No description
  • C 94.2%
  • Python 2.2%
  • Roff 1.2%
  • Objective-C 1%
  • Meson 0.9%
  • Other 0.3%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer a8192aa709 Xi: add bounds check for barrier events in input_constrain_cursor
input_constrain_cursor() writes barrier hit and leave events into the
InputEventList buffer without checking how many slots remain.
The buffer is allocated by the DDX at GetMaximumEventsNum() (100) entries
and may contain one raw event already. A client can create more than 100
pointer barriers, pre-arm them as released via XIBarrierReleasePointer,
and then trigger a single pointer motion that crosses all barriers
simultaneously. The leave event loop iterates every hit barrier and
writes one event per barrier, overflowing the 100-slot buffer.

In an ideal world we'd change the InternalEvent* pointer to a struct
that contains allocated size, number of events and the pointer itself
but we're crossing public APIs here and that requires an ABI bump.

So we make do with cutting off the number of barrier events at 64 which
should be low enough to not trigger the issue. However, for the 100+
barrier case this means we only send BarierHit events, not BarrierRelease.
Potentially leaving a client stuck.

We mitigate that problem by simply refusing to create more than 32
barriers per screen (which on its own would also fix the issue, but hey,
'doppelt gemoppelt' as they say).

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31938

CVE-2026-93519

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit 1f42cc1f00)
2026-10-20 21:11:11 +02:00
.github ci: fix purge script — preserve PR runs for open PRs (including forks) 2026-10-14 18:18:05 +02:00
.vscode lint: Add .clang-tidy and analyzer scripts 2026-05-26 12:15:17 +02:00
config config: remove the fdi2iclass.py script 2026-10-20 19:56:53 +02:00
dix dix: remove passive grabs referencing a device on removal 2026-10-20 21:11:11 +02:00
doc Xext/namespace: fix memory leak during namespace destruction 2026-10-07 16:01:44 +02:00
exa exa: silence -Wold-style-declaration warning from gcc 16 2026-10-01 11:29:50 +02:00
fb fb: Don't widen the planemask over padding bits when ROOTLESS_SAFEALPHA is set 2026-09-30 19:06:39 +02:00
glamor glamor: size tmp_bits buffer for source coordinate range in upload_boxes 2026-10-20 19:49:20 +02:00
hw modesetting: Fix RandR output leasing while TearFree is enabled. 2026-10-20 19:58:05 +02:00
include xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int 2026-10-20 19:54:36 +02:00
man Disable font server connections by default 2026-09-29 18:24:47 +02:00
mi meson_options: disable XvMC build by default 2026-10-13 14:16:38 +02:00
miext miext/sync: Handle SIGBUS from truncated shm fences 2026-10-20 19:47:40 +02:00
msutil treewide: Add and use fallbacks for libdrm and libgbm 2026-09-09 11:33:33 +02:00
os os: Add busfault_set_jmp() for SIGBUS unwind 2026-10-20 19:47:40 +02:00
test xkb: fix CheckKeySyms overwriting request-range symsPerKey entries 2026-10-20 19:54:36 +02:00
Xext Xi: add bounds check for barrier events in input_constrain_cursor 2026-10-20 21:11:11 +02:00
.clang-tidy lint: Add .clang-tidy and analyzer scripts 2026-05-26 12:15:17 +02:00
.dir-locals.el .dir-locals.el: Add missing final newline 2019-10-01 17:05:28 +00:00
.git-blame-ignore-revs Ignore the coding style change commit during git blame 2024-12-06 09:55:53 +10:00
.gitignore lint: Add .clang-tidy and analyzer scripts 2026-05-26 12:15:17 +02:00
.mailmap Update mailmap for Peter Harris 2025-04-15 13:49:13 -04:00
CoC.md it's time to add a CoC (code of conduct) 2025-06-12 17:21:47 +02:00
CODE_OF_CONDUCT.md it's time to add a CoC (code of conduct) 2025-06-12 17:21:47 +02:00
CODE_OVERVIEW.md composite: move it under Xext/ 2026-06-17 07:50:13 +02:00
CONTRIBUTING.md fix minor spelling mistake in contributing guidelines 2025-09-05 15:05:37 +02:00
COPYING COPYING: update copyright dates/holders for remaining existing licenses 2026-06-12 18:24:49 +02:00
HISTORY.md HISTORY.md: add brief overview of the XLibre fork 2025-07-25 08:06:47 -04:00
meson.build meson: check cpu_family() instead of cpu() 2026-10-02 14:48:19 +02:00
meson_options.txt meson_options: disable XvMC build by default 2026-10-13 14:16:38 +02:00
NEWS NEWS: add 25.2.0 release entry 2026-06-19 19:24:57 +02:00
README.md docs: add GetMerged maintainer review scorecard badge 2026-10-07 18:12:28 +02:00
xlibre-server.pc.in xorg-server.pc: add more variables for easier driver builds 2026-01-08 16:57:10 +01:00
xorg-server.m4 xorg-server.m4: add helper macros for driver builds 2026-01-08 17:17:12 +01:00
xorg-server.pc.in xorg-server.pc: add more variables for easier driver builds 2026-01-08 16:57:10 +01:00
xserver.ent.in

XLibre Xserver

GetMerged Scorecard

The XLibre Xserver is the community-managed display server for the X Window System Protocol Version 11 (Wikipedia), in short, X11.

1 year of XLibre screenshot
One Year of XLibre. See more liberated screens here.

Selected Features

  • All the good things from X.Org Server, including its unreleased features
  • TearFree modesetting by default and optionally atomic modesetting
  • Support for the Nvidia drivers 340, 390, 470, 570, and newer
  • Xnamespace extension for separating X clients
  • Support for seat management via seatd besides systemd-logind
  • Xfbdev, the generic framebuffer Xserver for Linux
  • CI builds for several BSDs, Linux, MacOS, and Microsoft Windows
  • Active community, cleanups, fixes, and development based on merit

To learn more about the features and mission of XLibre, please visit our homepage.

Switching to XLibre

The easiest way to install and run XLibre is to use your distribution's provided packages. Please see the Are We XLibre Yet? - (X11Libre/xserver Wiki) page for a list of the available options. If there is no option, then go on with building and installing XLibre from source.

Building XLibre

After cloning the Xserver repository or unpacking the sources and installing the dependencies, change into the source directory and run the Meson build tool:

cd "<source dir of xserver>"
meson setup <prefix> build <meson_options>
ninja -C build install

You may specify the install <prefix> with, for example, --prefix="$(pwd)/image" and add build time <meson_options> like so: -Dxnest=false. You may also want to build and install some graphics and input drivers. Please refer to the Building XLibre (X11Libre/xserver Wiki) page for more details.

Configuring XLibre

Until XLibre releases its own, you can find a detailed description of the configuration on the Configuration - Xorg (ArchWiki) page. If you have built and installed XLibre yourself, then change into the <prefix> directory with cd <prefix> and create a directory etc/X11 with a file xorg.conf and adjust it accordingly.

Starting with version 25.0.0.16, the proprietary Nvidia driver is autodetected and handled internally without any special configuration. Please see the Compatibility of XLibre (X11Libre/xserver Wiki) page for more details on the Nvidia driver and compatibility in general.

Running XLibre

If you installed XLibre using your distribution's provided packages, then the Xserver is usually started by init (Wikipedia) on system start. On other systems it should be possible to manually start XLibre with user permissions by invoking startx. Please refer to man startx for how to use it.

If you have built and installed XLibre yourself, then you may want to shutdown other Xservers, change into the <prefix> directory, and create a simple testx.sh file with the following contents:

#!/bin/sh
./bin/X :1 vt8 -logfile /dev/stdout &
_pid=$!
sleep 10 && kill $_pid

You can adjust the :1 vt8 and other options in the testx.sh file as detailed in man Xorg. Make the testx.sh executable and run it:

chmod 0770 testx.sh
./testx.sh

This should give you 10 glorious seconds of a black and beautiful and empty screen. Afterwards the Xserver complains about being killed, but there should be no other critical errors for a "test passed." For more details, please see Building XLibre (X11Libre/xserver Wiki).

If you are using seatd for rootless operation instead of (e)logind, create the following file named .xserverrc in your home directory:

#!/bin/sh
exec X -keeptty "$@"

Then, run chmod +x ~/.xserverrc.

I want to help!

That's great; there's enough to do for everyone. You may consider one of the many ideas and feature requests out there. To help in testing, you may consider becoming an XLibre Test Driver. Please also have a look at the good first and help wanted issues and the Liberated Screens.

If you want to work on anything, just let us know. If you have any questions, just ask. Thank you!

Contact

XLibre Discussions at GitHub | XLibre mailing list at FreeLists | @x11dev channel at Telegram | #xlibredev space at Matrix | XLibre security contact at GitHub