hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity
xserver/dix
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer 803fd0b94e dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN 
XLFDMAXFONTNAMELEN was 256 bytes, but libXfont2 defines MAXFONTNAMELEN
as 1024 and allows font names and alias targets up to that length in
fonts.alias files.

doListFontsAndAliases copies the resolved alias target into a
stack-allocated tmp_pattern[XLFDMAXFONTNAMELEN] and then into
c->current.pattern[XLFDMAXFONTNAMELEN] (defined in LFWIstateRec).
doListFontsWithInfo has the same pattern, copying the resolved name into
c->current.pattern[]. With the old 256-byte limit, a fonts.alias entry
with a target name between 257 and 1023 bytes would overflow both
buffers.

An attacker can exploit this by:
  1. Creating a font directory with a fonts.alias containing an alias
     whose target name exceeds 256 bytes
  2. Using SetFontPath to add the malicious directory
  3. Calling ListFonts with the alias name to trigger alias resolution
  4. The oversized resolved name overflows the 256-byte stack buffer

Increase XLFDMAXFONTNAMELEN from 256 to 1024 to match libXfont2's
MAXFONTNAMELEN, ensuring the server can handle any name the font library
produces.

This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-30136

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2026-06-03 19:07:48 +02:00
..
.gitignore
atom.c dix: atom: declare variables where needed 2026-05-04 16:52:16 +02:00
atom_priv.h
BuiltInAtoms
callback_priv.h glx: revert cb85ceae2d 2025-11-11 10:46:29 +01:00
client.c dix: add callback before ClientRec is being destroyed 2025-09-22 12:15:31 +02:00
client_priv.h dix: replace XACE_CLIENT_ACCESS by direct callback 2025-09-29 11:24:13 +02:00
color.c dix: remove dixLookupBuiltinColor() unused screen argument 2025-11-28 18:43:40 +01:00
colormap.c dix: colormap: declare variables where needed in ResizeVisualArray() 2026-05-08 17:21:48 +02:00
colormap_priv.h dix: add AllocColormap() to symbol table for internal wfb module 2025-06-12 17:21:48 +02:00
cursor.c cursor: fix AllocARGBCursor leak/double-free for psrcbits/pmaskbits/argb 2026-05-21 16:50:29 +02:00
cursor_priv.h include: unexport CURSOR_BITS_SIZE() and CURSOR_REC_SIZE() macros 2025-11-08 10:45:43 +01:00
devices.c dix/devices.c: Fix infinite loop when tearing down an X server 2026-05-11 10:16:00 +02:00
devices_priv.h dix: replace XACE_CLIENT_ACCESS by direct callback 2025-10-07 10:52:54 +02:00
dispatch.c cursor: fix AllocARGBCursor leak/double-free for psrcbits/pmaskbits/argb 2026-05-21 16:50:29 +02:00
dispatch.h dix: move include guards up to wrap the whole file 2025-11-21 15:20:11 +01:00
display.c
dix_priv.h dix: encapsulate ScreenRec::UnrealizeWindow() call in helper function 2026-01-08 17:44:11 +01:00
dixfonts.c dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN 2026-06-03 19:07:48 +02:00
dixgrabs_priv.h dix: unexport GrabInProgress 2025-11-20 17:42:29 +01:00
dixstruct_priv.h include: don't install client.h anymore 2025-12-05 19:44:59 +01:00
dixutils.c dix: partially revert 8399c4e263 2025-11-11 10:46:29 +01:00
enterleave.c include: windowstr.h: unexport w*() macros 2025-11-27 19:54:42 +01:00
enterleave.h dix: move include guards up to wrap the whole file 2025-11-21 15:20:11 +01:00
eventconvert.c dix: small diff files more C99 scoped declaration 2025-07-31 16:57:44 +02:00
eventconvert.h
events.c dix: events: fix typo in BadAlloc handling in SetInputFocus() 2026-05-07 10:11:42 +02:00
exevents_priv.h dix: unexport XIUnregisterPropertyHandler() and XIDeleteAllDeviceProperties() 2025-11-20 19:21:37 +01:00
extension.c dix: ProcQueryExtension(): use X_REQUEST_* macros 2026-05-08 14:06:21 +02:00
extension_priv.h dix: replace XACE_EXT_ACCESS and XACE_EXT_DISPATCH by direct callback 2025-09-23 11:37:50 +02:00
gc.c dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs() 2025-12-09 17:41:25 +01:00
gc_priv.h dix: move GCAllBits define into private header 2025-11-27 20:05:59 +01:00
generate-atoms dix: don't include dix-config.h from randrstr.h 2025-07-23 15:46:51 +02:00
gestures.c include: windowstr.h: unexport w*() macros 2025-11-27 19:54:42 +01:00
getevents.c dix: fix missing includes of extinit.h 2025-10-07 11:07:00 +02:00
globals.c dix: reexport ConnectionInfo for NVidia 390 2025-11-27 17:06:36 +01:00
glyphcurs.c treewide: fix misleading firstScreen variable naming to masterScreen 2025-09-12 11:44:05 +02:00
grabs.c dix: and NULL protect FreeCursor() 2026-04-29 19:20:33 +02:00
input_priv.h dix: ensure that event fix-up is not performed on core events 2025-09-29 17:15:16 +02:00
inpututils.c dix: replace XACE_CLIENT_ACCESS by direct callback 2025-10-07 10:52:54 +02:00
inpututils_priv.h treewide: drop including <dix-config.h> from private includes 2025-12-04 19:50:44 +01:00
lookup.c dix: use NULL instead of NullClient 2025-07-18 22:24:55 +02:00
main.c dix: move alwaysCheckForInput declaration to first use 2025-12-15 14:10:59 +01:00
meson.build os: move AllowByteSwappedClients setting into DIX 2025-11-27 10:44:23 +01:00
pixmap.c Treewide: Fix typos 2026-03-16 13:11:07 +01:00
privates.c dix: privates: update docs on dixRegisterPrivateKey() 2025-10-29 11:45:04 +01:00
property.c dix: ProcRotateProperties(): use X_REQUEST_* macros 2026-05-08 14:06:08 +02:00
property_priv.h dix: unexport DeleteProperty() 2025-11-20 19:22:35 +01:00
protocol.txt
ptrveloc.c Treewide: Fix typos 2026-03-16 13:11:07 +01:00
ptrveloc_priv.h
region.c dix: small diff files more C99 scoped declaration 2025-07-31 16:57:44 +02:00
registry.c dix: registry: add LookupDixAccessName() 2025-06-12 17:21:48 +02:00
registry_priv.h dix: registry: add LookupDixAccessName() 2025-06-12 17:21:48 +02:00
reqhandlers_priv.h dix: inline SProcGrabButton() 2026-01-31 16:20:28 +01:00
request_priv.h include: dix.h: add macros for reply swapping in request handlers 2026-04-28 13:26:09 +02:00
resource.c dix: fix missing includes of extinit.h 2025-10-07 11:07:00 +02:00
resource_priv.h dix: unexport ResourceStateCallback (not used by drivers) 2025-09-29 10:34:35 +02:00
rpcbuf.c dix: unexport SwapLongs() 2025-11-25 18:26:02 +01:00
rpcbuf_priv.h dix: rpcbuf: x_rpcbuf_write_counted_string_pad() silence size mismatch warning 2025-09-17 09:37:31 +02:00
screen.c dix: dixFreeScreen call hookPostCreateResources too 2025-10-29 11:41:26 +01:00
screen_hooks.c dix: encapsulate ScreenRec::UnrealizeWindow() call in helper function 2026-01-08 17:44:11 +01:00
screen_hooks_priv.h glxmor/glamor_egl: Move glamor_egl_close_screen to the post screen close hook 2026-04-02 10:13:02 +02:00
screenint_priv.h treewide: use helper dixGetScreenPtr() for retrieving ScreenPtr's 2025-10-30 09:44:24 +01:00
screensaver_priv.h dix: unexport screenIsSaved and HasSaverWindow() 2025-11-20 17:52:23 +01:00
selection.c dix: ProcSetSelectionOwner(): use X_REQUEST_* macros 2026-05-08 14:05:35 +02:00
selection_priv.h dix: add selection filtering hooks 2025-06-12 17:21:48 +02:00
server_priv.h dix: reexport ConnectionInfo for NVidia 390 2025-11-27 17:06:36 +01:00
settings.c os: unexport SeatId and move it to dix settings 2026-02-03 11:34:14 +01:00
settings_priv.h os: unexport SeatId and move it to dix settings 2026-02-03 11:34:14 +01:00
stubmain.c
swaprep.c dix: move ReplyNotSwappd() out of public header 2025-11-11 10:43:11 +01:00
swaprep.h dix: swaprep.h: fix missing include of Xdefs.h 2026-04-23 10:29:14 +02:00
swapreq.c dix: inline SProcGrabButton() 2026-01-31 16:20:28 +01:00
swapreq.h dix: inline SProcQueryColor() 2026-01-31 16:16:19 +01:00
tables.c dix: inline SProcGrabButton() 2026-01-31 16:20:28 +01:00
touch.c include: windowstr.h: unexport w*() macros 2025-11-27 19:54:42 +01:00
window.c cursor: fix AllocARGBCursor leak/double-free for psrcbits/pmaskbits/argb 2026-05-21 16:50:29 +02:00
window_priv.h include: windowstr.h: unexport w*() macros 2025-11-27 19:54:42 +01:00