hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-14 05:14:45 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xi
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Alan Coopersmith 07300b543e Xi: avoid memory leak when hitting bounds check for barrier events 
The fix for CVE-2026-93519 added a bounds check for barrier events in
CreatePointerBarrierClient() and if it's hit immediately returns
BadAlloc.  Unfortunately it was added after `ret` was already allocated
and before *client_out is set to `ret`, so `ret` leaks.

This fix changes it to jump to the same cleanup code to free(ret)
that the rest of the function already uses.

Fixes: 1f42cc1f0 ("Xi: add bounds check for barrier events in input_constrain_cursor")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2352>
(cherry picked from commit 8e901e6013)
2026-10-19 14:12:05 +02:00
..
allowev.c Xi: inline SProcXAllowDeviceEvents() 2025-09-22 12:42:44 +02:00
chgdctl.c Xi: XProcXChangeDeviceControl(): fix missing request parameter bytewap 2026-04-27 17:21:57 +02:00
chgfctl.c dix: unexport SwapLongs() 2025-11-25 18:26:02 +01:00
chgkbd.c Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
chgkmap.c dix: unexport SwapLongs() 2025-11-25 18:26:02 +01:00
chgprop.c include: windowstr.h: unexport w*() macros 2025-11-27 19:54:42 +01:00
chgptr.c Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
chgptr.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
closedev.c include: windowstr.h: unexport w*() macros 2025-11-27 19:54:42 +01:00
devbell.c Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
exevents.c Xi: clean up gesture sprite traces in WindowGone 2026-10-08 18:13:16 +02:00
exglobals.h Xi: helper for private structure retrieval 2025-09-10 13:41:47 +02:00
extinit.c Xi: byte-swap DeviceChanged valuator and scroll data 2026-10-05 09:23:49 +02:00
getbmap.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
getdctl.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
getfctl.c Xi: zero feedback reply buffer in ProcXGetFeedbackControl 2026-06-12 18:54:06 +02:00
getfocus.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
getkmap.c Revert "xkb: unexport XkbGetCoreMap() and XkbSetRepeatKeys()" 2026-06-16 06:48:41 +02:00
getmmap.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
getprop.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
getprop.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
getselev.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
getvers.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
grabdev.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
grabdev.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
grabdevb.c dix: unexport SwapLongs() 2025-11-25 18:26:02 +01:00
grabdevk.c dix: unexport SwapLongs() 2025-11-25 18:26:02 +01:00
gtmotion.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
handlers.h Xi: inline SProcXISelectEvents() and SProcXIGetSelectedEvents() 2025-10-30 09:44:41 +01:00
listdev.c Xi: zero device/pointer/state reply buffers 2026-06-12 18:52:26 +02:00
meson.build treewide: remove "lib" prefix in static_library names (meson) 2025-07-03 12:01:52 +02:00
opendev.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
queryst.c Xi: fix NULL pointer dereference in ProcXQueryDeviceState 2026-06-12 18:55:08 +02:00
selectev.c Xi: inline SProcXSelectExtensionEvent() 2025-09-24 11:38:34 +02:00
sendexev.c dix: unexport SwapLongs() 2025-11-25 18:26:02 +01:00
setbmap.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
setdval.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
setfocus.c Xi: inline ProcXSetDeviceFocus() 2025-10-20 10:01:19 +02:00
setmmap.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
setmode.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
stubs.c
ungrdev.c Xi: inline SProcXUngrabDevice() 2025-09-24 11:38:22 +02:00
ungrdevb.c Xi: inline SProcXUngrabDeviceButton() 2025-10-21 10:21:52 +02:00
ungrdevk.c Xi: inline SProcXUngrabDeviceKey() 2025-10-22 14:05:24 +02:00
xiallowev.c Xi: inline SProcXIAllowEvents() 2025-10-21 10:21:31 +02:00
xibarriers.c Xi: avoid memory leak when hitting bounds check for barrier events 2026-10-19 14:12:05 +02:00
xibarriers.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
xichangecursor.c Xi: fix NULL pointer dereference in ProcXIChangeCursor 2026-06-12 18:55:40 +02:00
xichangehierarchy.c Xi/xichangehierarchy: reject zero-length hierarchy change entries 2026-06-05 14:58:54 +02:00
xichangehierarchy.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
xigetclientpointer.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
xigrabdev.c Xi: xigrabdev: fix FTBS on *BSD 2026-05-06 19:20:08 +02:00
xipassivegrab.c Xi: validate modifier values in ProcXIPassiveUngrabDevice 2026-10-08 18:14:15 +02:00
xiproperty.c Xi: fix ProcX*ChangeDeviceProperty swapping 2026-06-21 12:05:57 +02:00
xiproperty.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
xiquerydevice.c Xi: byte-swap XIQueryDevice ScrollClass flags 2026-10-05 09:23:49 +02:00
xiquerydevice.h Xi: consolidate request handler prototypes 2025-09-12 09:25:29 +02:00
xiquerypointer.c Xi: zero device/pointer/state reply buffers 2026-06-12 18:52:26 +02:00
xiqueryversion.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
xiselectev.c Xi: xiselectev: fix OOB read in ProcXISelectEvents' non-swapped path 2026-10-07 16:56:08 +02:00
xisetclientpointer.c Xi: inline SProcXIGetClientPointer() and SProcXISetClientPointer() 2025-10-26 13:56:58 +01:00
xisetdevfocus.c Xi: consistenly name reply structs "reply" instead of "rep" 2025-12-04 16:28:54 +01:00
XIstubs.h
xiwarppointer.c dix, Xi: remove spurious dereference when checking function pointers 2026-10-15 16:48:01 +02:00