hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-14 05:14:45 +00:00
Code Issues Projects Releases Wiki Activity
xserver/dix
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer 4cec8f8089 dix: remove passive grabs referencing a device on removal 
Passive grabs (GrabRec) store raw DeviceIntPtr values for both the
grabbed device and the modifier device without any lifetime management.
When a device is removed via XIRemoveMaster, CloseDevice() frees the
device struct, but leaves dangling pointers in grab->modifierDevice
for any grab that used this device.

Subsequent pointer events trigger CheckPassiveGrab() which dereferences
the dangling modifierDevice pointer for XI grabs (the CORE and XI2 paths
reassign it, but the XI path does not).

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31832

CVE-2026-93516

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit be57263415)
2026-10-20 21:11:11 +02:00
..
.gitignore
atom.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
atom_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
BuiltInAtoms
callback_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
client.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
client_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
color.c treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
colormap.c colormap: code refactor for loops and simplify bit shift 2026-10-13 14:30:44 +02:00
colormap_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
connsetup.c Xext: panoramiX: let PanoramiXCreateConnectionBlock() return rpcbuf 2026-09-29 16:11:03 +02:00
cursor.c treewide: fix result type of BitmapBytePad() to size_t 2026-06-29 15:44:48 +02:00
cursor_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
devices.c dix: remove passive grabs referencing a device on removal 2026-10-20 21:11:11 +02:00
devices_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
dispatch.c dix: dispatch: return DestroySubwindows() errors from ProcDestroySubwindows 2026-10-13 10:39:14 +02:00
dispatch.h dix: move include guards up to wrap the whole file 2025-11-21 15:20:11 +01:00
display.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
dix_priv.h dix: unexport autosetDPI 2026-10-07 14:53:45 +02:00
dixfonts.c Disable font server connections by default 2026-09-29 18:24:47 +02:00
dixgrabs_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
dixstruct_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
dixutils.c dix: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:28:52 +02:00
enterleave.c Xi: move it under Xext/xinput 2026-06-17 16:25:12 +02:00
enterleave.h dix: move include guards up to wrap the whole file 2025-11-21 15:20:11 +01:00
eventconvert.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
eventconvert.h
events.c dix: replace global swapEvent buffer with per-call calloc/free 2026-10-15 17:11:55 +02:00
exevents_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
extension.c Xext: remove the XF86-BigFont extension 2026-07-27 18:31:44 +02:00
extension_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
gc.c dix: parentheses around macro argument symbols 2026-06-25 06:54:55 +02:00
gc_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
generate-atoms
gestures.c dix: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:28:52 +02:00
getevents.c dix: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:28:52 +02:00
globals.c dix: unexport autosetDPI 2026-10-07 14:53:45 +02:00
glyphcurs.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
grabs.c dix: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:28:52 +02:00
input_priv.h dix: make InputDevIsFloating() and InputDevIsMaster() static inline 2026-10-06 19:00:54 +02:00
inputdev.c dix: add new lookup functions for input devices via config_string 2026-07-31 16:06:26 +02:00
inputdev_priv.h dix: add new lookup functions for input devices via config_string 2026-07-31 16:06:26 +02:00
inpututils.c treewide: replace min/max macros by non-exported MIN/MAX and deprecate them 2026-06-25 14:06:17 +02:00
inpututils_priv.h treewide: drop including <dix-config.h> from private includes 2025-12-04 19:50:44 +01:00
lookup.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
main.c xext: panoramix: simplify PanoramiXConsolidate() calls 2026-09-28 19:50:33 +02:00
meson.build dix: factor out sending connection abort to own function 2026-09-24 15:19:10 +02:00
pixmap.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
privates.c dix: fix missing includes of <assert.h> 2026-06-18 17:36:59 +02:00
property.c xext: panoramiX: helpers for checking wether it's enabled/disabled 2026-07-24 17:27:51 +02:00
property_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
protocol.txt Xext: remove the XF86-BigFont extension 2026-07-27 18:31:44 +02:00
ptrveloc.c dix: ptrveloc: fix NULL-deref/div-by-zero on tracker alloc failure 2026-08-24 13:40:57 +02:00
ptrveloc_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
region.c RegionValidate: Fix double free of badreg->data on the error path 2026-10-01 18:52:29 +02:00
registry.c dix/registry: decrement the buffer size in __accbit 2026-09-21 17:51:38 +02:00
registry_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
reqhandlers_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
request_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
resource.c xext: panoramiX: helpers for checking wether it's enabled/disabled 2026-07-24 17:27:51 +02:00
resource_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
rpcbuf.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
rpcbuf_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
saveset_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
screen.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
screen_hooks.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
screen_hooks_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
screenint_priv.h dix: DIX_FOR_N_SCREENS — make self-contained (ternary instead of MIN) 2026-09-24 14:23:13 +02:00
screensaver_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
selection.c dix: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:28:52 +02:00
selection_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
server_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
settings.c license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
settings_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00
sleepuntil.c dix: sleepuntil: use struct xorg_list instead of own list logic 2026-06-25 15:46:11 +02:00
sleepuntil.h Xext: move sleepuntil.c to dix 2026-06-19 09:37:22 +02:00
stubmain.c
swaprep.c dix: refactor sending out the connection setup prefix 2026-09-24 19:59:25 +02:00
swaprep.h dix: refactor sending out the connection setup prefix 2026-09-24 19:59:25 +02:00
swapreq.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
swapreq.h dix: inline SProcQueryColor() 2026-01-31 16:16:19 +01:00
tables.c dix: inline SProcGrabButton() 2026-01-31 16:20:28 +01:00
touch.c dix: use stdbool's 'bool' instead of 'Bool' for local variables 2026-07-27 10:28:52 +02:00
window.c dix/window: fix UnmapNotify and DestroyNotify order in DestroySubwindows 2026-10-14 18:00:21 +02:00
window_priv.h license: add X11 OR MIT OR AGPL-3.0-or-later to Enrico Weigelt's source files 2026-07-29 10:02:59 +02:00