hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-29 02:31:18 +00:00
Code Issues Projects Releases Wiki Activity
xserver/glamor
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer edfab509bd glamor: size tmp_bits buffer for source coordinate range in upload_boxes 
glamor_upload_boxes() allocates the tmp_bits buffer (used for 24-bit to
32-bit depth conversion) based on the destination pixmap height, but
indexes it using source coordinates (y1 - dy_dst + dy_src). When the
source is taller than the destination, the source-relative offset
exceeds the destination height, causing writes past the buffer end.

Size the buffer to account for the source coordinate mapping:
byte_stride * (pixmap->drawable.height - dy_dst + dy_src). This
ensures the buffer covers the full range of source rows that will be
accessed during the upload.

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-32361

CVE-2026-93522

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit ad26c26bf7)
2026-10-20 19:49:20 +02:00
..
glamor.c glamor: Add glamor_is_gles 2026-10-12 13:22:59 +02:00
glamor_addtraps.c fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
glamor_composite_glyphs.c glamor/glamor_composite_glyphs.c Fix glyph compositing paths 2026-09-21 12:07:18 +02:00
glamor_compositerects.c glamor/glamor_compositerects.c: Set need_free_region immediately after pixman region allocation 2026-09-11 14:13:17 +02:00
glamor_context.h glamor: Assume EGL in glamor_context 2021-09-15 19:14:23 +00:00
glamor_copy.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_core.c glamor: fix memleak in error path of glamor_link_glsl_prog() 2026-09-28 17:09:34 +02:00
glamor_dash.c treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
glamor_debug.h glamor: parentheses around macro argument symbols 2026-06-24 15:04:36 +02:00
glamor_egl.c glamor/glamor_egl: Add support for passing gbm devices to glamor 2026-10-19 13:09:25 +02:00
glamor_egl.h glamor/glamor_egl: Add support for passing gbm devices to glamor 2026-10-19 13:09:25 +02:00
glamor_egl_ext.h glamor/glamor_egl: Add ifdefs for EGL libraries that do not support EGLDeviceEXT 2026-06-15 16:48:40 +02:00
glamor_egl_priv.h glamor/glamor_egl: Add support for passing gbm devices to glamor 2026-10-19 13:09:25 +02:00
glamor_fbo.c glamor: Add glamor_egl_untexture_pixmap 2026-10-12 13:22:59 +02:00
glamor_font.c glamor: Check for glGetError() != GL_NO_ERROR instead of just GL_OUT_OF_MEMORY 2026-10-07 16:17:00 +02:00
glamor_font.h glamor: glamor_font.h: fix missing include of <X11/Xdefs.h> 2026-04-23 10:56:39 +02:00
glamor_glx_provider.c glamor: parentheses around macro argument symbols 2026-06-24 15:04:36 +02:00
glamor_glx_provider.h drop Xwayland 2025-06-17 12:51:36 +02:00
glamor_glyphblt.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_gradient.c Treewide: Fix typos 2026-03-16 13:11:07 +01:00
glamor_image.c glamor: fix missing include of dix-config.h 2025-06-12 16:50:32 +02:00
glamor_largepixmap.c treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
glamor_lines.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_picture.c glamor: Check for glGetError() != GL_NO_ERROR instead of just GL_OUT_OF_MEMORY 2026-10-07 16:17:00 +02:00
glamor_pixmap.c glamor: fix missing include of dix-config.h 2025-06-12 16:50:32 +02:00
glamor_points.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_prepare.c glamor: Check for glGetError() != GL_NO_ERROR instead of just GL_OUT_OF_MEMORY 2026-10-07 16:17:00 +02:00
glamor_prepare.h glamor: glamor_prepare.h: fix missing include of <X11/Xdefs.h> 2026-04-23 10:28:47 +02:00
glamor_priv.h glamor/glamor_egl: Fix error reporting in glamor_egl_create_textured_pixmap_from_egl_image 2026-09-21 12:08:12 +02:00
glamor_program.c glamor: use highp for fill_pos UVs on GLES 2026-10-20 19:46:16 +02:00
glamor_program.h treewide: replace PICT_FORMAT_RGB by PIXMAN_FORMAT_RGB 2025-08-07 12:45:37 +02:00
glamor_rects.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_render.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_segs.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_spans.c glamor: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:29:57 +02:00
glamor_sync.c glamor: fix missing include of dix-config.h 2025-06-12 16:50:32 +02:00
glamor_text.c glamor: BUG_RETURN*() on pixmap private data 2025-06-12 16:31:49 +02:00
glamor_transfer.c glamor: size tmp_bits buffer for source coordinate range in upload_boxes 2026-10-20 19:49:20 +02:00
glamor_transfer.h glamor: Take DrawablePtr instead of PixmapPtr in up/download_boxes 2023-07-18 09:34:39 +00:00
glamor_transform.c glamor: use NULL instead of NullClient 2025-07-18 22:24:55 +02:00
glamor_transform.h glamor: glamor_transform.h: fix missing include of <X11/Xdefs.h> 2026-04-23 10:28:38 +02:00
glamor_trapezoid.c treewide: clean up includes of mipict.h 2026-04-30 14:51:33 +02:00
glamor_triangles.c fb: pict: unexport fbTriangles() 2025-06-12 16:35:19 +02:00
glamor_utils.c glamor: use NULL instead of NullClient 2025-07-18 22:24:55 +02:00
glamor_utils.h treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
glamor_vbo.c glamor: fix missing includes of <assert.h> 2026-06-18 17:12:08 +02:00
glamor_window.c glamor: fix missing include of dix-config.h 2025-06-12 16:50:32 +02:00
glamor_xv.c kdrive: glamor_xv: Don't leak X-Video memory and textures 2026-08-25 10:43:31 +02:00
meson.build glx: move it under Xext/ 2026-06-17 15:17:56 +02:00