Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Peter Hutterer a9f84fcef9 fb/mi/glamor: reject glyphs with negative dimensions ... GLYPHWIDTHPIXELS and GLYPHHEIGHTPIXELS compute glyph dimensions from signed INT16 fields. A crafted PCF font can produce negative results (e.g. rightSideBearing < leftSideBearing). All callees have a while (height--) loop which will end up in OOB writes for negative height values. In the case of a negative height, some callees cast to size_t or end up with negative strides. The same pattern exists in fbPoloyGlyphBit, miPolyGlyphBlt and glamor_poly_glyph_blt_gl, so let's fix all of them in one go. Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2250> (cherry picked from commit e31efd3e10) Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>		2026-07-22 16:22:27 +02:00
..
fb_priv.h	fb: move over public SDK headers to include/	2026-02-12 14:39:31 +01:00
fballpriv.c	fb: reexport fbGetGCPrivateKey and add itw wrapped version	2025-12-18 10:47:47 +01:00
fbarc.c	fb: unexport fbGetGCPrivate() macro	2025-06-12 16:41:09 +02:00
fbbits.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbbits.h	fb: fbbits.h: no need to include dix-config.h here	2025-07-18 04:51:30 +02:00
fbblt.c	fb: move FbStipStrideToBitsStride() to fbblt.c	2025-06-12 16:40:17 +02:00
fbbltone.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbcmap_mi.c	fb: unexport fbListInstalledColormaps()	2025-06-12 16:40:12 +02:00
fbcopy.c	fb: replace xallocarray() by calloc()	2025-06-12 17:21:43 +02:00
fbfill.c	fb: unexport fbValidateDrawable()	2025-06-12 16:39:59 +02:00
fbfillrect.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbfillsp.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbgc.c	fb: unexport fbGetGCPrivate() macro	2025-06-12 16:41:09 +02:00
fbgetsp.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbglyph.c	fb/mi/glamor: reject glyphs with negative dimensions	2026-07-22 16:22:27 +02:00
fbimage.c	fb: unexport FbBitsStrideToStipStride() macro	2025-06-12 16:40:20 +02:00
fbline.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fboverlay.c	fb: quiet -Wanalyzer-out-of-bounds warnings in fbOverlayCopyWindow()	2026-04-21 12:19:30 +02:00
fbpict.c	render: move it under Xext/	2026-06-17 14:29:57 +02:00
fbpict_priv.h	render: move over public SDK headers to include/	2026-02-12 17:43:44 +01:00
fbpixmap.c	treewide: drop unnecessary pixmap field initialization	2025-09-01 13:31:52 +02:00
fbpoint.c	fb: unexport FbBitsStrideToStipStride() macro	2025-06-12 16:40:20 +02:00
fbpush.c	fb: unexport FbBitsStrideToStipStride() macro	2025-06-12 16:40:20 +02:00
fbscreen.c	dix: add dixAllocServerXID()	2025-06-12 17:21:48 +02:00
fbseg.c	fb: use NULL instead of NullClient	2025-07-18 22:24:55 +02:00
fbsetsp.c	fb: unexport fbValidateDrawable()	2025-06-12 16:39:59 +02:00
fbsolid.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbtile.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbtrap.c	treewide: clean up includes of mipict.h	2026-04-30 14:51:33 +02:00
fbutil.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
fbwindow.c	fb: replace DDXPoint by xPoint	2026-02-10 16:01:08 +01:00
meson.build	fb: move over public SDK headers to include/	2026-02-12 14:39:31 +01:00