Peter Hutterer
564ccf2ce9
mi: reset the PointerWindows reference on screen switch ...
PointerWindows[] keeps a reference to the last window our sprite
entered - changes are usually handled by CheckMotion().
If we switch between screens via XWarpPointer our
dev->spriteInfo->sprite->win is set to the new screen's root window.
If there's another window at the cursor location CheckMotion() will
trigger the right enter/leave events later. If there is not, it skips
that process and we never trigger LeaveWindow() - PointerWindows[] for
the device still refers to the previous window.
If that window is destroyed we have a dangling reference that will
eventually cause a use-after-free bug when checking the window hierarchy
later.
To trigger this, we require:
- two protocol screens
- XWarpPointer to the other screen's root window
- XDestroyWindow before entering any other window
This is a niche bug so we hack around it by making sure we reset the
PointerWindows[] entry so we cannot have a dangling pointer. This
doesn't handle Enter/Leave events correctly but the previous code didn't
either.
CVE-2023-5380, ZDI-CAN-21608
This vulnerability was discovered by:
Sri working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2023-10-25 00:37:47 +00:00
Fix spelling/wording issues
2020-07-05 13:07:33 -07:00
Convert more funcs to use InternalEvent.
2021-12-19 20:01:04 +00:00
include: Stop including <X11/fonts/fontproto.h>
2018-10-25 12:32:48 -04:00
xi: Implement grab support for new gesture event types
2021-05-30 13:26:32 +03:00
dix: Add new internal event enums for gesture events
2021-05-30 13:26:30 +03:00
xi: Implement internal gesture event struct
2021-05-30 13:26:31 +03:00
mi: reset the PointerWindows reference on screen switch
2023-10-25 00:37:47 +00:00
xi: Implement grab support for new gesture event types
2021-05-30 13:26:32 +03:00
Allow disabling the SHAPE extension at runtime
2023-03-03 18:28:40 +00:00
Consolidate fourcc.h
2020-09-15 11:43:16 +02:00
Fix spelling/wording issues
2020-07-05 13:07:33 -07:00
input: Add new hook DeviceSendEventsProc for XTEST
2023-06-26 13:19:19 +02:00
input: Add new hook DeviceSendEventsProc for XTEST
2023-06-26 13:19:19 +02:00
Implement gesture processing logic
2021-05-30 13:26:42 +03:00
Enable USE_DEV_IO on FreeBSD/aarch64
2023-10-22 16:08:21 +00:00
include: Increase the number of max. input devices to 256.
2019-11-09 23:05:13 -05:00
Disallow byte-swapped clients by default
2023-01-06 11:59:37 +10:00
Switch to libbsd-overlay
2023-08-16 19:56:50 +00:00
dix: Remove pScratchPixmap and other associated ABI changes
2022-12-30 01:32:25 +00:00
rootless: Use screen_x and screen_y instead of pixmap pointer hacks
2023-01-20 17:10:54 +00:00
Fix compilation with windows.h from latest w32api
2021-08-31 16:56:28 +00:00
Remove "All rights reserved" from Oracle copyright notices
2023-02-25 09:40:41 -08:00
Mark the dixChangeWindowProperty() value argument as const
2021-07-30 08:36:35 +00:00
xfixes: Add ClientDisconnectMode
2021-06-07 17:28:05 +02:00
dix: Fix undefined shift in HashResourceID
2019-10-15 14:06:21 -04:00
dix: De-ugly the prototype for Add{GPU,}Screen
2018-10-30 12:21:41 -04:00
dix: Remove pScratchPixmap and other associated ABI changes
2022-12-30 01:32:25 +00:00
xf86/logind: Fix compilation error when built without logind/platform bus
2021-12-20 16:56:14 +01:00
dix: Remove WindowRec::backStorage
2019-04-12 21:53:03 +00:00
dix: Force update LEDs after device state update in EnableDevice
2023-02-21 03:43:05 +00:00
Fix spelling/wording issues
2020-07-05 13:07:33 -07:00
xf86AutoConfig: try modesetting on all platforms we build it on
2022-09-20 18:26:03 +00:00
Remove "All rights reserved" from Oracle copyright notices
2023-02-25 09:40:41 -08:00
Remove "All rights reserved" from Oracle copyright notices
2023-02-25 09:40:41 -08:00
Fix typo in error message
2019-01-10 18:40:20 +02:00
xwayland: Add XTEST support using EIS
2023-06-26 13:19:19 +02:00
564ccf2ce9