Mason Green
8c14928742
Xext/namespace: fix potential NULL-pointer dereference in select_ns() ...
When the configuration file is parsed at server startup, select_ns()
dynamically allocates namespace structures. However, it does not check
whether calloc() or strdup() successfully allocate memory.
If calloc() fails, the server dereferences a NULL pointer and crashes
instantly.
If strdup() fails, the namespace is added to the global list with a
NULL name. When the server later searches for a namespace, it calls
strlen() on the NULL name. This causes a delayed crash of the server
at runtime.
Fix this by adding standard FatalError() checks to handle allocation
failures safely during startup.
Also include a formal TLA+ verification model of the Xnamespace
security isolation extension in doc/Xnamespace.tla.
Signed-off-by: Mason Green <mason@greenm01.net>
(cherry picked from commit e0160fdb7d
2026-10-08 13:09:50 +02:00
Xext/namespace: fix potential NULL-pointer dereference in select_ns()
2026-10-08 13:09:50 +02:00
miext: move over extinit_priv.h from include
2025-06-12 17:21:46 +02:00
dix: add dixAllocServerXID()
2025-06-12 17:21:48 +02:00
Xext: drop checking for HAVE_DIX_CONFIG_H
2025-06-12 16:50:20 +02:00
miext: move over extinit_priv.h from include
2025-06-12 17:21:46 +02:00
xext: add/fix include guards where missing/broken
2025-06-27 13:58:05 +02:00
xext: replace xallocarray() by calloc()
2025-06-12 17:21:43 +02:00
Xext: hashtable.h: unexport functions not used by drivers
2025-06-12 16:51:36 +02:00
treewide: remove "lib" prefix in static_library names (meson)
2025-07-03 12:01:52 +02:00
panoramiX: fail if we can't allocate our visual arrays
2026-05-01 18:51:19 +02:00
composite: clean up including panoramix headers
2025-06-12 17:21:43 +02:00
xext: add/fix include guards where missing/broken
2025-06-27 13:58:05 +02:00
panoramix: protect against allocaton failure
2025-06-12 17:21:44 +02:00
panoramix: export PanoramiXTranslateVisualID for nvidia
2025-06-16 10:32:48 +02:00
Xext: clean up including panoramix headers
2025-06-12 17:21:43 +02:00
saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow
2026-06-03 15:33:26 +02:00
miext: move over extinit_priv.h from include
2025-06-12 17:21:46 +02:00
Xext: security: drop not needed include
2025-06-12 16:30:13 +02:00
Xext: shape: fix non-ximerama build
2025-08-12 11:07:24 +02:00
Xext/shm: add missing reply byte-swap in ProcShmCreateSegment
2026-04-27 15:20:43 +02:00
Xext: use calloc() instead of malloc()
2025-06-12 16:48:11 +02:00
Xext: drop checking for HAVE_DIX_CONFIG_H
2025-06-12 16:50:20 +02:00
sync: fix deletion of counters and fences
2026-06-03 15:42:12 +02:00
Xext/vidmode: fix SProcVidModeSwitchToMode swapping only screen field
2026-04-27 15:17:23 +02:00
xace: export XaceRegisterCallback() and XaceDeleteCallback()
2025-06-12 17:21:45 +02:00
Xext: Fix typo in xace.h
2025-06-27 17:10:33 +02:00
dix: move over private defintions from selection.h to private header
2025-06-12 17:21:46 +02:00
miext: move over extinit_priv.h from include
2025-06-12 17:21:46 +02:00
xf86bigfont: fix compiler warning on unused variable
2025-07-01 17:01:07 +02:00
Xext/xres: fix client PID value swap in ConstructClientIdValue
2026-06-05 15:05:41 +02:00
dix: move over private defintions from selection.h to private header
2025-06-12 17:21:46 +02:00
selinux: remap security classes on policyload
2026-04-21 10:45:12 +02:00
Xext: xtest: fix stack out-of-bounds write in ProcXTestFakeInput
2026-06-12 18:58:56 +02:00
Zero out structs to avoid leaking information via padding
2026-04-27 15:16:13 +02:00
xext: add/fix include guards where missing/broken
2025-06-27 13:58:05 +02:00
treewide: preemptively revert !1714 where it affects ABI compatibility
2025-06-16 10:32:48 +02:00
Xext: xv: fix redefinition of typedef 'XvPortNotifyPtr'
2025-08-05 18:59:43 +02:00
miext: move over extinit_priv.h from include
2025-06-12 17:21:46 +02:00
Xext: xvmc: guard against NULL screen private in ProcXvMCGetDRInfo
2026-06-12 18:58:20 +02:00
8c14928742