Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Enrico Weigelt, metux IT consult 543f5dcb92 xfixes: swap nbytes before validating request length ... ProcXFixesSetCursorName() and ProcXFixesChangeCursorByName() called REQUEST_FIXED_SIZE(..., stuff->nbytes) while stuff->nbytes was still in wire byte order for a swapped client; the swaps(&stuff->nbytes) happened afterwards. MakeAtom() then used the host-order (swapped) value. A byte-swapped client could choose a wire-order nbytes that passes the length check (e.g. 0x0001) whose swapped value is large (0x0100), making MakeAtom() read several hundred bytes past the end of the request buffer and fold that adjacent heap memory into the atom table (disclosed via GetCursorName) or crash the server. Swap nbytes before REQUEST_FIXED_SIZE so the validated value is the one MakeAtom() consumes. This restores the ordering that existed before the request swapping was inlined into the Proc handlers (commit 8336ad8e6f). Fixes: 8336ad8e6f ("xfixes: inline request swapping") Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>		2026-06-12 19:01:07 +02:00
..
cursor.c	xfixes: swap nbytes before validating request length	2026-06-12 19:01:07 +02:00
disconnect.c	dix: move request/response related functions to new request_priv.h header	2025-09-24 11:32:50 +02:00
meson.build	treewide: remove "lib" prefix in static_library names (meson)	2025-07-03 12:01:52 +02:00
region.c	xfixes: region: fix duplicate reply field swapping	2026-04-28 18:53:26 +02:00
saveset.c	xfixes: inline request swapping	2025-09-08 09:57:03 +02:00
select.c	xfixes: inline request swapping	2025-09-08 09:57:03 +02:00
xfixes.c	dix: move request/response related functions to new request_priv.h header	2025-09-24 11:32:50 +02:00
xfixes.h	xfixes: move include guards up to wrap the whole file	2025-11-21 15:20:11 +01:00
xfixesint.h	xfixes: move include guards up to wrap the whole file	2025-11-21 15:20:11 +01:00