hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-29 02:31:18 +00:00
Code Issues Projects Releases Wiki Activity

Revert "xfixes: use dixGetAtomID()"

Browse source 
This reverts commit c32b5b4d5b.

The commit writes out of bounds with tchar[stuff->nbytes] write
since the string isn't null terminated.
This messed other data which makes requests fail and window managers/
desktop environments fail to start.

ProcXFixesSetCursorName also incorrectly uses dixGetAtomID
which doesn't create the atom if it doesn't exist, which it previously
did with MakeAtom(..., TRUE).

The new dixGet/AddAtom methods dont work without null-terminated strings
so the change has to be reverted instead.

Signed-off-by: dec05eba <dec05eba@protonmail.com>
This commit is contained in:
dec05eba 2025-07-23 15:30:30 +02:00 • committed by Enrico Weigelt
commit 0797119176
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
xfixes/cursor.c
View file

@ -413,12 +413,12 @@ ProcXFixesSetCursorName(ClientPtr client)
char *tchar;
REQUEST(xXFixesSetCursorNameReq);
Atom atom;
REQUEST_FIXED_SIZE(xXFixesSetCursorNameReq, stuff->nbytes);
VERIFY_CURSOR(pCursor, stuff->cursor, client, DixSetAttrAccess);
tchar = (char *) &stuff[1];
tchar[stuff->nbytes] = 0;
Atom atom = dixGetAtomID(tchar);
atom = MakeAtom(tchar, stuff->nbytes, TRUE);
if (atom == BAD_RESOURCE)
return BadAlloc;
@ -692,6 +692,7 @@ int
ProcXFixesChangeCursorByName(ClientPtr client)
{
CursorPtr pSource;
Atom name;
char *tchar;
REQUEST(xXFixesChangeCursorByNameReq);
@ -700,8 +701,7 @@ ProcXFixesChangeCursorByName(ClientPtr client)
VERIFY_CURSOR(pSource, stuff->source, client,
DixReadAccess | DixGetAttrAccess);
tchar = (char *) &stuff[1];
tchar[stuff->nbytes] = 0;
Atom name = dixGetAtomID(tchar);
name = MakeAtom(tchar, stuff->nbytes, FALSE);
if (name)
ReplaceCursor(pSource, TestForCursorName, &name);
return Success;