hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-26 01:59:57 +00:00
Code Issues Projects Releases Wiki Activity

Xi: fix event_id & time delta in generated barrier events

Browse source 
The fix for CVE-2026-93519 moved the updates of pbd->last_timestamp
and pbd->barrier_event_id from after they were used to generate the
data in events to before, causing the event_id to be one too high,
and the time delta (ms - pbd->last_timestamp) to always be zero.

This fix moves them back to being after they are used to generate
the event data.

Fixes: 1f42cc1f ("Xi: add bounds check for barrier events in input_constrain_cursor")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2353>
(cherry picked from commit 98aed9ddba)
This commit is contained in:
Alan Coopersmith 2026-10-08 17:53:59 -07:00 • committed by Enrico Weigelt, metux IT consult
commit fe86e4fc94
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
Xext/xinput/xibarriers.c
View file

@ -422,7 +422,7 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr pScreen,
DeviceIntPtr master;
/* We cannot know how many events are available in *events, but
* we know it all DDX very protbably allocated them with
* we know that all DDX very probably allocated them with
* GetMaximumEventsNum() and fill_pointer_events() may have added one.
*
* Let's cap at a maximum of 64 barrier events which is way more than
@ -522,10 +522,6 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr pScreen,
continue;
pbd->hit = FALSE;
pbd->last_timestamp = ms;
/* If we've left the hit box, this is the
* start of a new event ID. */
pbd->barrier_event_id++;
if (*nevents < MAX_BARRIER_EVENTS) {
ev.type = ET_BarrierLeave;
@ -547,6 +543,10 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr pScreen,
*nevents += 1;
}
pbd->last_timestamp = ms;
/* If we've left the hit box, this is the
* start of a new event ID. */
pbd->barrier_event_id++;
}
out: