From d5fe1ff412d455fab37c8f2bcce66a94a514ed84 Mon Sep 17 00:00:00 2001 From: "Enrico Weigelt, metux IT consult" Date: Fri, 12 Jun 2026 09:51:07 +0200 Subject: [PATCH] xfree86: vidmode: zero gamma ramp reply padding ProcVidModeGetGammaRamp reserves length = (size + 1) & ~1 entries per channel but GetGammaRamp() only fills stuff->size entries. When size is odd, the last CARD16 of each of the three channels was left uninitialized and sent to the client. The buffer used the non-zeroing x_rpcbuf_reserve(). Use x_rpcbuf_reserve0() for the ramp buffer. Fixes: 0bf7d613d5c4 ("xf86vidmode: ProcVidModeSetGammaRamp(): use x_rpcbuf_t") Signed-off-by: Enrico Weigelt, metux IT consult --- hw/xfree86/xext/vidmode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/xfree86/xext/vidmode.c b/hw/xfree86/xext/vidmode.c index 2d2996d38a..58d4a9db73 100644 --- a/hw/xfree86/xext/vidmode.c +++ b/hw/xfree86/xext/vidmode.c @@ -1679,7 +1679,7 @@ ProcVidModeGetGammaRamp(ClientPtr client) if (stuff->size) { size_t ramplen = length * 3 * sizeof(CARD16); - CARD16 *ramp = x_rpcbuf_reserve(&rpcbuf, ramplen); + CARD16 *ramp = x_rpcbuf_reserve0(&rpcbuf, ramplen); if (!ramp) return BadAlloc;