From 7537745b5fe63d7e43d692bfa86f93259d522c80 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Mon, 20 Jan 2025 17:06:07 +0100 Subject: [PATCH xserver 12/13] sync: Do not fail SyncAddTriggerToSyncObject() We do not want to return a failure at the very last step in SyncInitTrigger() after having all changes applied. SyncAddTriggerToSyncObject() must not fail on memory allocation, if the allocation of the SyncTriggerList fails, trigger a FatalError() instead. Related to CVE-2025-26601, ZDI-CAN-25870 Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer (cherry picked from commit 8cbc90c8817306af75a60f494ec9dbb1061e50db) Part-of: --- Xext/sync.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Xext/sync.c b/Xext/sync.c index 66a52283d..8def4adbf 100644 --- a/Xext/sync.c +++ b/Xext/sync.c @@ -199,8 +199,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger) return Success; } - if (!(pCur = malloc(sizeof(SyncTriggerList)))) - return BadAlloc; + /* Failure is not an option, it's succeed or burst! */ + pCur = XNFalloc(sizeof(SyncTriggerList)); pCur->pTrigger = pTrigger; pCur->next = pTrigger->pSync->pTriglist; @@ -408,8 +408,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, * a new counter on a trigger */ if (newSyncObject) { - if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success) - return rc; + SyncAddTriggerToSyncObject(pTrigger); } else if (pCounter && IsSystemCounter(pCounter)) { SyncComputeBracketValues(pCounter); -- 2.48.1