mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-15 05:23:40 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
d536dde7b4
On a calloc() failure while growing the rootless screen pixmap buffer, the old buffer was already freed and pixmap_data_size already bumped to the new (larger) size before the failure check -- leaving s->pixmap_data (and the screen pixmap pPix, still pointing at the freed block via its prior ModifyPixmapHeader() call) dangling. Worse, because pixmap_data_size was already bumped, a later same-or-smaller-size call sees pixmap_data_size < rowbytes as false and skips reallocating forever, permanently pinning the dangling state instead of retrying. Trigger: real host memory pressure during a rootless (Xquartz-style DDX) geometry change. Fix: allocate the replacement into a temporary first; only free the old buffer and update pixmap_data_size/pixmap_data together once the new allocation has succeeded. Found via a fleet-directed alloc-fail/UAF sweep of Xext/, mi/, and miext/, not from a live crash report. Verification note: miext/rootless/ only compiles into hw/xquartz, which this Linux build has disabled -- checked with a standalone `gcc -fsyntax-only` pass instead of the normal ninja+meson-test build/test cycle used for the other fixes in this sweep. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net> |
||
| .. | ||
| damage | ||
| rootless | ||
| shadow | ||
| sync | ||
| extinit_priv.h | ||