Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Enrico Weigelt, metux IT consult 2ba0ed012f mi: fix double-free/UAF in miDCInitialize() on miSpriteInitialize() failure ... miDCInitialize() registers the CloseScreen hook (miDCCloseScreen, via dixScreenHookPostClose()) and stores pScreenPriv into the screen's devPrivates *before* calling miSpriteInitialize(). On failure it only freed pScreenPriv, leaving both the hook armed and the devPrivates slot pointing at now-freed memory. This isn't just "a caller that ignores the Bool return could look it up later" -- the hook it already registered guarantees the problem fires on every subsequent screen close: miDCCloseScreen() looks up the dangling pointer via dixLookupPrivate(), passes it to miDCSwitchScreenCursor() (dereferencing freed memory, e.g. dixDestroyPixmap() on pScreenPriv->sourceBits), and then frees pScreenPriv a second time. Trigger: any allocation failure inside miSpriteInitialize() during screen init (a DDX like vfb/kdrive/xfree86/xnest/xwin calling miDCInitialize()) sets this up; the actual crash fires later, at screen close. Fix: unhook the CloseScreen callback and clear the devPrivates slot before freeing pScreenPriv, matching what miDCCloseScreen() itself does on the normal teardown path. Found via a fleet-directed alloc-fail/UAF sweep of Xext/, mi/, and miext/, not from a live crash report. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>		2026-08-07 15:00:09 +02:00
..
meson.build	mi: move over mioverlay.c to hw/xfree86/compat	2026-06-24 19:26:49 +02:00
mi_priv.h	license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files	2026-07-29 10:02:59 +02:00
miarc.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
micmap.c	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
micopy.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
midash.c	mi: unexport miStepDash()	2025-02-06 16:45:20 +02:00
midispcur.c	mi: fix double-free/UAF in miDCInitialize() on miSpriteInitialize() failure	2026-08-07 15:00:09 +02:00
mieq.c	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
miexpose.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
mifillarc.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
mifillarc.h	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
mifpoly.h
migc.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
miglblt.c	fb/mi/glamor: reject glyphs with negative dimensions	2026-07-14 11:54:22 +02:00
miinitext.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
miinitext.h	mi: drop including dix-config.h from headers	2026-02-10 16:01:20 +01:00
mipointer.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
mipointer_priv.h	license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files	2026-07-29 10:02:59 +02:00
mipoly.c	treewide: replace min/max macros by non-exported MIN/MAX and deprecate them	2026-06-25 14:06:17 +02:00
mipoly.h	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
mipolypnt.c	mi: use NULL instead of NullClient	2025-07-18 22:24:55 +02:00
mipolyrect.c	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
mipolyseg.c	drop obsolete HAVE_DIX_CONFIG_H	2024-10-10 13:38:31 +00:00
mipolytext.c	treewide: clean up includes of misc.h	2026-06-19 19:24:57 +02:00
mipushpxl.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
miscanfill.h	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
miscrinit.c	treewide: clean up includes of misc.h	2026-06-19 19:24:57 +02:00
misprite.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
misprite.h	mi: misprite.h: change retval's from Bool to bool (stdbool.h)	2026-04-23 20:01:59 +02:00
mivaltree.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
miwideline.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
miwideline.h	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
miwindow.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
mizerarc.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00
mizerclip.c	mi: parentheses around macro argument symbols	2026-06-25 09:23:45 +02:00
mizerline.c	mi: use stdbool's 'bool' instead of 'Bool' for local variables	2026-08-07 14:35:29 +02:00