hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/glx
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer 598255b2fa glx: fix reversed length check in ChangeDrawableAttributes 
The request length validation in __glXDisp_ChangeDrawableAttributes and
__glXDispSwap_ChangeDrawableAttributes uses the wrong comparison direction.
The check tests whether the computed request size is LESS THAN
client->req_len, but should test whether it is GREATER THAN. With the
reversed operator, an undersized request (where numAttribs claims more
attribute pairs than the request actually contains) passes validation.

DoChangeDrawableAttributes then iterates numAttribs attribute pairs starting
from the end of the request header, reading past the actual request data
into adjacent memory. This is an out-of-bounds read that can also cause
an out-of-bounds write when a GLX_EVENT_MASK attribute key is found in the
overread data and its corresponding value is written to pGlxDraw->eventMask.

This patch effectively reverts commit 402b329c3a ("glx: Work around
wrong request lengths sent by mesa"). This was fixed in mesa commit
4324d6fdfbba1 in 2011 (mesa 7.11).

Fixes: 402b329c3a ("glx: Work around wrong request lengths sent by mesa")

This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-30165

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228>
2026-06-03 15:39:29 +02:00
..
clientinfo.c glx: handle strdup allocation failures 2026-04-30 18:03:20 +02:00
createcontext.c glx: createcontext: silence analyzer warning and make code easier to understand 2025-06-12 16:33:12 +02:00
extension_string.c glx: fix missing include of dix-config.h 2025-06-12 16:50:30 +02:00
extension_string.h glx: Implement GLX_EXT_get_drawable_type 2020-09-28 17:16:24 +00:00
glxcmds.c glx: fix reversed length check in ChangeDrawableAttributes 2026-06-03 15:39:29 +02:00
glxcmdsswap.c glx: fix reversed length check in ChangeDrawableAttributes 2026-06-03 15:39:29 +02:00
glxcontext.h GLX: fix context render type queries 2020-11-26 20:07:55 +00:00
glxdrawable.h Add Windows-DRI extension 2016-09-15 20:10:29 +01:00
glxdri2.c stop defining _XF86DRI_SERVER_ 2026-01-05 14:42:09 +01:00
glxdricommon.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
glxdricommon.h glx: remove unused systemTimeExtension 2017-09-08 11:23:35 -07:00
glxdriswrast.c drop remains of cygwin support 2025-06-12 17:21:46 +02:00
glxext.c glx: glxext fix memory leak when calling DestroyPixmap 2026-01-13 15:01:49 +01:00
glxext.h glx: Fix GLX_CONTEXT_RELEASE_BEHAVIOR_ARB handling 2019-05-01 14:38:09 +00:00
glxscreens.c glx: fail if we can't init a screen 2026-04-30 19:31:08 +02:00
glxscreens.h glx: fix duplicate typedef 2025-08-05 11:15:56 +02:00
glxserver.h glx: Enable GLX_ARB_create_context_no_error (v2) 2018-02-26 10:18:58 -05:00
glxutil.h
indirect_dispatch.c glx: drop obsolete warnings on files being generated 2025-02-06 14:29:54 +00:00
indirect_dispatch.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
indirect_dispatch_swap.c glx: drop obsolete warnings on files being generated 2025-02-06 14:29:54 +00:00
indirect_program.c glx: drop obsolete glxbyteorder.h 2025-02-06 14:29:54 +00:00
indirect_reqsize.c drop remains of cygwin support 2025-06-12 17:21:46 +02:00
indirect_reqsize.h drop remains of support for old Sun compilers 2024-02-19 09:21:36 +00:00
indirect_size.h drop remains of cygwin support 2025-06-12 17:21:46 +02:00
indirect_size_get.c drop remains of cygwin support 2025-06-12 17:21:46 +02:00
indirect_size_get.h drop remains of cygwin support 2025-06-12 17:21:46 +02:00
indirect_table.c glx: drop autogen marker from indirect_table.c 2025-06-12 16:50:27 +02:00
indirect_table.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
indirect_texture_compression.c glx: drop obsolete glxbyteorder.h 2025-02-06 14:29:54 +00:00
indirect_util.c glx: Don't blindly write 8 bytes in GLX single replies 2025-07-03 16:43:18 +02:00
indirect_util.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
meson.build treewide: remove "lib" prefix in static_library names (meson) 2025-07-03 12:01:52 +02:00
render2.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
render2swap.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
renderpix.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
renderpixswap.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
rensize.c glx: fix correct sizeof GL unsigned int 2025-06-23 16:18:47 +02:00
single2.c glx: use calloc() instead of malloc() 2025-06-12 16:49:22 +02:00
single2swap.c glx: use sizeof() for reply struct 2025-02-06 20:04:23 +00:00
singlepix.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
singlepixswap.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
singlesize.c glx: Fix out-of-bounds reads from negative return 2025-07-03 16:43:18 +02:00
singlesize.h
swap_interval.c glx: drop obsolete glxbyteorder.h 2025-02-06 14:29:54 +00:00
unpack.h glx: use sizeof() for reply struct 2025-02-06 20:04:23 +00:00
vnd_dispatch_stubs.c dix: make LEGAL_NEW_RESOURCE() macro private 2025-06-12 17:21:43 +02:00
vndcmds.c glx: use calloc() instead of malloc() 2025-06-12 16:49:22 +02:00
vndext.c miext: move over extinit_priv.h from include 2025-06-12 17:21:46 +02:00
vndserver.h glx: move private definitions from vndserver.h to vndserver_priv.h 2024-02-22 23:52:03 +00:00
vndserver_priv.h glx: move private definitions from vndserver.h to vndserver_priv.h 2024-02-22 23:52:03 +00:00
vndservermapping.c glx: fix missing include of dix-config.h 2025-06-12 16:50:30 +02:00
vndservervendor.c glx: fix missing include of dix-config.h 2025-06-12 16:50:30 +02:00
vndservervendor.h glx: Import glxvnd server module (v2) 2018-02-14 17:04:35 -05:00
xfont.c glx: use calloc() instead of malloc() 2025-06-12 16:49:22 +02:00