
diff --git a/glamor/glamor.c b/glamor/glamor.c
index abefef614..236c45d6d 100644
--- a/glamor/glamor.c
+++ b/glamor/glamor.c
@@ -711,23 +711,25 @@ glamor_init(ScreenPtr screen, unsigned int flags)
glamor_priv->saved_procs.bitmap_to_region = screen->BitmapToRegion;
screen->BitmapToRegion = glamor_bitmap_to_region;
- glamor_priv->saved_procs.composite = ps->Composite;
- ps->Composite = glamor_composite;
+ if (ps) {
+ glamor_priv->saved_procs.composite = ps->Composite;
+ ps->Composite = glamor_composite;
- glamor_priv->saved_procs.trapezoids = ps->Trapezoids;
- ps->Trapezoids = glamor_trapezoids;
+ glamor_priv->saved_procs.trapezoids = ps->Trapezoids;
+ ps->Trapezoids = glamor_trapezoids;
- glamor_priv->saved_procs.triangles = ps->Triangles;
- ps->Triangles = glamor_triangles;
+ glamor_priv->saved_procs.triangles = ps->Triangles;
+ ps->Triangles = glamor_triangles;
- glamor_priv->saved_procs.addtraps = ps->AddTraps;
- ps->AddTraps = glamor_add_traps;
+ glamor_priv->saved_procs.addtraps = ps->AddTraps;
+ ps->AddTraps = glamor_add_traps;
- glamor_priv->saved_procs.composite_rects = ps->CompositeRects;
- ps->CompositeRects = glamor_composite_rectangles;
+ glamor_priv->saved_procs.composite_rects = ps->CompositeRects;
+ ps->CompositeRects = glamor_composite_rectangles;
- glamor_priv->saved_procs.glyphs = ps->Glyphs;
- ps->Glyphs = glamor_composite_glyphs;
+ glamor_priv->saved_procs.glyphs = ps->Glyphs;
+ ps->Glyphs = glamor_composite_glyphs;
+ }
glamor_init_vbo(screen);
glamor_init_gradient_shader(screen);
@@ -784,11 +786,13 @@ glamor_close_screen(ScreenPtr screen)
screen->BitmapToRegion = glamor_priv->saved_procs.bitmap_to_region;
screen->BlockHandler = glamor_priv->saved_procs.block_handler;
- ps->Composite = glamor_priv->saved_procs.composite;
- ps->Trapezoids = glamor_priv->saved_procs.trapezoids;
- ps->Triangles = glamor_priv->saved_procs.triangles;
- ps->CompositeRects = glamor_priv->saved_procs.composite_rects;
- ps->Glyphs = glamor_priv->saved_procs.glyphs;
+ if (ps) {
+ ps->Composite = glamor_priv->saved_procs.composite;
+ ps->Trapezoids = glamor_priv->saved_procs.trapezoids;
+ ps->Triangles = glamor_priv->saved_procs.triangles;
+ ps->CompositeRects = glamor_priv->saved_procs.composite_rects;
+ ps->Glyphs = glamor_priv->saved_procs.glyphs;
+ }
screen_pixmap = screen->GetScreenPixmap(screen);
glamor_pixmap_destroy_fbo(screen_pixmap);
--
2.54.0

45
SOURCES/0037-glamor-handle-allocation-failure-in-glamor_create_pi.patch Normal file
View File

@ -0,0 +1,45 @@
From 557660af8831f2395e40ad9019104d2119d3cb20 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 25 Oct 2025 16:27:34 -0700
Subject: [PATCH xserver 37/51] glamor: handle allocation failure in
glamor_create_pixmap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported by gcc 15.1:
../glamor/glamor.c: In function ‘glamor_create_pixmap’:
../glamor/glamor.c:233:23: warning: potential null pointer dereference
[-Wnull-dereference]
233 | pixmap_priv->type = GLAMOR_TEXTURE_ONLY;
| ~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
../glamor/glamor.c:228:26: warning: potential null pointer dereference
[-Wnull-dereference]
228 | pixmap_priv->is_cbcr = (GLAMOR_CREATE_FORMAT_CBCR & usage) == GLAMOR_CREATE_FORMAT_CBCR;
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit cc647f23679ae2beb7b971aa7d1203375c25bb55)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/glamor/glamor.c b/glamor/glamor.c
index 236c45d6d..01fb3ac80 100644
--- a/glamor/glamor.c
+++ b/glamor/glamor.c
@@ -220,6 +220,9 @@ glamor_create_pixmap(ScreenPtr screen, int w, int h, int depth,
else
pixmap = fbCreatePixmap(screen, 0, 0, depth, usage);
+ if (!pixmap)
+ return NullPixmap;
+
pixmap_priv = glamor_get_pixmap_private(pixmap);
format = gl_iformat_for_pixmap(pixmap);
--
2.54.0

41
SOURCES/0038-glamor-silence-false-positive-in-glamor_validate_gc.patch Normal file
View File

@ -0,0 +1,41 @@
From 7a65240a6e20590814c44ab2286108c59446ba1f Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 26 Oct 2025 12:56:13 -0700
Subject: [PATCH xserver 38/51] glamor: silence false positive in
glamor_validate_gc()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
We know that if gc->tileIsPixel is false, then gc->tile.pixmap must be
a valid pixmap, but gcc's static analyzer doesn't and needs to be told.
Silences false positive reported in #1817:
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_core.c:205:19:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit a79bdc495eaabd770cec03badd74c3b023877ba1)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/glamor/glamor_core.c b/glamor/glamor_core.c
index cb315e2d1..05e37a162 100644
--- a/glamor/glamor_core.c
+++ b/glamor/glamor_core.c
@@ -199,6 +199,8 @@ glamor_validate_gc(GCPtr gc, unsigned long changes, DrawablePtr drawable)
*/
if (changes & GCTile) {
if (!gc->tileIsPixel) {
+ assert(gc->tile.pixmap != NullPixmap);
+
glamor_pixmap_private *pixmap_priv =
glamor_get_pixmap_private(gc->tile.pixmap);
if ((!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv))
--
2.54.0

93
SOURCES/0039-glamor-handle-allocation-failures-in-glamor_largepix.patch Normal file
View File

@ -0,0 +1,93 @@
From c58f85aaaea2613c3049a6032d75d2422d748c71 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 26 Oct 2025 15:39:47 -0700
Subject: [PATCH xserver 39/51] glamor: handle allocation failures in
glamor_largepixmap.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:130:17:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘clipped_regions’
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:235:13:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘result_regions’
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:365:9:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘clipped_regions’
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_largepixmap.c:1175:9:
warning[-Wanalyzer-possible-null-dereference]:
dereference of possibly-NULL ‘source_pixmap_priv’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 84cf20e6ddacbfc62637f156a92d673574c43604)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor_largepixmap.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
diff --git a/glamor/glamor_largepixmap.c b/glamor/glamor_largepixmap.c
index f9adb93bc..ba347e3d2 100644
--- a/glamor/glamor_largepixmap.c
+++ b/glamor/glamor_largepixmap.c
@@ -77,6 +77,10 @@ __glamor_compute_clipped_regions(int block_w,
clipped_regions = calloc((end_block_x - start_block_x + 1)
* (end_block_y - start_block_y + 1),
sizeof(*clipped_regions));
+ if (clipped_regions == NULL) {
+ *n_region = 0;
+ return NULL;
+ }
DEBUGF("startx %d starty %d endx %d endy %d \n",
start_x, start_y, end_x, end_y);
@@ -216,6 +220,11 @@ glamor_compute_clipped_regions_ext(PixmapPtr pixmap,
inner_block_w)
* ((block_h + inner_block_h - 1) /
inner_block_h), sizeof(*result_regions));
+ if (result_regions == NULL) {
+ *n_region = 0;
+ free(clipped_regions);
+ return NULL;
+ }
k = 0;
for (i = 0; i < *n_region; i++) {
x = box_array[clipped_regions[i].block_idx].x1;
@@ -362,10 +371,14 @@ _glamor_compute_clipped_regions(PixmapPtr pixmap,
DEBUGRegionPrint(region);
if (glamor_pixmap_priv_is_small(pixmap_priv)) {
clipped_regions = calloc(1, sizeof(*clipped_regions));
- clipped_regions[0].region = RegionCreate(NULL, 1);
- clipped_regions[0].block_idx = 0;
- RegionCopy(clipped_regions[0].region, region);
- *n_region = 1;
+ if (clipped_regions) {
+ clipped_regions[0].region = RegionCreate(NULL, 1);
+ clipped_regions[0].block_idx = 0;
+ RegionCopy(clipped_regions[0].region, region);
+ *n_region = 1;
+ }
+ else
+ *n_region = 0;
return clipped_regions;
}
@@ -1172,6 +1185,8 @@ glamor_composite_largepixmap_region(CARD8 op,
/* XXX self-copy... */
need_free_source_pixmap_priv = source_pixmap_priv;
source_pixmap_priv = malloc(sizeof(*source_pixmap_priv));
+ if (source_pixmap_priv == NULL)
+ return FALSE;
*source_pixmap_priv = *need_free_source_pixmap_priv;
need_free_source_pixmap_priv = source_pixmap_priv;
}
--
2.54.0

38
SOURCES/0040-glamor-avoid-null-dereference-in-glamor_dash_setup.patch Normal file
View File

@ -0,0 +1,38 @@
From b04a54c567eb0f31bc7d58e47d1adf6b04b3c981 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Tue, 28 Oct 2025 18:16:00 -0700
Subject: [PATCH xserver 40/51] glamor: avoid null dereference in
glamor_dash_setup()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_dash.c:152:10:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit c6522229b86f9087347b17280b6e5f19345baf9a)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor_dash.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/glamor/glamor_dash.c b/glamor/glamor_dash.c
index b53ce5c50..ec8bf36bf 100644
--- a/glamor/glamor_dash.c
+++ b/glamor/glamor_dash.c
@@ -149,7 +149,7 @@ glamor_dash_setup(DrawablePtr drawable, GCPtr gc)
dash_pixmap = glamor_get_dash_pixmap(gc);
dash_priv = glamor_get_pixmap_private(dash_pixmap);
- if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv))
+ if (!dash_priv || !GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv))
goto bail;
glamor_make_current(glamor_priv);
--
2.54.0

38
SOURCES/0041-glamor-avoid-null-dereference-in-glamor_composite_cl.patch Normal file
View File

@ -0,0 +1,38 @@
From 3ab3771224837193aaae44d95b4f7dd6552c64ad Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 2 Nov 2025 11:23:37 -0800
Subject: [PATCH xserver 41/51] glamor: avoid null dereference in
glamor_composite_clipped_region()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported in #1817:
xwayland-24.1.6/redhat-linux-build/../glamor/glamor_render.c:1577:21:
warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 6a4ec30af49bcbf61cf8ebc3a8f5541abac9024d)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor_render.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/glamor/glamor_render.c b/glamor/glamor_render.c
index d5737018f..7a037e47c 100644
--- a/glamor/glamor_render.c
+++ b/glamor/glamor_render.c
@@ -1465,7 +1465,7 @@ glamor_composite_clipped_region(CARD8 op,
if (source
&& ((!source->pDrawable
&& (source->pSourcePict->type != SourcePictTypeSolidFill))
- || (source->pDrawable
+ || (source->pDrawable && source_pixmap
&& !GLAMOR_PIXMAP_PRIV_HAS_FBO(source_pixmap_priv)
&& (source_pixmap->drawable.width != width
|| source_pixmap->drawable.height != height)))) {
--
2.54.0

49
SOURCES/0042-glamor-avoid-double-free-in-glamor_make_pixmap_expor.patch Normal file
View File

@ -0,0 +1,49 @@
From 90358719e7eec514929256d3cf75f2dbe132f97d Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sun, 2 Nov 2025 12:16:56 -0800
Subject: [PATCH xserver 42/51] glamor: avoid double free in
glamor_make_pixmap_exportable()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reported by gcc 15.1:
../glamor/glamor_egl.c:320:9:
warning: double-‘free’ of ‘modifiers’ [CWE-415] [-Wanalyzer-double-free]
[...]
│ 732 |│ free(*modifiers);
│ |│ ~~~~~~~~~~~~~~~~
│ |│ |
│ |└───────>(25) ...to here
│ | (26) first ‘free’ here
[...]
│ 320 | free(modifiers);
│ | ~~~~~~~~~~~~~~~
│ | |
│ | (28) ⚠️ second ‘free’ here; first ‘free’ was at (26)
Fixes: cef12efc1 ("glamor: Implement GetSupportedModifiers")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
(cherry picked from commit 3e9baa20f39b0502efdaf48c2ca7e2f58d1e3120)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
glamor/glamor_egl.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/glamor/glamor_egl.c b/glamor/glamor_egl.c
index 4120c2e7d..3687eb675 100644
--- a/glamor/glamor_egl.c
+++ b/glamor/glamor_egl.c
@@ -680,6 +680,7 @@ glamor_get_modifiers(ScreenPtr screen, uint32_t format,
if (!eglQueryDmaBufModifiersEXT(glamor_egl->display, format, num,
(EGLuint64KHR *) *modifiers, NULL, &num)) {
free(*modifiers);
+ *modifiers = NULL;
return FALSE;
}
--
2.54.0

41
SOURCES/0043-xkb-fix-incorrect-size-check-when-growing-doodads-in.patch Normal file
View File

@ -0,0 +1,41 @@
From 0458dead41dbea8b4675c86d7151a62b7efa6237 Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Date: Tue, 14 Apr 2026 12:06:51 +0300
Subject: [PATCH xserver 43/51] xkb: fix incorrect size check when growing
doodads in a section
In XkbAddGeomDoodad(), when adding a doodad to a specific section
(section != NULL), there is a comparison between section->num_doodads
and geom->sz_doodads instead of the section's own section->sz_doodads.
The else branch (global geometry doodads) was already correct.
Compare section->num_doodads against section->sz_doodads to prevent
a potential out-of-bounds.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit dd8b8cf49d326802c53b01835618a7e3765d91cb)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
xkb/XKBGAlloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xkb/XKBGAlloc.c b/xkb/XKBGAlloc.c
index f0cda24fe..9b71f6121 100644
--- a/xkb/XKBGAlloc.c
+++ b/xkb/XKBGAlloc.c
@@ -769,7 +769,7 @@ XkbAddGeomDoodad(XkbGeometryPtr geom, XkbSectionPtr section, Atom name)
return doodad;
}
if (section) {
- if ((section->num_doodads >= geom->sz_doodads) &&
+ if ((section->num_doodads >= section->sz_doodads) &&
(_XkbAllocDoodads(section, 1) != Success)) {
return NULL;
}
--
2.54.0

43
SOURCES/0044-xkb-fix-potential-buff-overflow-in-XkbVModIndexText-.patch Normal file
View File

@ -0,0 +1,43 @@
From 6164f19b0df91d77d814ae7ee4e0876f2583cffe Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Date: Tue, 14 Apr 2026 13:22:35 +0300
Subject: [PATCH xserver 44/51] xkb: fix potential buff overflow in
XkbVModIndexText for XkbCFile format
len calculation and strncpy limit were off by one when prefixing
"vmod_" to the virtual modifier name. This could write the final
NULL one byte past the allocated buffer from tbGetBuffer().
Use proper allocation len for prefix to avoid writing out-of-bounds.
Found by Linux Verification Center (linuxtesting.org) with SVACE
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit 5dfb435c1d864bf154369cb86d085d4159730378)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
xkb/xkbtext.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
index 002626450..c2db41f7a 100644
--- a/xkb/xkbtext.c
+++ b/xkb/xkbtext.c
@@ -129,11 +129,11 @@ XkbVModIndexText(XkbDescPtr xkb, unsigned ndx, unsigned format)
len = strlen(tmp) + 1;
if (format == XkbCFile)
- len += 4;
+ len += 5;
rtrn = tbGetBuffer(len);
if (format == XkbCFile) {
strcpy(rtrn, "vmod_");
- strncpy(&rtrn[5], tmp, len - 4);
+ strncpy(&rtrn[5], tmp, len - 5);
}
else
strncpy(rtrn, tmp, len);
--
2.54.0

37
SOURCES/0045-Xi-add-missing-gesture-grab-type-checks-in-ProcXIPas.patch Normal file
View File

@ -0,0 +1,37 @@
From 085be53420c299c81a1637f9f433c7eb3a472967 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Wed, 29 Apr 2026 05:59:12 +0000
Subject: [PATCH xserver 45/51] Xi: add missing gesture grab type checks in
ProcXIPassiveUngrabDevice
ProcXIPassiveUngrabDevice was missing XIGrabtypeGesturePinchBegin and
XIGrabtypeGestureSwipeBegin from its detail!=0 rejection check. The
corresponding ProcXIPassiveGrabDevice function correctly includes
these gesture types.
Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit 90954812496770f4903a024cb610404a8dd882ad)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
Xi/xipassivegrab.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index bf9b09482..dca9f1a4e 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -317,7 +317,9 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
if ((stuff->grab_type == XIGrabtypeEnter ||
stuff->grab_type == XIGrabtypeFocusIn ||
- stuff->grab_type == XIGrabtypeTouchBegin) && stuff->detail != 0) {
+ stuff->grab_type == XIGrabtypeTouchBegin ||
+ stuff->grab_type == XIGrabtypeGesturePinchBegin ||
+ stuff->grab_type == XIGrabtypeGestureSwipeBegin) && stuff->detail != 0) {
client->errorValue = stuff->detail;
return BadValue;
}
--
2.54.0

52
SOURCES/0046-xkb-Fix-out-of-bounds-array-access-in-_CheckSetShape.patch Normal file
View File

@ -0,0 +1,52 @@
From 2cafacd074770724046ee3add86467dd6a71e72e Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sat, 18 Apr 2026 07:34:51 +1000
Subject: [PATCH xserver 46/51] xkb: Fix out-of-bounds array access in
_CheckSetShapes()
The primaryNdx and approxNdx fields in the shape wire description are
attacker-controlled CARD8 values from the client request. They are used
to index into the shape->outlines[] array, but were only checked against
XkbNoShape (0xff) and never validated against the actual number of
outlines (shapeWire->nOutlines).
Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit 86a321ad98213957bbb56f295417b0939326718b)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
xkb/xkb.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 887b87b07..c1ec0c516 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5566,10 +5566,22 @@ _CheckSetShapes(XkbGeometryPtr geom,
ol->num_points = olWire->nPoints;
olWire = (xkbOutlineWireDesc *)ptWire;
}
- if (shapeWire->primaryNdx != XkbNoShape)
+ if (shapeWire->primaryNdx != XkbNoShape) {
+ if (shapeWire->primaryNdx >= shapeWire->nOutlines) {
+ client->errorValue = _XkbErrCode3(0x08, shapeWire->primaryNdx,
+ shapeWire->nOutlines);
+ return BadValue;
+ }
shape->primary = &shape->outlines[shapeWire->primaryNdx];
- if (shapeWire->approxNdx != XkbNoShape)
+ }
+ if (shapeWire->approxNdx != XkbNoShape) {
+ if (shapeWire->approxNdx >= shapeWire->nOutlines) {
+ client->errorValue = _XkbErrCode3(0x08, shapeWire->approxNdx,
+ shapeWire->nOutlines);
+ return BadValue;
+ }
shape->approx = &shape->outlines[shapeWire->approxNdx];
+ }
shapeWire = (xkbShapeWireDesc *) olWire;
}
wire = (char *) shapeWire;
--
2.54.0

41
SOURCES/0047-xkb-Fix-off-by-one-in-color-index-validation-in-_Che.patch Normal file
View File

@ -0,0 +1,41 @@
From b81807ab582993a0a45ccb4feb28dccf88ac3fed Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sat, 18 Apr 2026 07:35:15 +1000
Subject: [PATCH xserver 47/51] xkb: Fix off-by-one in color index validation
in _CheckSetGeom()
The bounds checks for baseColorNdx and labelColorNdx in _CheckSetGeom()
use '>' instead of '>=' when comparing against req->nColors. Since
nColors is a count and valid indices are 0 to nColors-1, an index equal
to nColors is one past the end of the array.
Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit 6b6e8020b902e48e3330f9a54cd439a51988bc50)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
xkb/xkb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index c1ec0c516..c6e2bf40c 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5631,12 +5631,12 @@ _CheckSetGeom(XkbGeometryPtr geom, xkbSetGeometryReq * req, ClientPtr client)
client->errorValue = _XkbErrCode3(0x01, 2, req->nColors);
return BadValue;
}
- if (req->baseColorNdx > req->nColors) {
+ if (req->baseColorNdx >= req->nColors) {
client->errorValue =
_XkbErrCode3(0x03, req->nColors, req->baseColorNdx);
return BadMatch;
}
- if (req->labelColorNdx > req->nColors) {
+ if (req->labelColorNdx >= req->nColors) {
client->errorValue =
_XkbErrCode3(0x03, req->nColors, req->labelColorNdx);
return BadMatch;
--
2.54.0

55
SOURCES/0048-xkb-Fix-off-by-one-and-NULL-dereferences-in-_CheckSe.patch Normal file
View File

@ -0,0 +1,55 @@
From a1b025ef5278cd9e404136e9b4ef9aa769112533 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sat, 18 Apr 2026 07:35:53 +1000
Subject: [PATCH xserver 48/51] xkb: Fix off-by-one and NULL dereferences in
_CheckSetOverlay()
Off-by-one in rowUnder validation: the bounds check uses '>' instead
of '>=' when comparing rWire->rowUnder against section->num_rows.
Since num_rows is a count and valid indices are 0 to num_rows-1,
rowUnder == num_rows passes the check but is one past the valid range.
XkbAddGeomOverlayRow() uses this as an array index, causing an
out-of-bounds read on section->rows[].
And throw in two alloc checks while we're at it.
Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit ed19312c4bda0a8f66b236348ffc553e5d8d2a09)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
xkb/xkb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index c6e2bf40c..b2c2dfa24 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5362,6 +5362,8 @@ _CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
}
CHK_ATOM_ONLY(olWire->name);
ol = XkbAddGeomOverlay(section, olWire->name, olWire->nRows);
+ if (!ol)
+ return BadAlloc;
rWire = (xkbOverlayRowWireDesc *) &olWire[1];
for (r = 0; r < olWire->nRows; r++) {
register int k;
@@ -5371,12 +5373,14 @@ _CheckSetOverlay(char **wire_inout, xkbSetGeometryReq *req,
if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1))
return BadLength;
- if (rWire->rowUnder > section->num_rows) {
+ if (rWire->rowUnder >= section->num_rows) {
client->errorValue = _XkbErrCode4(0x20, r, section->num_rows,
rWire->rowUnder);
return BadMatch;
}
row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys);
+ if (!row)
+ return BadAlloc;
kWire = (xkbOverlayKeyWireDesc *) &rWire[1];
for (k = 0; k < rWire->nKeys; k++, kWire++) {
if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1))
--
2.54.0

50
SOURCES/0049-xkb-Add-bounds-check-for-action-data-in-CheckKeyActi.patch Normal file
View File

@ -0,0 +1,50 @@
From fa79e0f32fbdae0591fe07307ea4bf3ff2541fc2 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sat, 18 Apr 2026 07:38:14 +1000
Subject: [PATCH xserver 49/51] xkb: Add bounds check for action data in
CheckKeyActions()
CheckKeyActions() validates the per-key action count bytes individually
but does not verify that the computed total action data region falls
within the request buffer before advancing the wire pointer past it.
After the loop, the function calculates the final wire position as
wire + nActs * sizeof(XkbAnyAction), where nActs is the sum of per-key
action counts read from the request. The upstream length validation in
_XkbSetMapCheckLength() uses req->totalActs from the request header,
not the computed nActs. If a crafted request provides a totalActs value
that passes the length check but per-key action counts that sum to a
different nActs, the wire pointer could advance past the actual request
buffer.
The subsequent SetKeyActions() function uses memcpy to read from this
potentially out-of-bounds region, which could leak heap data or cause
a crash.
Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit a439a7340ad976983ef34eca4f537831b38e191f)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
xkb/xkb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index b2c2dfa24..fc0476056 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -1863,6 +1863,11 @@ CheckKeyActions(ClientPtr client,
if (req->nKeyActs % 4)
wire += 4 - (req->nKeyActs % 4);
*wireRtrn = (CARD8 *) (((XkbAnyAction *) wire) + nActs);
+ if (nActs > 0 &&
+ !_XkbCheckRequestBounds(client, req, wire, *wireRtrn)) {
+ *nActsRtrn = _XkbErrCode2(0x25, nActs);
+ return 0;
+ }
*nActsRtrn = nActs;
return 1;
}
--
2.54.0

35
SOURCES/0050-present-actually-return-the-created-notifies.patch Normal file
View File

@ -0,0 +1,35 @@
From 698d94109a7839785857b9b6295df37e26b58337 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Wed, 6 May 2026 11:45:15 +1000
Subject: [PATCH xserver 50/51] present: actually return the created notifies
present_create_notifies() creates an array of notifies but never returns
them to the caller, despite them being passed individually to
present_add_window_notify(). The caller proceeds with a NULL notifies
array, eventually causing an OOB in present_vblank_notify() when
vblank->notifies is NULL.
Reported-by: Feng Ning, Innora Pte. Ltd.
(cherry picked from commit f70cc16c6831c9faa14c1f2a8588c6efb6ede263)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
present/present_notify.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/present/present_notify.c b/present/present_notify.c
index 924de380a..69dfe62b4 100644
--- a/present/present_notify.c
+++ b/present/present_notify.c
@@ -96,6 +96,8 @@ present_create_notifies(ClientPtr client, int num_notifies, xPresentNotify *x_no
added++;
}
+
+ *p_notifies = notifies;
return Success;
bail:
--
2.54.0

70
SOURCES/0051-glx-reject-negative-size-in-FeedbackBuffer-and-Selec.patch Normal file
View File

@ -0,0 +1,70 @@
From 0eb7bf6f31e0af293f3b92b6ed11d5e3bb998302 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 17 Apr 2026 12:02:13 +1000
Subject: [PATCH xserver 51/51] glx: reject negative size in FeedbackBuffer and
SelectBuffer requests
Assisted-by: Claude:claude-claude-opus-4-6
(cherry picked from commit 54860e6c7f513739adf225a7998004f230db81a0)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2224>
---
glx/single2.c | 8 ++++++++
glx/single2swap.c | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git a/glx/single2.c b/glx/single2.c
index 36a01f0cb..948d00f1d 100644
--- a/glx/single2.c
+++ b/glx/single2.c
@@ -61,6 +61,10 @@ __glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
pc += __GLX_SINGLE_HDR_SIZE;
size = *(GLsizei *) (pc + 0);
type = *(GLenum *) (pc + 4);
+ if (size < 0) {
+ cl->client->errorValue = size;
+ return BadValue;
+ }
if (cx->feedbackBufSize < size) {
cx->feedbackBuf = reallocarray(cx->feedbackBuf,
(size_t) size, __GLX_SIZE_FLOAT32);
@@ -91,6 +95,10 @@ __glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
pc += __GLX_SINGLE_HDR_SIZE;
size = *(GLsizei *) (pc + 0);
+ if (size < 0) {
+ cl->client->errorValue = size;
+ return BadValue;
+ }
if (cx->selectBufSize < size) {
cx->selectBuf = reallocarray(cx->selectBuf,
(size_t) size, __GLX_SIZE_CARD32);
diff --git a/glx/single2swap.c b/glx/single2swap.c
index b140946ba..fdc093900 100644
--- a/glx/single2swap.c
+++ b/glx/single2swap.c
@@ -62,6 +62,10 @@ __glXDispSwap_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
__GLX_SWAP_INT(pc + 4);
size = *(GLsizei *) (pc + 0);
type = *(GLenum *) (pc + 4);
+ if (size < 0) {
+ cl->client->errorValue = size;
+ return BadValue;
+ }
if (cx->feedbackBufSize < size) {
cx->feedbackBuf = reallocarray(cx->feedbackBuf,
(size_t) size, __GLX_SIZE_FLOAT32);
@@ -96,6 +100,10 @@ __glXDispSwap_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
pc += __GLX_SINGLE_HDR_SIZE;
__GLX_SWAP_INT(pc + 0);
size = *(GLsizei *) (pc + 0);
+ if (size < 0) {
+ cl->client->errorValue = size;
+ return BadValue;
+ }
if (cx->selectBufSize < size) {
cx->selectBuf = reallocarray(cx->selectBuf,
(size_t) size, __GLX_SIZE_CARD32);
--
2.54.0

179
SOURCES/CVE-2026-55999.patch Normal file
View File

@ -0,0 +1,179 @@
From 0f1f4bcbfb1f23b800dfe386782d3a0f05b6756f Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 1 Jun 2026 20:44:34 +1000
Subject: [PATCH xserver 1/2] fb/mi/glamor: reject glyphs with negative
dimensions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
GLYPHWIDTHPIXELS and GLYPHHEIGHTPIXELS compute glyph dimensions from
signed INT16 fields. A crafted PCF font can produce negative results
(e.g. rightSideBearing < leftSideBearing).
All callees have a while (height--) loop which will end up in OOB writes
for negative height values.
In the case of a negative height, some callees cast to size_t or end up
with negative strides.
The same pattern exists in fbPoloyGlyphBit, miPolyGlyphBlt and
glamor_poly_glyph_blt_gl, so let's fix all of them in one go.
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit e31efd3e106e53bfc29d499ff0a34b0d20013f2d)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2252>
---
fb/fbglyph.c | 4 ++--
glamor/glamor_glyphblt.c | 2 +-
mi/miglblt.c | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/fb/fbglyph.c b/fb/fbglyph.c
index 1bdc2d4fd..5c9318f5e 100644
--- a/fb/fbglyph.c
+++ b/fb/fbglyph.c
@@ -95,7 +95,7 @@ fbPolyGlyphBlt(DrawablePtr pDrawable,
pglyph = FONTGLYPHBITS(pglyphBase, pci);
gWidth = GLYPHWIDTHPIXELS(pci);
gHeight = GLYPHHEIGHTPIXELS(pci);
- if (gWidth && gHeight) {
+ if (gWidth > 0 && gHeight > 0) {
gx = x + pci->metrics.leftSideBearing;
gy = y - pci->metrics.ascent;
if (glyph && gWidth <= sizeof(FbStip) * 8 &&
@@ -197,7 +197,7 @@ fbImageGlyphBlt(DrawablePtr pDrawable,
pglyph = FONTGLYPHBITS(pglyphBase, pci);
gWidth = GLYPHWIDTHPIXELS(pci);
gHeight = GLYPHHEIGHTPIXELS(pci);
- if (gWidth && gHeight) {
+ if (gWidth > 0 && gHeight > 0) {
gx = x + pci->metrics.leftSideBearing;
gy = y - pci->metrics.ascent;
if (glyph && gWidth <= sizeof(FbStip) * 8 &&
diff --git a/glamor/glamor_glyphblt.c b/glamor/glamor_glyphblt.c
index cada7bae7..d9665f778 100644
--- a/glamor/glamor_glyphblt.c
+++ b/glamor/glamor_glyphblt.c
@@ -90,7 +90,7 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
int h = GLYPHHEIGHTPIXELS(charinfo);
uint8_t *glyphbits = FONTGLYPHBITS(NULL, charinfo);
- if (w && h) {
+ if (w > 0 && h > 0) {
int glyph_x = x + charinfo->metrics.leftSideBearing;
int glyph_y = y - charinfo->metrics.ascent;
int glyph_stride = GLYPHWIDTHBYTESPADDED(charinfo);
diff --git a/mi/miglblt.c b/mi/miglblt.c
index 169d44ffc..8e33e90d8 100644
--- a/mi/miglblt.c
+++ b/mi/miglblt.c
@@ -143,7 +143,7 @@ miPolyGlyphBlt(DrawablePtr pDrawable, GC * pGC, int x, int y, unsigned int nglyp
pglyph = FONTGLYPHBITS(pglyphBase, pci);
gWidth = GLYPHWIDTHPIXELS(pci);
gHeight = GLYPHHEIGHTPIXELS(pci);
- if (gWidth && gHeight) {
+ if (gWidth > 0 && gHeight > 0) {
nbyGlyphWidth = GLYPHWIDTHBYTESPADDED(pci);
nbyPadGlyph = BitmapBytePad(gWidth);
--
2.54.0
From f3df3c9a52b4f480cbcff45cc6569c19de6bfede Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sun, 31 May 2026 19:37:01 +1000
Subject: [PATCH xserver 2/2] glamor: reject fonts with per-glyph metrics
exceeding maxbounds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
glamor_font_get() computes the atlas slot size from the font's declared
maxbounds, but copies each glyph's bitmap using the per-glyph metrics
(GLYPHHEIGHTPIXELS/GLYPHWIDTHBYTES macros). When a malicious PCF font
has per-glyph metrics exceeding maxbounds, the memcpy writes past the
heap-allocated atlas buffer. Negative per-glyph metrics are even worse:
the loop counter wraps to ~4 billion iterations (via unsigned cast) or
memcpy's size parameter wraps to SIZE_MAX.
The PCF parser in libXfont2 does not recompute maxbounds from per-glyph
data (only the BDF parser does), so the file's declared maxbounds values
are trusted as-is.
Reject fonts where any per-glyph metric is negative or exceeds the
atlas slot size, falling back to software rendering which uses per-glyph
metrics directly without an atlas.
This vulnerability was discovered by:
Anonymous working with Trend Micro Zero Day Initiative
CVE-2026-55999/ZDI-CAN-30498
Assisted-by: Claude:claude-opus-4-6
(cherry picked from commit fbf7bac22e2c6bd627fb042742a23318263edae1)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2252>
---
glamor/glamor_font.c | 30 +++++++++++++++++++++++++++---
1 file changed, 27 insertions(+), 3 deletions(-)
diff --git a/glamor/glamor_font.c b/glamor/glamor_font.c
index c689455c9..9c4941b05 100644
--- a/glamor/glamor_font.c
+++ b/glamor/glamor_font.c
@@ -71,6 +71,9 @@ glamor_font_get(ScreenPtr screen, FontPtr font)
glyph_width_pixels = font->info.maxbounds.rightSideBearing - font->info.minbounds.leftSideBearing;
glyph_height = font->info.maxbounds.ascent + font->info.maxbounds.descent;
+ if (glyph_width_pixels <= 0 || glyph_height <= 0)
+ return NULL;
+
glyph_width_bytes = (glyph_width_pixels + 7) >> 3;
glamor_font->glyph_width_pixels = glyph_width_pixels;
@@ -130,7 +133,28 @@ glamor_font_get(ScreenPtr screen, FontPtr font)
if (count) {
char *dst;
char *src = glyph->bits;
- unsigned y;
+ int gw = GLYPHWIDTHBYTES(glyph);
+ int gh = GLYPHHEIGHTPIXELS(glyph);
+
+ /* Reject fonts where any per-glyph metric is negative
+ * or exceeds the atlas slot size derived from maxbounds.
+ * The PCF parser in libXfont2 does not recompute
+ * maxbounds from per-glyph data, so a crafted PCF file
+ * can violate the maxbounds invariant.
+ *
+ * gw is passed as size_t to memcpy and a negative value
+ * would thus result in OOB access.
+ *
+ * Returning NULL makes glamor fall back to software
+ * rendering.
+ */
+ if (gw < 0 || gh < 0 ||
+ gw > glyph_width_bytes || gh > glyph_height) {
+ glDeleteTextures(1, &glamor_font->texture_id);
+ glamor_font->texture_id = 0;
+ free(bits);
+ return NULL;
+ }
dst = bits;
/* get offset of start of first row */
@@ -139,8 +163,8 @@ glamor_font_get(ScreenPtr screen, FontPtr font)
dst += (row & 1) ? glamor_font->row_width : 0;
dst += col * glyph_width_bytes;
- for (y = 0; y < GLYPHHEIGHTPIXELS(glyph); y++) {
- memcpy(dst, src, GLYPHWIDTHBYTES(glyph));
+ for (int y = 0; y < gh; y++) {
+ memcpy(dst, src, gw);
dst += overall_width;
src += GLYPHWIDTHBYTESPADDED(glyph);
}
--
2.54.0

116
SPECS/xorg-x11-server.spec
View File

@ -42,7 +42,7 @@
Summary: X.Org X11 X server
Name: xorg-x11-server
Version: 1.20.11
Release: 33%{?gitdate:.%{gitdate}}%{?dist}
Release: 38%{?gitdate:.%{gitdate}}%{?dist}
URL: http://www.x.org
License: MIT
@ -126,6 +126,8 @@ Patch115: 0001-xquartz-Remove-invalid-Unicode-sequence.patch
Patch116: 0001-dix-Force-update-LEDs-after-device-state-update-in-E.patch
# https://issues.redhat.com/browse/RHEL-84253
Patch117: 0001-xfree86-Fix-potentially-NULL-reference-to-platform-d.patch
# https://redhat.atlassian.net/browse/RHEL-169728
Patch118: 0001-dri2-Protect-against-dri2ClientPrivate-assertion-fai.patch
# CVE-2021-4011
Patch10009: 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
@ -245,6 +247,93 @@ Patch10072: 0002-xkb-Make-the-RT_XKBCLIENT-resource-private.patch
Patch10073: 0003-xkb-Free-the-XKB-resource-when-freeing-XkbInterest.patch
# CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap()
Patch10074: 0004-xkb-Prevent-overflow-in-XkbSetCompatMap.patch
# CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap()
Patch10075: 0001-xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch
# CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom()
Patch10076: 0002-xkb-Fix-bounds-check-in-_CheckSetGeom.patch
# CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence()
Patch10077: 0003-miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch
# CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap()
Patch10078: 0004-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch
# CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes()
Patch10079: 0005-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch
Patch10080: 0006-xkb-Add-more-_XkbCheckRequestBounds.patch
# ZDI-CAN-30159 - CVE-2026-50257 - XSYNC Use-After-Free in miSyncDestroyFence()
# ZDI-CAN-30163 - CVE-2026-50260 - XSYNC Use-After-Free in FreeCounter()
Patch10081: 0001-sync-fix-deletion-of-counters-and-fences.patch
# ZDI-CAN-30164 - CVE-2026-50261 - XSYNC Use-After-Free in SyncChangeCounter()
Patch10082: 0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch
# ZDI-CAN-30160 - CVE-2026-50258 - XKB Key Types Stack-based Buffer Overflow
Patch10083: 0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch
# ZDI-CAN-30161 - CVE-2026-50259 - XKB SetMap Request Stack-based Buffer Overflow
Patch10084: 0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch
# ZDI-CAN-30165 - CVE-2026-50262 - GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write
Patch10085: 0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch
# ZDI-CAN-30168 - CVE-2026-50263 - CreateSaverWindow Use-After-Free Information Disclosure
Patch10086: 0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch
# ZDI-CAN-30136 - CVE-2026-50256 - Font Alias Stack-based Buffer Overflow
Patch10087: 0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch
# CVE-2026-50264 - DRI2 DRIGetBuffers/DRIGetBuffersWithFormat Out-Of-Bounds Write
Patch10088: 0008-dri2-Use-booleans-for-fake-front-buffer-tracking-in-.patch
Patch10089: 0009-dri2-Deduplicate-attachments-in-do_get_buffer.patch
# Other security related fixes
Patch10090: 0001-os-avoid-potential-out-of-bounds-access-at-logVHdrMe.patch
Patch10091: 0002-dix-avoid-null-ptr-deref-at-doListFontsWithInfo.patch
Patch10092: 0003-panoramix-avoid-null-dereference-in-PanoramiXMaybeAd.patch
Patch10093: 0004-panoramix-avoid-null-dereference-in-PanoramiXConsoli.patch
Patch10094: 0005-Xext-shm-avoid-null-dereference-in-ShmInitScreenPriv.patch
Patch10095: 0006-Xext-sync-avoid-null-dereference-if-SysCounterGetPri.patch
Patch10096: 0007-Xext-sync-avoid-null-dereference-in-init_system_idle.patch
Patch10097: 0008-Xext-sync-Avoid-dereference-of-invalid-pointer-if-ma.patch
Patch10098: 0009-Xext-vidmode-avoid-null-dereference-if-VidModeCreate.patch
Patch10099: 0010-Xext-xres-avoid-null-dereference-in-ProcXResQueryCli.patch
Patch10100: 0011-Xext-xselinux-add-fast-path-to-ProcSELinuxListSelect.patch
Patch10101: 0012-Xext-xselinux-avoid-memory-leak-in-SELinuxAtomToSID.patch
Patch10102: 0013-Xext-xtest-avoid-null-dereference-in-ProcXTestFakeIn.patch
Patch10103: 0014-Xi-avoid-null-dereference-if-wOtherInputMasks-return.patch
Patch10104: 0015-Xi-set-value-for-led_values-in-CopySwapKbdFeedback.patch
Patch10105: 0016-Xi-handle-allocation-failure-in-ProcXGetDeviceDontPr.patch
Patch10106: 0017-Xi-handle-allocation-failure-in-ProcXListInputDevice.patch
Patch10107: 0018-Xi-handle-allocation-failure-in-add_master_func.patch
Patch10108: 0019-dix-handle-allocation-failure-in-DeviceFocusEvent.patch
Patch10109: 0020-dix-avoid-null-dereference-if-wOtherInputMasks-retur.patch
Patch10110: 0021-dix-assert-that-size-of-buffers-to-swap-is-a-multipl.patch
Patch10111: 0022-dix-handle-allocation-failure-in-ChangeWindowDeviceC.patch
Patch10112: 0023-xfree86-Fix-builds-with-gcc-Wpedantic.patch
Patch10113: 0024-dix-set-errorValue-correctly-when-XID-lookup-fails-i.patch
Patch10114: 0025-os-avoid-closing-null-fd-at-Fopen.patch
Patch10115: 0026-render-fix-multiple-mem-leaks-on-err-paths.patch
Patch10116: 0027-dix-avoid-null-ptr-deref-at-doListFontsAndAliases.patch
Patch10117: 0028-randr-clear-primary-screen-s-primaryOutput-when-the-.patch
Patch10118: 0029-Make-xf86CompatOutput-return-NULL-when-there-are-no-.patch
Patch10119: 0030-Better-fix-for-xf86CompatOut-when-there-are-no-priva.patch
Patch10120: 0031-xf86-check-return-value-of-XF86_CRTC_CONFIG_PTR-in-x.patch
Patch10121: 0032-os-include-assert.h-in-ospoll.c.patch
Patch10122: 0033-os-make-FormatInt64-handle-LONG_MIN-correctly.patch
Patch10123: 0034-os-use-close-on-exec-for-X-server-socket-to-prevent-.patch
Patch10124: 0035-xf86bigfont-fix-Wimplicit-function-declaration-error.patch
Patch10125: 0036-glamor-handle-potential-NULL-return-from-GetPictureS.patch
Patch10126: 0037-glamor-handle-allocation-failure-in-glamor_create_pi.patch
Patch10127: 0038-glamor-silence-false-positive-in-glamor_validate_gc.patch
Patch10128: 0039-glamor-handle-allocation-failures-in-glamor_largepix.patch
Patch10129: 0040-glamor-avoid-null-dereference-in-glamor_dash_setup.patch
Patch10130: 0041-glamor-avoid-null-dereference-in-glamor_composite_cl.patch
Patch10131: 0042-glamor-avoid-double-free-in-glamor_make_pixmap_expor.patch
Patch10132: 0043-xkb-fix-incorrect-size-check-when-growing-doodads-in.patch
Patch10133: 0044-xkb-fix-potential-buff-overflow-in-XkbVModIndexText-.patch
Patch10134: 0045-Xi-add-missing-gesture-grab-type-checks-in-ProcXIPas.patch
Patch10135: 0046-xkb-Fix-out-of-bounds-array-access-in-_CheckSetShape.patch
Patch10136: 0047-xkb-Fix-off-by-one-in-color-index-validation-in-_Che.patch
Patch10137: 0048-xkb-Fix-off-by-one-and-NULL-dereferences-in-_CheckSe.patch
Patch10138: 0049-xkb-Add-bounds-check-for-action-data-in-CheckKeyActi.patch
Patch10139: 0050-present-actually-return-the-created-notifies.patch
Patch10140: 0051-glx-reject-negative-size-in-FeedbackBuffer-and-Selec.patch
# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2237
Patch10141: 0001-dix-Silence-a-compiler-warning-in-doListFontsAndAlia.patch
# https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1257
Patch10142: 0001-xkb-fix-int-size-mismatch.patch
# CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow
Patch10143: CVE-2026-55999.patch
BuildRequires: make
BuildRequires: systemtap-sdt-devel
@ -655,6 +744,31 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
%changelog
* Tue Jul 28 2026 Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-38
- CVE fix for CVE-2026-55999
Resolves: https://redhat.atlassian.net/browse/RHEL-191502
* Fri Jun 12 2026 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-37
- Other security related fixes
Resolves: https://redhat.atlassian.net/browse/RHEL-183891
* Wed Jun 10 2026 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-36
- CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
CVE-2026-50262, CVE-2026-50263, CVE-2026-50264
Resolves: https://redhat.atlassian.net/browse/RHEL-182428
* Tue May 19 2026 Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-35
- dri2: Protect against dri2ClientPrivate assertion failures
Resolves: https://redhat.atlassian.net/browse/RHEL-169728
* Tue Apr 14 2026 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34
- CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
CVE-2026-34002, CVE-2026-34003
Resolves: https://redhat.atlassian.net/browse/RHEL-163227
Resolves: https://redhat.atlassian.net/browse/RHEL-163309
Resolves: https://redhat.atlassian.net/browse/RHEL-163240
* Wed Jan 14 2026 Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-33
- Rebuild against xorg-x11-xtrans-devel 1.4.0-9
Resolves: RHEL-117509