mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-15 05:23:40 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
a0f5e66caa
_CheckSetDoodad() allocates doodad->text.text via _GetCountedString()
and then attempts to allocate doodad->text.font. If the font string
allocation fails (e.g. because the font string length extends past
the request boundary), the error handler frees doodad->text.text but
does not NULL the pointer. The doodad was already added to the geometry
by XkbAddGeomDoodad() before the string allocations, so when
XkbFreeGeometry() runs cleanup, _XkbClearDoodad() frees the same
dangling pointer again, resulting in a double-free.
NULL the pointer after freeing it to prevent the double-free.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31221
CVE-2026-88812
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit
|
||
| .. | ||
| __init__.py | ||
| bigrequests.py | ||
| glx.py | ||
| pcf.py | ||
| present.py | ||
| randr.py | ||
| record.py | ||
| render.py | ||
| screensaver.py | ||
| shm.py | ||
| sync.py | ||
| vidmode.py | ||
| x11.py | ||
| xi.py | ||
| xinerama.py | ||
| xkb.py | ||
| xres.py | ||