Backport of ccfc4797cf (PR #3793) to release/25.2.
The original fix (da72833185) introduced a use-after-free vulnerability by
caching a pointer into a realloc()able privates array (pListHead). This fix
replaces the pListHead pointer with pListDrawable, storing the drawable pointer
at insertion time and re-deriving the list head at removal time via
getDrawableDamageRef(), avoiding the realloc() UAF.
The fix:
1. Changes pListHead (DamagePtr *) to pListDrawable (DrawablePtr) in damagestr.h
2. Updates damageInsertDamage to store pDamage->pDrawable instead of the list head pointer
3. Updates damageRemoveDamage to take a DrawablePtr and re-derive the list head via getDrawableDamageRef()
4. Updates all call sites to pass the drawable pointer instead of the list head pointer
5. Fixes damagePixmapDestroy to pass the pixmap as the drawable
*1) da72833185
Backport notes -- deviations from a clean cherry-pick, all measured:
The cherry-pick conflicted in five places, not one: four in miext/damage/damage.c
and one in include/damagestr.h. The conflicts are not cosmetic. pListHead was
introduced by da72833185, which only ever reached master, so it does not exist on
this branch at all:
git grep -c pListHead origin/release/25.2 -> 0
The release tree still carries the *pre-da728331854* form, which cached the list
head locally in damageSetWindowPixmap(). Git's three-way merge reconstructs the
correct net effect, but the merge base is a tree that never had pListHead, so every
site where master merely *renamed* the field appears here as an addition.
1. All five conflict zones were resolved by taking the incoming side. Verified
afterwards that no conflict marker remains and that the resulting function
bodies match master's, field for field.
2. One additional hunk was required that is NOT part of the upstream commit:
damageSetWindowPixmap() left behind
PixmapPtr pOldPixmap = (*pScreen->GetWindowPixmap) (pWindow);
DamagePtr *pPrev = getPixmapDamageRef(pOldPixmap);
Both become dead once the removal path goes through
damageRemoveDamage(pDamage->pListDrawable, pDamage). master's version of that
function has neither line, because on master the equivalent line had already
become pListHead. Left in place they would fail the build with
error: unused variable 'pPrev' [-Werror=unused-variable]
so they are removed here, matching master.
Note that pOldPixmap was the only user of pScreen->GetWindowPixmap in this
function; pScreen itself stays live via damageScrPriv() and pScrPriv.
No other change. pPrev remains in the *insert* path of damageSetWindowPixmap(),
which is where master keeps it, because that call inserts into the list it just
derived.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
(cherry picked from commit ccfc4797cf)
7717c4a00f