hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-12 04:55:49 +00:00
Code Issues Projects Releases Wiki Activity
xserver/include
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Enrico Weigelt, metux IT consult 7717c4a00f miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF 
Backport of ccfc4797cf (PR #3793) to release/25.2.

The original fix (da72833185) introduced a use-after-free vulnerability by
caching a pointer into a realloc()able privates array (pListHead). This fix
replaces the pListHead pointer with pListDrawable, storing the drawable pointer
at insertion time and re-deriving the list head at removal time via
getDrawableDamageRef(), avoiding the realloc() UAF.

The fix:
1. Changes pListHead (DamagePtr *) to pListDrawable (DrawablePtr) in damagestr.h
2. Updates damageInsertDamage to store pDamage->pDrawable instead of the list head pointer
3. Updates damageRemoveDamage to take a DrawablePtr and re-derive the list head via getDrawableDamageRef()
4. Updates all call sites to pass the drawable pointer instead of the list head pointer
5. Fixes damagePixmapDestroy to pass the pixmap as the drawable

*1) da72833185

Backport notes -- deviations from a clean cherry-pick, all measured:

The cherry-pick conflicted in five places, not one: four in miext/damage/damage.c
and one in include/damagestr.h. The conflicts are not cosmetic. pListHead was
introduced by da72833185, which only ever reached master, so it does not exist on
this branch at all:

    git grep -c pListHead origin/release/25.2 -> 0

The release tree still carries the *pre-da728331854* form, which cached the list
head locally in damageSetWindowPixmap(). Git's three-way merge reconstructs the
correct net effect, but the merge base is a tree that never had pListHead, so every
site where master merely *renamed* the field appears here as an addition.

1. All five conflict zones were resolved by taking the incoming side. Verified
   afterwards that no conflict marker remains and that the resulting function
   bodies match master's, field for field.

2. One additional hunk was required that is NOT part of the upstream commit:
   damageSetWindowPixmap() left behind

       PixmapPtr pOldPixmap = (*pScreen->GetWindowPixmap) (pWindow);
       DamagePtr *pPrev = getPixmapDamageRef(pOldPixmap);

   Both become dead once the removal path goes through
   damageRemoveDamage(pDamage->pListDrawable, pDamage). master's version of that
   function has neither line, because on master the equivalent line had already
   become pListHead. Left in place they would fail the build with

       error: unused variable 'pPrev' [-Werror=unused-variable]

   so they are removed here, matching master.

   Note that pOldPixmap was the only user of pScreen->GetWindowPixmap in this
   function; pScreen itself stays live via damageScrPriv() and pScrPriv.

No other change. pPrev remains in the *insert* path of damageSetWindowPixmap(),
which is where master keeps it, because that call inserts into the list it just
derived.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
(cherry picked from commit ccfc4797cf)
2026-10-02 14:37:46 +02:00
..
.gitignore
callback.h include: misc.h: drop duplicate definition of CallbackListPtr 2025-09-25 09:36:53 +02:00
client.h include: drop including dix-config.h 2026-02-10 11:48:39 +01:00
colormap.h dix: unexport ResizeVisualArray() 2025-06-12 17:21:46 +02:00
colormapst.h dix: move SHAREDCOLOR struct declaration out of public header 2025-06-12 17:21:43 +02:00
compiler.h include: compiler.h: restore MIPS port I/O port access (12-year-old bug) 2026-08-24 13:36:53 +02:00
compositeext.h composite: move public SDK header to include/ 2026-02-12 13:21:41 +01:00
cursor.h dix: drop superfluous XineramaGetCursorScreen() 2024-09-02 16:43:29 +00:00
cursorstr.h include: unexport CURSOR_BITS_SIZE() and CURSOR_REC_SIZE() macros 2025-11-08 10:45:43 +01:00
damage.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
damagestr.h miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF 2026-10-02 14:37:46 +02:00
dgaproc.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
displaymode.h include: drop including dix-config.h 2026-02-10 11:48:39 +01:00
dix.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
dixaccess.h
dixfont.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
dixfontstr.h include: dixfontstr.h: drop unused PADGLYPHWIDTHBYTES defines 2025-11-07 09:32:40 +01:00
dixstruct.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
dri.h xfree86: dri: move over public SDK headers to include/ 2026-02-12 18:28:35 +01:00
dri2.h include: dri2.h: fix missing include of "dix.h" 2026-04-24 16:44:17 +02:00
dri3.h dri3: move public dri3.h sdk header to include/ 2026-02-12 14:24:36 +01:00
dristruct.h Fix typos 2026-04-19 12:32:26 +02:00
edid.h xfree86: ddc: move public SDK headers to include/ 2026-02-12 19:18:54 +01:00
events.h
eventstr.h mi: reset the PointerWindows reference on screen switch 2023-10-25 00:37:47 +00:00
exa.h Fix typos 2026-04-19 12:32:26 +02:00
exevents.h dix: unexport XIUnregisterPropertyHandler() and XIDeleteAllDeviceProperties() 2025-11-20 19:21:37 +01:00
extension.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
extinit.h include: update comment about exported noPanoramiXExtension 2025-09-15 10:26:11 +02:00
extnsionst.h include: extnsionst.h: drop unnecessary includes 2026-06-18 13:50:05 +02:00
fb.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
fbdevhw.h xfree86: fbdevhw: move over public SDK header to include/ 2026-02-12 16:26:30 +01:00
fboverlay.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
fbpict.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
fbrop.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
fd_notify.h os: move X_NOTIFY_* defines to separate header 2025-07-25 15:21:13 +02:00
fourcc.h glamor: xv: add rgb565 2023-11-29 21:18:29 +00:00
gc.h dix: unexport SetClipRects() 2024-04-15 23:10:31 +00:00
gcstruct.h include: replace DDXPoint by xPoint 2026-02-10 15:58:55 +01:00
glamor.h glamor_egl: remove unneeded xf86 includes/GLAMOR_FOR_XORG 2026-05-12 14:50:18 +02:00
globals.h os: unexport SeatId and move it to dix settings 2026-02-03 11:34:14 +01:00
glx_extinit.h Xext/glx: exports symbols to make extension shared 2026-08-24 13:38:06 +02:00
glxvndabi.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
glyphstr.h render: move over public SDK headers to include/ 2026-02-12 17:43:44 +01:00
i2c_def.h xfree86: i2c: move over public SDK headers to include/ 2026-02-12 19:50:11 +01:00
input.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
inputstr.h include: inputstr.h: drop assert() 2026-06-19 19:24:57 +02:00
list.h include: list.h: add duplicate checking add/append functions 2025-06-12 17:21:48 +02:00
meson.build include: glamor/glamor_egl: Use EGL extensions string macros for build-time compat 2026-06-15 16:48:40 +02:00
mi.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
micmap.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
micoord.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
migc.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
miline.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
mioverlay.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
mipict.h render: move over public SDK headers to include/ 2026-02-12 17:43:44 +01:00
mipointer.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
mipointrst.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
misc.h os: add header for math related functions (possibly OS optimized) 2025-11-27 19:58:33 +01:00
miscstruct.h
mistruct.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
misync.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
misyncfd.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
misyncshm.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
misyncstr.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
mizerarc.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
opaque.h dix: unexport enableIndirectGLX 2025-11-20 19:25:41 +01:00
optionstr.h
os.h dix: dixfonts: move closure structures into consumer source file 2026-04-28 14:39:41 +02:00
picture.h Fix typos 2026-04-19 12:32:26 +02:00
picturestr.h render: move over public SDK headers to include/ 2026-02-12 17:43:44 +01:00
pixmap.h
pixmapstr.h include: pixmapstr.h: inline PixmapBox() and fix signedness 2025-09-18 20:26:31 +02:00
present.h present: move over public SDK header to include/ 2026-02-12 16:21:20 +01:00
privates.h dix: privates: update docs on dixRegisterPrivateKey() 2025-10-29 11:45:04 +01:00
property.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
propertyst.h
protocol-versions.h xvmc: move over protocol version defines into xvmc.c 2025-02-06 23:29:10 +00:00
ptrveloc.h dix: unexport SetAccelerationProfile() 2024-03-09 18:01:52 +00:00
randrstr.h randr: don't ifdef on RANDR_10_INTERFACE anymore 2026-02-13 14:00:41 +01:00
region.h
regionstr.h include: regionstr.h: drop unused legacy macros 2025-11-12 15:39:50 +01:00
resource.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
rgb.h
rrtransform.h randr: move over public SDK headers to include/ 2026-02-12 15:35:58 +01:00
sarea.h xfree86: dri: move over public SDK headers to include/ 2026-02-12 18:28:35 +01:00
screenint.h Revert "dix: unexport AttachOutputGPU() and DetachOutputGPU()" 2024-09-01 20:38:01 +00:00
scrnintstr.h include: scrnintstr.h: mark private area of ScreenRec 2026-05-08 13:58:15 +02:00
servermd.h include: drop including dix-config.h 2026-02-10 11:48:39 +01:00
shadow.h miext: shadow: move over public SDK header to include/ 2026-02-12 14:39:55 +01:00
shadowfb.h xfree86: shadowfb: move public SDK headers into include/ 2026-02-13 10:11:07 +01:00
shmint.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
syncsdk.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
validate.h mi: move ValidateRec to mi_priv.h and rename to MiValidateRec 2026-02-10 18:27:41 +01:00
vbe.h xfree86: int10: move public SDK headers to include/ 2026-02-13 10:25:17 +01:00
vbeModes.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
vgaHW.h xfree86: vgahw: move over public SDK header to include/ 2026-02-12 17:08:29 +01:00
vidmodestr.h include: drop including dix-config.h 2026-02-10 11:48:39 +01:00
vndserver.h glx: move over vndserver.h public SDK header to include/ 2026-02-12 14:25:12 +01:00
wfbrename.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
window.h include: window.h: drop duplicate typedef of WindowPtr 2026-05-06 19:32:33 +02:00
windowstr.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xaarop.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86_OSlib.h xfree86: common: move public SDK headers to include/ 2026-02-12 19:51:51 +01:00
xf86_OSproc.h xfree86: common: move public SDK headers to include/ 2026-02-12 19:51:51 +01:00
xf86cmap.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86Crtc.h xf86: check return value of XF86_CRTC_CONFIG_PTR in xf86CompatOutput() 2026-03-16 13:14:07 +01:00
xf86Cursor.h xfree86: ramdac: move over public SDK headers to include/ 2026-02-13 11:40:38 +01:00
xf86DDC.h xfree86: ddc: move public SDK headers to include/ 2026-02-12 19:18:54 +01:00
xf86fbman.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86i2c.h xfree86: i2c: move over public SDK headers to include/ 2026-02-12 19:50:11 +01:00
xf86int10.h xfree86: int10: move public SDK headers to include/ 2026-02-13 10:25:17 +01:00
xf86Modes.h xfree86: modes: move public SDK headers to include/ 2026-02-12 19:03:56 +01:00
xf86Module.h Fix typos 2026-04-19 12:32:26 +02:00
xf86Opt.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
xf86Optionstr.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86Optrec.h include: dont include xorg-config.h 2026-02-13 14:00:33 +01:00
xf86Parser.h include: dont include xorg-config.h 2026-02-13 14:00:33 +01:00
xf86Pci.h treewide: fix typos 2026-03-16 13:11:07 +01:00
xf86platformBus.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86Priv.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86Privstr.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86RandR12.h xfree86: modes: move public SDK headers to include/ 2026-02-12 19:03:56 +01:00
xf86sbusBus.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86str.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86Xinput.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86xv.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86xvmc.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xisb.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
xkb-config.h.in
xkbrules.h xkb: unexport XkbRF_VarDefsRec struct 2025-06-12 17:21:47 +02:00
xkbsrv.h Add docs for some internal methods 2026-03-16 13:20:45 +01:00
xkbstr.h include: xkbstr.h: fix missing include of Xdefs.h 2024-04-09 06:50:20 +00:00
xlibre_ptrtypes.h include: xlibre_ptrtypes: protect from double declaration of ClientPtr 2026-04-30 14:39:39 +02:00
xorgVersion.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
Xprintf.h include: fix warning on XNFvasprintf() prototype 2025-12-04 17:28:58 +01:00
xserver-properties.h Treewide: Fix typos 2026-03-16 13:11:07 +01:00
Xserver.d
xvdix.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
xvmcext.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
xwin-config.h.meson.in treewide: Pull DEFAULT_LOGDIR into dix-config.h 2026-03-18 14:09:52 +01:00