hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-14 05:14:45 +00:00
Code Issues Projects Releases Wiki Activity
xserver/dix
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer 4419b293f2 dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN 
XLFDMAXFONTNAMELEN was 256 bytes, but libXfont2 defines MAXFONTNAMELEN
as 1024 and allows font names and alias targets up to that length in
fonts.alias files.

doListFontsAndAliases copies the resolved alias target into a
stack-allocated tmp_pattern[XLFDMAXFONTNAMELEN] and then into
c->current.pattern[XLFDMAXFONTNAMELEN] (defined in LFWIstateRec).
doListFontsWithInfo has the same pattern, copying the resolved name into
c->current.pattern[]. With the old 256-byte limit, a fonts.alias entry
with a target name between 257 and 1023 bytes would overflow both
buffers.

An attacker can exploit this by:
  1. Creating a font directory with a fonts.alias containing an alias
     whose target name exceeds 256 bytes
  2. Using SetFontPath to add the malicious directory
  3. Calling ListFonts with the alias name to trigger alias resolution
  4. The oversized resolved name overflows the 256-byte stack buffer

Increase XLFDMAXFONTNAMELEN from 256 to 1024 to match libXfont2's
MAXFONTNAMELEN, ensuring the server can handle any name the font library
produces.

This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-30136

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228>
2026-06-03 15:04:23 +02:00
..
.gitignore
atom.c dix: replace xallocarray() by calloc() 2025-06-12 17:21:43 +02:00
atom_priv.h dix: unexport InitAtoms() and FreeAllAtoms() 2025-06-12 16:20:15 +02:00
BuiltInAtoms
callback_priv.h dix: make DeleteCallbackList() non-static and document it 2025-06-12 16:43:56 +02:00
client.c dix: add callback before ClientRec is being destroyed 2025-09-26 16:49:51 +02:00
client_priv.h dix: add callback before ClientRec is being destroyed 2025-09-26 16:49:51 +02:00
closestr.h dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN 2026-06-03 15:04:23 +02:00
color.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
colormap.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
colormap_priv.h dix: add AllocColormap() to symbol table for internal wfb module 2025-06-12 17:21:48 +02:00
cursor.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
cursor_priv.h dix: unexport GetSpritePosition() 2024-09-02 16:43:29 +00:00
devices.c dix: AllocDevicePair(): clean up on allocation failure 2026-05-01 18:43:49 +02:00
dispatch.c dix: Dispatch() separate variable for read result 2025-12-19 12:41:04 +01:00
dispatch.h dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
display.c dix: add getter for display name 2025-02-11 19:13:01 +01:00
dix_priv.h dix: macro for checking X protocol types 2025-08-05 11:38:53 +02:00
dixfonts.c dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN 2026-06-03 15:04:23 +02:00
dixgrabs_priv.h dix: let CreateGrab operate on ClientPtr instead of array index 2025-06-12 16:53:37 +02:00
dixstruct_priv.h include: move private defs to dixstruct_priv.h 2024-04-30 00:47:38 +00:00
dixutils.c dix: replace CLIENT_ID() macro by dixClientIdForXID() inline function 2025-06-12 16:53:27 +02:00
enterleave.c Xi: use fixed define for extenion base opcode 2025-06-12 17:21:43 +02:00
enterleave.h dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
eventconvert.c Xi: use fixed define for extenion base opcode 2025-06-12 17:21:43 +02:00
eventconvert.h dix: unexport eventconvert.h functions 2024-03-11 12:26:44 +01:00
events.c dix: events: fix typo in BadAlloc handling in SetInputFocus() 2026-05-07 10:11:03 +02:00
exevents_priv.h XI: unexport XIPropToInt() and XIPropToFloat() 2025-06-12 16:25:48 +02:00
extension.c drop Xwayland 2025-06-17 12:51:36 +02:00
extension_priv.h drop Xwayland 2025-06-17 12:51:36 +02:00
gc.c dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs() 2025-12-10 12:48:06 +01:00
gc_priv.h dix: replace FreeDefaultStipple() 2025-06-12 16:43:51 +02:00
generate-atoms dix: generate-atoms: Changed BASH to POSIX SH for portability. 2025-06-25 10:53:36 +02:00
gestures.c dix: make RESOURCE_CLIENT_MASK macro private 2025-06-12 16:53:53 +02:00
getevents.c dix: clean up including panoramix headers 2025-06-12 17:21:43 +02:00
globals.c dix: add getter for display name 2025-02-11 19:13:01 +01:00
glyphcurs.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
grabs.c dix: clean up MakeWindowOptional() calls and add alloc fault checks 2025-06-12 17:21:48 +02:00
input_priv.h Xi: unexport AssignTypeAndName() 2025-06-12 17:21:46 +02:00
inpututils.c dix: inpututils: don't use %hhx printf pattern 2025-08-05 11:39:53 +02:00
lookup.c dix: add dixClientForXID() 2025-06-12 16:53:34 +02:00
main.c dix: fix memory clearing in dix_main() 2025-08-15 14:26:09 +02:00
meson.build dix: add callback before ClientRec is being destroyed 2025-09-26 16:49:51 +02:00
pixmap.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
privates.c dix: remove unused NAMESPACE private type 2025-06-16 10:32:48 +02:00
property.c dix: delete unused PropertyStateRec structure to debloat codebase 2025-06-18 21:26:40 +02:00
property_priv.h dix: drop PropertyStateCallback 2025-06-17 12:51:36 +02:00
protocol.txt
ptrveloc.c XI: unexport XIPropToInt() and XIPropToFloat() 2025-06-12 16:25:48 +02:00
ptrveloc_priv.h dix: fix duplicate typedef of MotionTracker and *MotionTrackerPtr 2024-09-01 22:32:49 +00:00
region.c dix: use calloc() instead of malloc() 2025-06-12 16:49:43 +02:00
registry.c dix: registry: add LookupDixAccessName() 2025-06-12 17:21:48 +02:00
registry_priv.h dix: registry: add LookupDixAccessName() 2025-06-12 17:21:48 +02:00
reqhandlers_priv.h dix: unexport events related request handlers 2025-06-12 16:16:45 +02:00
resource.c dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
resource_priv.h dix: unexport and document GetXIDRange() 2025-06-12 16:54:09 +02:00
screen.c dix: dixFreeScreen call hookPostCreateResources too 2025-10-29 16:28:33 +01:00
screen_hooks.c dix: add screen hook for post-close 2025-07-02 15:41:37 +02:00
screen_hooks_priv.h dix: add screen hook for post-close 2025-07-02 15:41:37 +02:00
screenint_priv.h dix: fix duplicate typedef of *ScreenPtr 2024-09-01 22:32:49 +00:00
selection.c dix: add selection filtering hooks 2025-06-12 17:21:48 +02:00
selection_priv.h dix: add selection filtering hooks 2025-06-12 17:21:48 +02:00
stubmain.c
swaprep.c dix: write out X_ListProperties reply directly 2025-06-12 17:21:42 +02:00
swapreq.c dix: unexport events related request handlers 2025-06-12 16:16:45 +02:00
tables.c dix: write out X_ListProperties reply directly 2025-06-12 17:21:42 +02:00
touch.c os: unexport internal logging functions 2025-06-12 17:21:46 +02:00
window.c dix: helper for checking whether window ID belongs to a root window 2025-06-12 17:21:48 +02:00
window_priv.h dix: helper for checking whether window ID belongs to a root window 2025-06-12 17:21:48 +02:00