hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-08 04:16:22 +00:00
Code Issues Projects Releases Wiki Activity
xserver/glx
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer 409394cea8 glx: fix reversed length check in ChangeDrawableAttributes 
The request length validation in __glXDisp_ChangeDrawableAttributes and
__glXDispSwap_ChangeDrawableAttributes uses the wrong comparison direction.
The check tests whether the computed request size is LESS THAN
client->req_len, but should test whether it is GREATER THAN. With the
reversed operator, an undersized request (where numAttribs claims more
attribute pairs than the request actually contains) passes validation.

DoChangeDrawableAttributes then iterates numAttribs attribute pairs starting
from the end of the request header, reading past the actual request data
into adjacent memory. This is an out-of-bounds read that can also cause
an out-of-bounds write when a GLX_EVENT_MASK attribute key is found in the
overread data and its corresponding value is written to pGlxDraw->eventMask.

This patch effectively reverts commit 402b329c3a ("glx: Work around
wrong request lengths sent by mesa"). This was fixed in mesa commit
4324d6fdfbba1 in 2011 (mesa 7.11).

Fixes: 402b329c3a ("glx: Work around wrong request lengths sent by mesa")

This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-30165

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2026-06-03 19:08:16 +02:00
..
glx_dri stop defining _XF86DRI_SERVER_ 2026-01-05 14:42:01 +01:00
clientinfo.c glx: handle strdup allocation failures 2026-05-01 18:52:04 +02:00
createcontext.c dix: unexport enableIndirectGLX 2025-11-20 19:25:41 +01:00
extension_string.c dix: unexport enableIndirectGLX 2025-11-20 19:25:41 +01:00
extension_string.h glx: Implement GLX_EXT_get_drawable_type 2020-09-28 17:16:24 +00:00
glxcmds.c glx: fix reversed length check in ChangeDrawableAttributes 2026-06-03 19:08:16 +02:00
glxcmdsswap.c glx: fix reversed length check in ChangeDrawableAttributes 2026-06-03 19:08:16 +02:00
glxcontext.h glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
glxdrawable.h glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
glxext.c glx: turn retval of xorgGlxCreateVendor() into void 2026-04-23 19:45:53 +02:00
glxext.h glx: glxext.h: add missing includes 2026-04-27 18:20:11 +02:00
glxscreens.c glx: fail if we can't init a screen 2026-04-30 19:54:24 +02:00
glxscreens.h glx: fix duplicate typedef 2025-08-05 10:18:19 +02:00
glxserver.h Treewide: Fix typos 2026-03-16 13:11:07 +01:00
glxutil.h glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
indirect_dispatch.c glx: drop obsolete warnings on files being generated 2025-02-06 14:29:54 +00:00
indirect_dispatch.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
indirect_dispatch_swap.c glx: drop obsolete warnings on files being generated 2025-02-06 14:29:54 +00:00
indirect_program.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
indirect_reqsize.c Revert 9a82f5c, bring back Cygwin support. 2025-12-21 12:59:03 +01:00
indirect_reqsize.h glx: indirect_reqsize.h: move include inside the guards 2026-04-24 13:05:14 +02:00
indirect_size.h drop remains of cygwin support 2025-06-12 17:21:46 +02:00
indirect_size_get.c Revert 9a82f5c, bring back Cygwin support. 2025-12-21 12:59:03 +01:00
indirect_size_get.h drop remains of cygwin support 2025-06-12 17:21:46 +02:00
indirect_table.c glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
indirect_table.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
indirect_texture_compression.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
indirect_util.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
indirect_util.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
meson.build glx: move over vndserver.h public SDK header to include/ 2026-02-12 14:25:12 +01:00
render2.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
render2swap.c glx: replace __GLX_SWAP_INT() by swapl() 2025-09-04 18:33:24 +02:00
renderpix.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
renderpixswap.c glx: replace __GLX_SWAP_INT() by swapl() 2025-09-04 18:33:24 +02:00
rensize.c glx: fix correct sizeof GL unsigned int 2025-06-23 16:18:47 +02:00
single2.c glx: reject negative size in FeedbackBuffer and SelectBuffer requests 2026-05-21 16:50:52 +02:00
single2swap.c glx: reject negative size in FeedbackBuffer and SelectBuffer requests 2026-05-21 16:50:52 +02:00
singlepix.c dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
singlepixswap.c glx: replace __GLX_SWAP_INT() by swapl() 2025-09-04 18:33:24 +02:00
singlesize.c glx: Fix out-of-bounds reads from negative return 2025-07-03 16:43:18 +02:00
singlesize.h glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
swap_interval.c glx: drop obsolete glxbyteorder.h 2025-02-06 14:29:54 +00:00
unpack.h dix: move request/response related functions to new request_priv.h header 2025-09-24 11:32:50 +02:00
vnd_dispatch_stubs.c treewide: use helper dixGetScreenPtr() for retrieving ScreenPtr's 2025-10-30 09:44:24 +01:00
vndcmds.c glx: vndcmds: Update a comment 2025-10-24 12:47:15 +02:00
vndext.c glx: revert cb85ceae2d 2025-11-11 10:46:29 +01:00
vndserver_priv.h glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
vndservermapping.c glx: fix duplicate tagInfo->vendor = NULL assignment 2026-06-03 17:47:54 +02:00
vndservervendor.c glx: fix missing include of dix-config.h 2025-06-12 16:50:30 +02:00
vndservervendor.h glx: drop including dix-config.h from internal includes 2025-07-18 04:51:30 +02:00
xfont.c glx: use calloc() instead of malloc() 2025-06-12 16:49:22 +02:00