hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-28 02:21:08 +00:00
Code Issues Projects Releases Wiki Activity

Xi: avoid memory leak when hitting bounds check for barrier events

Browse source 
The fix for CVE-2026-93519 added a bounds check for barrier events in
CreatePointerBarrierClient() and if it's hit immediately returns
BadAlloc.  Unfortunately it was added after `ret` was already allocated
and before *client_out is set to `ret`, so `ret` leaks.

This fix changes it to jump to the same cleanup code to free(ret)
that the rest of the function already uses.

Fixes: 1f42cc1f0 ("Xi: add bounds check for barrier events in input_constrain_cursor")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2352>
(cherry picked from commit 8e901e6013)
This commit is contained in:
Alan Coopersmith 2026-10-08 17:17:20 -07:00 • committed by Enrico Weigelt
commit f58dbbd64b
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Xext/xinput/xibarriers.c
View file

@ -604,8 +604,10 @@ CreatePointerBarrierClient(ClientPtr client,
* function */ * function */
xorg_list_for_each_entry(counter, &cs->barriers, entry) { xorg_list_for_each_entry(counter, &cs->barriers, entry) {
nbarriers++; nbarriers++;
if (nbarriers >= 32) if (nbarriers >= 32) {
return BadAlloc; err = BadAlloc;
goto error;
}
} }
ret->pScreen = pScreen; ret->pScreen = pScreen;