mirror of
https://github.com/X11Libre/xserver.git
synced 2026-11-15 05:23:40 +00:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
4aeded65eb
realloc()'d straight into (cl)->returnBuf: on failure this left returnBuf NULL but returnBufSize untouched at its prior (successful, smaller) value. A later call whose size+align fits under that stale returnBufSize then skips reallocating entirely (returnBufSize "looks" big enough) and dereferences/writes through the NULL returnBuf. Trigger (indirect GLX only): (1) a request causes a successful large allocation, setting returnBufSize high; (2) a later request causes realloc() to fail (OOM), leaving returnBuf NULL while returnBufSize stays at the earlier high value; (3) a third request with size+align <= that stale returnBufSize skips the realloc branch and derefs the NULL returnBuf -- server crash. Fix: realloc into a temporary first, only committing it (pointer + size together) to (cl)->returnBuf/returnBufSize on success -- the same idiom the sibling __glXGetAnswerBuffer() in indirect_util.c already uses correctly for the same operation. Found via a fleet-directed alloc-fail/UAF sweep of Xext/, not from a live crash report. Confirmed this header is actually compiled into libxserver_glx in this build (singlepix.c/indirect_program.c include it; both object files recompiled after this header edit) and the full ninja build + meson test suite (45/45, including pyxtest-test_glx.py) still pass -- but the actual indirect-GLX request path this macro serves was not exercised at runtime (no indirect-GLX client available in this environment), so this is a lighter-weight verification than the other fixes in this sweep. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net> |
||
| .. | ||
| glx_dri | ||
| clientinfo.c | ||
| createcontext.c | ||
| extension_string.c | ||
| extension_string.h | ||
| glxcmds.c | ||
| glxcmdsswap.c | ||
| glxcontext.h | ||
| glxdrawable.h | ||
| glxext.c | ||
| glxext.h | ||
| glxscreens.c | ||
| glxscreens.h | ||
| glxserver.h | ||
| glxutil.h | ||
| indirect_dispatch.c | ||
| indirect_dispatch.h | ||
| indirect_dispatch_swap.c | ||
| indirect_program.c | ||
| indirect_reqsize.c | ||
| indirect_reqsize.h | ||
| indirect_size.h | ||
| indirect_size_get.c | ||
| indirect_size_get.h | ||
| indirect_table.c | ||
| indirect_table.h | ||
| indirect_texture_compression.c | ||
| indirect_util.c | ||
| indirect_util.h | ||
| meson.build | ||
| render2.c | ||
| render2swap.c | ||
| renderpix.c | ||
| renderpixswap.c | ||
| rensize.c | ||
| single2.c | ||
| single2swap.c | ||
| singlepix.c | ||
| singlepixswap.c | ||
| singlesize.c | ||
| singlesize.h | ||
| swap_interval.c | ||
| unpack.h | ||
| vnd_dispatch_stubs.c | ||
| vndcmds.c | ||
| vndext.c | ||
| vndserver_priv.h | ||
| vndservermapping.c | ||
| vndservervendor.c | ||
| vndservervendor.h | ||
| xfont.c | ||