Author	SHA1	Message	Date
David	baaa397af9	render: free animated cursor timers on destruction ... AnimCursorCreate allocates an OsTimer even if the cursor is never displayed. AnimCurUnrealizeCursor releases the retained frame cursors but does not release that timer, leaking 40 bytes per animated cursor on the tested x86_64 build. Free the timer with the frame references on screen zero, and clear the pointer. This cleanup runs when the final cursor reference is released. The leak was reproduced with LeakSanitizer on an XLibre 25.1.9-based test server. With the fix, all 90 focused native ASan/UBSan checks pass with leak detection enabled and GLX disabled, including unused animated cursors and repeated displayed cursor replacement. Signed-off-by: David <david@code.contractors>	2026-10-13 13:58:33 +02:00
Octavia Togami	bb59d6895f	Fix use-after-free caused by duplicate glyphs in one glyphset ... We make two glyphsets, GS1 and GS2, both with the same format depth. GS1 contains any glyph different from the others, let's call it U (unique). GS2 contains two glyphs with the same content, or at least sha1 hash. Let's call them A and B. We first register GS1 and GS2. GS1 has no problems, but before the fix, registering GS2 breaks accounting in `globalGlyphs`. Since there is no check for duplicate glyphs within a single set, we make two `GlyphNew` entries for A and B. Now in the loop at the end, we go over each entry and call `AddGlyph` and `FreeGlyph`: 1. AddGlyph(GS2, A, idA) inserts A into `globalGlyphs` 2. FreeGlyph(A) drops A's refcnt by one, but as it's being held in `globalGlyphs` it's kept alive. 3. AddGlyph(GS2, B, idB) finds A in `globalGlyphs` and reuses it instead of inserting B 4. FreeGlyph(B) drops B's refcnt by one (to zero), and B is freed. Before the fix, the lookup in `globalGlyphs` finds A's entry, and since it isn't a DeletedGlyph, it erroneously removes the `gr->glyph` pointing to `A` and decrements `tableEntries`. This results in `tableEntries` being off-by-one as `A` is still alive. Now, we free the glyphsets in a particular order. Freeing GS1 results in calling FreeGlyph(U), which will decrement U's refcnt to zero, and free U. This clears out the entry in `globalGlyphs` for U and decrements `tableEntries`, which due to the earlier error is now zero. When `FreeGlyphSet` sees this, it clears the `globalGlyphs` for that format depth. Now freeing A or GS2 (which transitively frees A) will try to check the `globalGlyphs` at that format depth, but because it was cleared out this crashes. The fix here is to change FreeGlyph to only free a glyph from `globalGlyphs` that is exactly the glyph being freed, so that FreeGlyph(B) doesn't touch `globalGlyphs` at all. This keeps a proper count in `tableEntries` and prevents `globalGlyphs[fdepth]` from being freed before A is freed. Closes: #1881 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2264> (cherry picked from commit 81edc9caf557f7a44c5b308742814457de0eb6c0) (cherry picked from commit 716d876142280cd66bdcf000f81428dadd5d3937) Signed-off-by: Octavia Togami <octy@octyl.net>	2026-10-12 15:37:47 +02:00
Enrico Weigelt, metux IT consult	c933897bc9	dix: CreateConnectionBlock(): record number of roots ... When Xinerama is enabled, the number of user-visible roots (screens) isn't equal to number of actual server screens anymore. Instead of having #ifdef's in several places, let the connection block renderer record the number of roots actually processed. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-09-25 21:27:00 +02:00
Enrico Weigelt, metux IT consult	eb9a108624	render: fix glyph Picture/Pixmap leak on ProcRenderAddGlyphs bail path ... The bail: path freed a newly-realized (!found) glyph with a raw '--refcnt; free(glyph)' instead of FreeGlyph(), skipping FreeGlyphPicture()'s release of the glyph's per-screen Picture/Pixmap (created earlier in the same function via CreatePicture()/CreatePixmap(), attached via SetGlyphPicture()). Trigger: send X_RenderAddGlyphs with >= 2 glyphs where an earlier glyph is well-formed (gets fully realized) and a later one is malformed (e.g. declares more bitmap bytes than present, hitting the BadLength/goto bail above) -- the earlier glyph's Picture/Pixmap leaks every such request, repeatable unbounded-leak DoS. No OOM needed. Fix: call FreeGlyph() instead, for both found and !found glyphs -- it already does the right thing for each: a bare refcnt-- for a found glyph (matching the old behavior), and the full teardown (hash removal if present, FreeGlyphPicture(), free the struct) for a !found one. Safe to call on a glyph never added to the global hash yet (AddGlyph() only runs on the success path below): the hash lookup keys off this glyph's own sha1 and simply finds an empty slot to not remove. Found via a fleet-directed alloc-fail/UAF sweep of Xext/, not from a live crash report. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-08-24 13:42:01 +02:00
Enrico Weigelt, metux IT consult	9c46982fa0	xext: render: use stdbool's 'bool' instead of 'Bool' for local variables ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-08-07 14:26:14 +02:00
Enrico Weigelt, metux IT consult	dd2ad2cd93	xext: panoramiX: helpers for checking wether it's enabled/disabled ... These helpers are always defined, even when compiling w/o PanoramiX at all (symbol XINERAMA not defined), so we need fewer ifdef's. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-07-24 17:27:51 +02:00
Enrico Weigelt, metux IT consult	6a97f6d38e	render: filter: fix integer-overflow bypass of convolution size check ... convolutionFilterValidateParams() derives w/h from client-supplied xFixed values via the sign-extending xFixedToInt(), then checked 'w * h > nparams' as a plain (signed) int product. A client can choose negative w/h so the mathematical product is huge but the signed int product wraps to a small or negative value, defeating the bounds check that is supposed to reject a convolution kernel larger than the actual parameter list. Reject negative w/h outright and compare the product as int64_t so it cannot wrap before the comparison. Signed-off-by: Enrico Weigelt, metux IT consult <enrico.weigelt@vnc.biz>	2026-07-03 19:59:53 +02:00
Enrico Weigelt, metux IT consult	8031c2f45a	treewide: fix result type of BitmapBytePad() to size_t ... sizes can't have negative numbers, so use the size_t here. Also having to fix up lots of callers. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-29 15:44:48 +02:00
Enrico Weigelt, metux IT consult	639da9e136	treewide: replace min/max macros by non-exported MIN/MAX and deprecate them ... Replace public min/max macros by private MIN/MAX and deprecate them. The few drivers still using them can trivially define them on their own. Adding a new private header for all kind of math-ish definitions - future commits will move more stuff there. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-25 14:06:17 +02:00
Enrico Weigelt, metux IT consult	f37d9ec29b	render: parentheses around macro argument symbols ... For safety, add extra parantheses on each used macro argument. In most cases not strictly necessary, but better have some strict and automatically enforcable policy here than wasting time on judging individual cases. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-25 06:53:30 +02:00
Enrico Weigelt, metux IT consult	75b5dbadf9	render: use X_REQUEST_*() macros in ProcRenderFreeGlyphSet() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 16:49:23 +02:00
Enrico Weigelt, metux IT consult	6e9d67d99e	render: use X_REQUEST_HEAD*() macros in ProcRenderReferenceGlyphSet() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 11:41:27 +02:00
Enrico Weigelt, metux IT consult	e1a9fe0479	render: use X_HEADER_*() macros in ProcRenderQueryVersion() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 11:39:55 +02:00
Enrico Weigelt, metux IT consult	cbd23335c1	render: use X_REPLY_*() macros in ProcRenderQueryVersion() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 11:39:32 +02:00
Enrico Weigelt, metux IT consult	f3857a051f	render: use X_REQUEST_*() and X_REPLY_*() macros in ProcRenderQueryPictFormats() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 11:39:17 +02:00
Enrico Weigelt, metux IT consult	1403ddb6e1	render: use X_REQUEST_() and X_REPLY_*() macros in ProcRenderQueryPictIndexValues() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 11:39:05 +02:00
Enrico Weigelt, metux IT consult	44b98fa586	render: use X_REQUEST_*() macros in ProcRenderCreateGlyphSet() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 11:38:52 +02:00
Enrico Weigelt, metux IT consult	bad349b9ad	render: use X_REQUEST_*() macros in ProcRenderAddGlyphs() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:44:03 +02:00
Enrico Weigelt, metux IT consult	0c50299141	render: use X_REQUEST_*() macros in ProcRenderFreeGlyphs() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:43:45 +02:00
Enrico Weigelt, metux IT consult	1935cc8127	render: use X_REQUEST_*() macros in ProcRenderCreateCursor() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:17:28 +02:00
Enrico Weigelt, metux IT consult	e03a2e39ee	render: use X_REQUEST_*() and X_REPLY_*() macros in ProcRenderQueryFilters() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:17:19 +02:00
Enrico Weigelt, metux IT consult	fd2f4606c9	render: use X_REQUEST_*() macros in ProcRenderCreateAnimCursor() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:17:07 +02:00
Enrico Weigelt, metux IT consult	23374883b4	render: use X_REQUEST_*() macros in ProcRenderCreatePicture() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:16:41 +02:00
Enrico Weigelt, metux IT consult	6db1a537ed	render: use X_REQUEST_*() macros in ProcRenderSetPictureClipRectangles() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-24 09:13:22 +02:00
Enrico Weigelt, metux IT consult	ad4944091e	render: use X_REQUEST_*() macros in ProcRenderChangePicture() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 20:20:46 +02:00
Enrico Weigelt, metux IT consult	4e2bb6d1da	render: use X_REQUEST_*() macros in ProcRenderTrapezoids() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 19:58:45 +02:00
Enrico Weigelt, metux IT consult	b061468310	render: use X_REQUEST_*() macros in ProcRenderComposite() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 19:58:03 +02:00
Enrico Weigelt, metux IT consult	37c379a985	render: use X_REQUEST_*() macros in ProcRenderTriangles() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 17:29:19 +02:00
Enrico Weigelt, metux IT consult	d6c0b230e8	render: zero reply buffers in QueryPictFormats and QueryFilters ... ProcRenderQueryPictFormats left the internal padding of xPictFormInfo (pad1) and xPictDepth (pad1, pad2) unwritten, and ProcRenderQueryFilters left the odd-count alias alignment slot and the filter-name alignment tail unwritten. Both reply buffers were allocated with the non-zeroing x_rpcbuf_reserve(), so those bytes disclosed uninitialized server heap to the client. Use x_rpcbuf_reserve0() for both reply payloads. Fixes: fe9fcfe98f ("render: ProcRenderQueryPictFormats(): use x_rpcbuf_t") Fixes: 81f93d19a0 ("render: ProcRenderQueryFilters(): use x_rpcbuf_t") Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 16:29:55 +02:00
Enrico Weigelt, metux IT consult	1ecacbc740	render: use X_REQUEST_*() macros in ProcRenderFreePicture() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 16:16:56 +02:00
Enrico Weigelt, metux IT consult	5a36316d9b	render: use X_REQUEST_*() macros in ProcRenderFillRectangles() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 16:11:50 +02:00
Enrico Weigelt, metux IT consult	c7a51605f4	render: use X_REQUEST_*() macros in ProcRenderSetPictureTransform() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 15:43:04 +02:00
Enrico Weigelt, metux IT consult	3cf5858fb7	render: use X_REQUEST_*() macros in ProcRenderSetPictureFilter() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 14:39:41 +02:00
Enrico Weigelt, metux IT consult	92430c9008	render: fix swapping and additional length check in ProcRenderSetPictureFilter() ... * correctly swap the parameters, which are coming after the filter name block (those are treated as CARD32's) * additional length checks for malicious packets (protect from buffer overflow) Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-23 12:17:57 +02:00
Enrico Weigelt, metux IT consult	fbfabb6f14	render: use X_REQUEST_*() macros in ProcRenderTriStrip() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 18:51:01 +02:00
Enrico Weigelt, metux IT consult	bb99633179	render: use X_REQUEST_*() macros in ProcRenderTriFan() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 15:02:36 +02:00
Enrico Weigelt, metux IT consult	67fa091b54	render: use X_REQUEST_*() macros in ProcRenderCreateSolidFill() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 15:02:24 +02:00
Enrico Weigelt, metux IT consult	8a2329f21f	render: use X_REQUEST_*() macros in ProcRenderAddTraps() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 15:00:52 +02:00
Enrico Weigelt, metux IT consult	c3b4ec22fb	render: use X_REQUEST_*() macros in ProcRenderCompositeGlyphs() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 14:08:56 +02:00
Enrico Weigelt, metux IT consult	bc89695f8c	render: use X_REQUEST_*() macros in ProcRenderCreateLinearGradient() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 14:08:08 +02:00
Enrico Weigelt, metux IT consult	3bd9bf8d61	render: use X_REQUEST_*() macros ProcRenderCreateRadialGradient() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 13:23:25 +02:00
Enrico Weigelt, metux IT consult	6e41659bab	render: use X_REQUEST_*() macros in ProcRenderCreateConicalGradient() ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-22 13:22:52 +02:00
Enrico Weigelt, metux IT consult	876c782094	treewide: clean up includes of misc.h ... adding include/ prefix to it. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-19 19:24:57 +02:00
Enrico Weigelt, metux IT consult	2906b973a8	Xext: move remaining panoramix headers into panoramix subdir. ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-17 19:01:48 +02:00
Enrico Weigelt, metux IT consult	561168cfa1	render: move it under Xext/ ... Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>	2026-06-17 14:29:57 +02:00