hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-14 05:14:45 +00:00
Code Issues Projects Releases Wiki Activity
xserver/include
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer c5247a4185 xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int 
Fields in XkbClientMapRec and XkbServerMapRec that denote size/num
and are unsigned short can result in truncations. For example
when XkbResizeKeyType() computes the new size_syms value as
(nTotal * 15) / 10, the result may be implicitly truncated to 16
bits on assignment. This causes an undersized calloc allocation, and the
subsequent copy loop writes based on the actual (untruncated) key count,
resulting in a heap buffer overflow. A similar truncation may happen
in XkbResizeKeySyms() and XkbResizeKeyActions().

Widen the fields from unsigned short to unsigned int. These are internal
server structures, not wire protocol types.

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31834

CVE-2026-93518

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit 89101a6c66)
2026-10-20 19:54:36 +02:00
..
.gitignore
callback.h include: misc.h: drop duplicate definition of CallbackListPtr 2025-09-25 09:36:53 +02:00
colormap.h
colormapst.h
compiler.h include: compiler.h: ppc64el eieio barrier fallback for GCC 12.2 2026-08-07 14:02:59 +02:00
compositeext.h composite: move public SDK header to include/ 2026-02-12 13:21:41 +01:00
cursor.h
cursorstr.h include: unexport CURSOR_BITS_SIZE() and CURSOR_REC_SIZE() macros 2025-11-08 10:45:43 +01:00
damage.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
damagestr.h miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF 2026-10-02 02:53:47 +02:00
dgaproc.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
displaymode.h include: drop including dix-config.h 2026-02-10 11:48:39 +01:00
dix.h dix: guard ARRAY_SIZE against a platform-provided definition 2026-07-01 18:25:14 +02:00
dixaccess.h
dixfont.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
dixfontstr.h treewide: drop ifdef's for GLYPHPADBYTES != 4 2026-06-29 14:28:42 +02:00
dixstruct.h dix: use xorg_list saveSet list 2026-06-25 15:37:02 +02:00
dri.h xfree86: dri: move over public SDK headers to include/ 2026-02-12 18:28:35 +01:00
dri2.h include: dri2.h: fix missing include of "dix.h" 2026-04-24 16:44:17 +02:00
dri3.h dri3: move public dri3.h sdk header to include/ 2026-02-12 14:24:36 +01:00
dristruct.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
edid.h xfree86: ddc: parse CTA-861-G HDR static metadata + colorimetry data blocks 2026-08-24 13:50:42 +02:00
events.h
eventstr.h
exa.h Fix typos 2026-04-19 12:32:26 +02:00
exevents.h dix: unexport XIUnregisterPropertyHandler() and XIDeleteAllDeviceProperties() 2025-11-20 19:21:37 +01:00
extension.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
extinit.h
extnsionst.h include: extnsionst.h: drop unnecessary includes 2026-06-18 13:50:05 +02:00
fb.h Handle -Wimplicit-fallthrough warnings from gcc 16.1 2026-09-30 21:03:21 +02:00
fbdevhw.h xfree86: fbdevhw: move over public SDK header to include/ 2026-02-12 16:26:30 +01:00
fboverlay.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
fbpict.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
fbrop.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
fd_notify.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
fourcc.h xv: change FOURCC_RGBA32 to AMD one 2026-06-24 19:25:57 +02:00
gc.h
gcstruct.h include: replace DDXPoint by xPoint 2026-02-10 15:58:55 +01:00
glamor.h glamor: Add glamor_is_gles 2026-10-12 13:22:59 +02:00
globals.h dix: unexport autosetDPI 2026-10-07 14:53:45 +02:00
glx_extinit.h Xext/glx: exports symbols to make extension shared 2026-07-28 12:31:45 +02:00
glxvndabi.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
glyphstr.h render: move over public SDK headers to include/ 2026-02-12 17:43:44 +01:00
i2c_def.h xfree86: i2c: move over public SDK headers to include/ 2026-02-12 19:50:11 +01:00
input.h dix: add new lookup functions for input devices via config_string 2026-07-31 16:06:26 +02:00
inputstr.h include: inputstr.h: drop assert() 2026-06-19 19:24:57 +02:00
list.h list: make xorg_list cope with zero-initialized list heads 2026-06-25 10:47:59 +02:00
meson.build meson: don't tie the GBM_HAVE_BO_USE_* checks to glamor 2026-10-13 09:38:28 +02:00
mi.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
micmap.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
micoord.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
migc.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
miline.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
mipict.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
mipointer.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
mipointrst.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
misc.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
miscstruct.h
mistruct.h mi: move over public SDK headers to include/ 2026-02-12 16:21:38 +01:00
misync.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
misyncfd.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
misyncshm.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
misyncstr.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
mizerarc.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
opaque.h dix: unexport enableIndirectGLX 2025-11-20 19:25:41 +01:00
optionstr.h include: optionstr.h: drop unnecessary include of "list.h" 2026-07-31 15:36:08 +02:00
os.h os: drop xstrcasestr() 2026-07-23 14:35:08 +02:00
picture.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
picturestr.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
pixmap.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
pixmapstr.h
present.h present: move over public SDK header to include/ 2026-02-12 16:21:20 +01:00
privates.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
property.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
propertyst.h
protocol-versions.h Xext: remove the XF86-BigFont extension 2026-07-27 18:31:44 +02:00
ptrveloc.h
randrstr.h drop ifdef's on RANDR_12_INTERFACE 2026-07-27 19:34:52 +02:00
region.h
regionstr.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
resource.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
rgb.h
rrtransform.h randr: move over public SDK headers to include/ 2026-02-12 15:35:58 +01:00
sarea.h xfree86: dri: move over public SDK headers to include/ 2026-02-12 18:28:35 +01:00
screenint.h
scrnintstr.h scrnintstr.h: drop accidential _SCREEN_HOOK_TYPE 2026-10-14 11:23:08 +02:00
servermd.h glx: move GLYPHPADBYTES out of the SDK into its sole user 2026-06-29 15:49:32 +02:00
shadow.h miext: shadow: move over public SDK header to include/ 2026-02-12 14:39:55 +01:00
shadowfb.h xfree86: shadowfb: move public SDK headers into include/ 2026-02-13 10:11:07 +01:00
shmint.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
syncsdk.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
validate.h mi: move ValidateRec to mi_priv.h and rename to MiValidateRec 2026-02-10 18:27:41 +01:00
vbe.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
vbeModes.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
vgaHW.h xfree86: vgahw: move over public SDK header to include/ 2026-02-12 17:08:29 +01:00
vidmodestr.h include: drop including dix-config.h 2026-02-10 11:48:39 +01:00
vndserver.h glx: move over vndserver.h public SDK header to include/ 2026-02-12 14:25:12 +01:00
wfbrename.h fb: move over public SDK headers to include/ 2026-02-12 14:39:31 +01:00
window.h dix: add new lookup functions for input devices via config_string 2026-07-31 16:06:26 +02:00
windowstr.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
xaarop.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
xf86.h xf86: mark wasset unused in xf86UnblockSIGIO() compatibility wrapper 2026-10-02 12:52:06 +02:00
xf86_OSlib.h xfree86: fix NetBSD/OpenBSD build - don't enable syscons here 2026-09-18 20:58:19 +02:00
xf86_OSproc.h xfree86: common: move public SDK headers to include/ 2026-02-12 19:51:51 +01:00
xf86cmap.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86Crtc.h drop ifdef's on RANDR_12_INTERFACE 2026-07-27 19:34:52 +02:00
xf86Cursor.h xfree86: ramdac: move over public SDK headers to include/ 2026-02-13 11:40:38 +01:00
xf86DDC.h xfree86: ddc: parse CTA-861-G HDR static metadata + colorimetry data blocks 2026-08-24 13:50:42 +02:00
xf86fbman.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86i2c.h xfree86: i2c: move over public SDK headers to include/ 2026-02-12 19:50:11 +01:00
xf86int10.h xfree86: int10: move private definitions out of public header 2026-08-07 11:47:23 +02:00
xf86Modes.h xfree86: modes: move public SDK headers to include/ 2026-02-12 19:03:56 +01:00
xf86Module.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
xf86Opt.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
xf86Optionstr.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86Optrec.h include: dont include xorg-config.h 2026-02-13 14:00:33 +01:00
xf86Parser.h xfree86: parser: drop obsolete / dead DRI section 2026-10-12 11:07:48 +02:00
xf86Pci.h treewide: fix typos 2026-03-16 13:11:07 +01:00
xf86platformBus.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
xf86Priv.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86Privstr.h Disable font server connections by default 2026-09-29 18:24:47 +02:00
xf86RandR12.h xfree86: modes: move public SDK headers to include/ 2026-02-12 19:03:56 +01:00
xf86sbusBus.h xfree86: move over public SDK headers to include/ 2026-02-12 16:21:02 +01:00
xf86str.h xfree86: parser: drop obsolete / dead DRI section 2026-10-12 11:07:48 +02:00
xf86Xinput.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86xv.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xf86xvmc.h include: new header for fundamental pointer types 2026-02-12 18:28:35 +01:00
xisb.h include: fix missing includes of <X11/Xfuncproto.h> 2026-04-24 13:04:40 +02:00
xkb-config.h.in
xkbrules.h
xkbsrv.h Add docs for some internal methods 2026-03-16 13:20:45 +01:00
xkbstr.h xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int 2026-10-20 19:54:36 +02:00
xlibre_membarrier.h include: compiler.h: ppc64el eieio barrier fallback for GCC 12.2 2026-08-07 14:02:59 +02:00
xlibre_ptrtypes.h dix: add new lookup functions for input devices via config_string 2026-07-31 16:06:26 +02:00
xorgVersion.h include: parentheses around macro argument symbols 2026-06-24 19:12:55 +02:00
Xprintf.h include: fix warning on XNFvasprintf() prototype 2025-12-04 17:28:58 +01:00
xserver-properties.h Treewide: Fix typos 2026-03-16 13:11:07 +01:00
Xserver.d
xvdix.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
xvmcext.h Xext: move over public SDK headers to include/ 2026-02-12 19:00:42 +01:00
xwin-config.h.meson.in treewide: Pull DEFAULT_LOGDIR into dix-config.h 2026-03-18 14:09:52 +01:00