hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-05 03:45:42 +00:00
Code Issues Projects Releases Wiki Activity
xserver/render
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Olivier Fourdan 337d8d48b6 render: Avoid possible double-free in ProcRenderAddGlyphs() 
ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and
then frees it using FreeGlyph() to decrease the reference count, after
AddGlyph() has increased it.

AddGlyph() however may chose to reuse an existing glyph if it's already
in the glyphSet, and free the glyph that was given, in which case the
caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an
already freed glyph, as reported by ASan:

  READ of size 4 thread T0
    #0 in FreeGlyph xserver/render/glyph.c:252
    #1 in ProcRenderAddGlyphs xserver/render/render.c:1174
    #2 in Dispatch xserver/dix/dispatch.c:546
    #3 in dix_main xserver/dix/main.c:271
    #4 in main xserver/dix/stubmain.c:34
    #5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #6 in __libc_start_main_impl ../csu/libc-start.c:360
    #7  (/usr/bin/Xwayland+0x44fe4)
  Address is located 0 bytes inside of 64-byte region
  freed by thread T0 here:
    #0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
    #1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538
    #2 in AddGlyph xserver/render/glyph.c:295
    #3 in ProcRenderAddGlyphs xserver/render/render.c:1173
    #4 in Dispatch xserver/dix/dispatch.c:546
    #5 in dix_main xserver/dix/main.c:271
    #6 in main xserver/dix/stubmain.c:34
    #7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
  previously allocated by thread T0 here:
    #0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 in AllocateGlyph xserver/render/glyph.c:355
    #2 in ProcRenderAddGlyphs xserver/render/render.c:1085
    #3 in Dispatch xserver/dix/dispatch.c:546
    #4 in dix_main xserver/dix/main.c:271
    #5 in main xserver/dix/stubmain.c:34
    #6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
  SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph

To avoid that, make sure not to free the given glyph in AddGlyph().

v2: Simplify the test using the boolean returned from AddGlyph() (Michel)
v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter)

Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1476>
2024-04-09 07:02:26 +00:00
..
animcur.c render: move private definitions out of picturestr.h 2024-03-03 22:54:16 +00:00
filter.c
glyph.c render: Avoid possible double-free in ProcRenderAddGlyphs() 2024-04-09 07:02:26 +00:00
glyphstr.h render: move private definitions out of public glyphstr.h 2024-03-03 22:54:16 +00:00
glyphstr_priv.h render: fix refcounting of glyphs during ProcRenderAddGlyphs 2024-04-02 19:19:40 -07:00
matrix.c
meson.build meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
miindex.c
mipict.c mi: Add a default no-op miSourceValidate 2019-10-30 16:26:01 +00:00
mipict.h render: Hide/unexport some implementation details 2015-07-08 16:40:57 -04:00
mirect.c render: Simplify miCompositeRects 2018-02-26 10:02:24 -05:00
mitrap.c
mitri.c
picture.c render: move private definitions out of public glyphstr.h 2024-03-03 22:54:16 +00:00
picture.h glamor: fix CbCr format handling 2022-12-01 08:41:57 +00:00
picturestr.h render: move private definitions out of public glyphstr.h 2024-03-03 22:54:16 +00:00
picturestr_priv.h render: move private definitions out of picturestr.h 2024-03-03 22:54:16 +00:00
render.c render: fix refcounting of glyphs during ProcRenderAddGlyphs 2024-04-02 19:19:40 -07:00