No description
  • C 94.2%
  • Python 2.2%
  • Roff 1.2%
  • Objective-C 1%
  • Meson 0.9%
  • Other 0.3%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Octavia Togami 950ee20ba8 Fix use-after-free caused by duplicate glyphs in one glyphset
We make two glyphsets, GS1 and GS2, both with the same format depth.
GS1 contains any glyph different from the others, let's call it U
(unique). GS2 contains two glyphs with the same content, or at least
sha1 hash. Let's call them A and B.

We first register GS1 and GS2. GS1 has no problems, but before the
fix, registering GS2 breaks accounting in `globalGlyphs`. Since there
is no check for duplicate glyphs within a single set, we make two
`GlyphNew` entries for A and B. Now in the loop at the end, we go over
each entry and call `AddGlyph` and `FreeGlyph`:
1. AddGlyph(GS2, A, idA) inserts A into `globalGlyphs`
2. FreeGlyph(A) drops A's refcnt by one, but as it's being held in
   `globalGlyphs` it's kept alive.
3. AddGlyph(GS2, B, idB) finds A in `globalGlyphs` and reuses it
   instead of inserting B
4. FreeGlyph(B) drops B's refcnt by one (to zero), and B is freed.
   Before the fix, the lookup in `globalGlyphs` finds A's entry, and
   since it isn't a DeletedGlyph, it erroneously removes the
   `gr->glyph` pointing to `A` and decrements `tableEntries`. This
   results in `tableEntries` being off-by-one as `A` is still alive.

Now, we free the glyphsets in a particular order. Freeing GS1 results
in calling FreeGlyph(U), which will decrement U's refcnt to zero, and
free U. This clears out the entry in `globalGlyphs` for U and
decrements `tableEntries`, which due to the earlier error is now zero.
When `FreeGlyphSet` sees this, it clears the `globalGlyphs` for that
format depth. Now freeing A or GS2 (which transitively frees A) will
try to check the `globalGlyphs` at that format depth, but because it
was cleared out this crashes.

The fix here is to change FreeGlyph to only free a glyph from
`globalGlyphs` that is exactly the glyph being freed, so that
FreeGlyph(B) doesn't touch `globalGlyphs` at all. This keeps a proper
count in `tableEntries` and prevents `globalGlyphs[fdepth]` from being
freed before A is freed.

Closes: #1881
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2264>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2026-10-07 14:48:49 +02:00
.github .github: netbsd: upgrade to 11.0 2026-10-05 20:28:03 +02:00
.vscode lint: Add .clang-tidy and analyzer scripts 2026-05-26 12:15:17 +02:00
config config/udev: guard against NULL subsystem in fallback bus id 2026-07-23 13:48:49 +02:00
dix dix: make InputDevIsFloating() and InputDevIsMaster() static inline 2026-10-06 17:20:37 +02:00
doc Fix typos 2026-04-19 12:32:26 +02:00
exa exa: silence -Wold-style-declaration warning from gcc 16 2026-10-01 11:29:30 +02:00
fb fb: Don't widen the planemask over padding bits when ROOTLESS_SAFEALPHA is set 2026-09-30 21:13:19 +02:00
glamor xfree86: glamor_egl: Add option "DirectDRI3" 2026-09-11 14:13:42 +02:00
hw xf86: prevent passing NULL pointer as strcpy destination 2026-10-07 14:35:45 +02:00
include miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF 2026-10-02 14:37:46 +02:00
man Treewide: Fix typos 2026-03-16 13:11:07 +01:00
mi mi: guard against NULL event pointer 2026-10-07 14:36:54 +02:00
miext miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF 2026-10-02 14:37:46 +02:00
os darwin: Set thread priorities to user interactive or user initiated as appropriate 2026-09-30 21:05:41 +02:00
test test: Fix locale-dependent assertion in signal-logging test 2026-10-05 17:03:00 +02:00
Xext Fix use-after-free caused by duplicate glyphs in one glyphset 2026-10-07 14:48:49 +02:00
.appveyor.yml os: use internal xtrans instead of external library 2025-07-18 22:29:38 +02:00
.clang-tidy lint: Add .clang-tidy and analyzer scripts 2026-05-26 12:15:17 +02:00
.dir-locals.el
.git-blame-ignore-revs
.gitignore lint: Add .clang-tidy and analyzer scripts 2026-05-26 12:15:17 +02:00
.mailmap Update mailmap for Peter Harris 2025-04-15 13:49:13 -04:00
CoC.md it's time to add a CoC (code of conduct) 2025-06-12 17:21:47 +02:00
CODE_OF_CONDUCT.md it's time to add a CoC (code of conduct) 2025-06-12 17:21:47 +02:00
CODE_OVERVIEW.md composite: move it under Xext/ 2026-06-17 07:50:13 +02:00
CONTRIBUTING.md fix minor spelling mistake in contributing guidelines 2025-09-05 15:05:37 +02:00
COPYING COPYING: update copyright dates/holders for remaining existing licenses 2026-06-12 18:24:49 +02:00
HISTORY.md HISTORY.md: add brief overview of the XLibre fork 2025-07-25 08:06:47 -04:00
meson.build hotfix release 25.2.2 2026-07-23 16:57:57 +02:00
meson_options.txt meson_options.txt: fix boolean option value type 2026-06-09 17:12:10 +02:00
NEWS NEWS: add 25.2.0 release entry 2026-06-19 19:24:57 +02:00
README.md README.md: update for one year of XLibre 2026-06-05 12:43:25 -04:00
xlibre-server.pc.in xorg-server.pc: add more variables for easier driver builds 2026-01-08 16:57:10 +01:00
xorg-server.m4 xorg-server.m4: add helper macros for driver builds 2026-01-08 17:17:12 +01:00
xorg-server.pc.in xorg-server.pc: add more variables for easier driver builds 2026-01-08 16:57:10 +01:00
xserver.ent.in

XLibre Xserver

The XLibre Xserver is the community-managed display server for the X Window System Protocol Version 11 (Wikipedia), in short, X11.

1 year of XLibre screenshot
One Year of XLibre. See more liberated screens here.

Selected Features

  • All the good things from X.Org Server, including its unreleased features
  • TearFree modesetting by default and optionally atomic modesetting
  • Support for the Nvidia drivers 340, 390, 470, 570, and newer
  • Xnamespace extension for separating X clients
  • Support for seat management via seatd besides systemd-logind
  • Xfbdev, the generic framebuffer Xserver for Linux
  • CI builds for several BSDs, Linux, MacOS, and Microsoft Windows
  • Active community, cleanups, fixes, and development based on merit

To learn more about the features and mission of XLibre, please visit our homepage.

Switching to XLibre

The easiest way to install and run XLibre is to use your distribution's provided packages. Please see the Are We XLibre Yet? - (X11Libre/xserver Wiki) page for a list of the available options. If there is no option, then go on with building and installing XLibre from source.

Building XLibre

After cloning the Xserver repository or unpacking the sources and installing the dependencies, change into the source directory and run the Meson build tool:

cd "<source dir of xserver>"
meson setup <prefix> build <meson_options>
ninja -C build install

You may specify the install <prefix> with, for example, --prefix="$(pwd)/image" and add build time <meson_options> like so: -Dxnest=false. You may also want to build and install some graphics and input drivers. Please refer to the Building XLibre (X11Libre/xserver Wiki) page for more details.

Configuring XLibre

Until XLibre releases its own, you can find a detailed description of the configuration on the Configuration - Xorg (ArchWiki) page. If you have built and installed XLibre yourself, then change into the <prefix> directory with cd <prefix> and create a directory etc/X11 with a file xorg.conf and adjust it accordingly.

Starting with version 25.0.0.16, the proprietary Nvidia driver is autodetected and handled internally without any special configuration. Please see the Compatibility of XLibre (X11Libre/xserver Wiki) page for more details on the Nvidia driver and compatibility in general.

Running XLibre

If you installed XLibre using your distribution's provided packages, then the Xserver is usually started by init (Wikipedia) on system start. On other systems it should be possible to manually start XLibre with user permissions by invoking startx. Please refer to man startx for how to use it.

If you have built and installed XLibre yourself, then you may want to shutdown other Xservers, change into the <prefix> directory, and create a simple testx.sh file with the following contents:

#!/bin/sh
./bin/X :1 vt8 -logfile /dev/stdout &
_pid=$!
sleep 10 && kill $_pid

You can adjust the :1 vt8 and other options in the testx.sh file as detailed in man Xorg. Make the testx.sh executable and run it:

chmod 0770 testx.sh
./testx.sh

This should give you 10 glorious seconds of a black and beautiful and empty screen. Afterwards the Xserver complains about being killed, but there should be no other critical errors for a "test passed." For more details, please see Building XLibre (X11Libre/xserver Wiki).

I want to help!

That's great; there's enough to do for everyone. You may consider one of the many ideas and feature requests out there. To help in testing, you may consider becoming an XLibre Test Driver. Please also have a look at the good first and help wanted issues and the Liberated Screens.

If you want to work on anything, just let us know. If you have any questions, just ask. Thank you!

Contact

XLibre Discussions at GitHub | XLibre mailing list at FreeLists | @x11dev channel at Telegram | #xlibredev space at Matrix | XLibre security contact at GitHub