hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-12 04:55:49 +00:00
Code Issues Projects Releases Wiki Activity
xserver/include
History
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Peter Hutterer c489be39fc xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int 
Fields in XkbClientMapRec and XkbServerMapRec that denote size/num
and are unsigned short can result in truncations. For example
when XkbResizeKeyType() computes the new size_syms value as
(nTotal * 15) / 10, the result may be implicitly truncated to 16
bits on assignment. This causes an undersized calloc allocation, and the
subsequent copy loop writes based on the actual (untruncated) key count,
resulting in a heap buffer overflow. A similar truncation may happen
in XkbResizeKeySyms() and XkbResizeKeyActions().

Widen the fields from unsigned short to unsigned int. These are internal
server structures, not wire protocol types.

This vulnerability was discovered by:
  Anonymous working with TrendAI Zero Day Initiative

ZDI-CAN-31834

CVE-2026-93518

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341>
(cherry picked from commit 89101a6c66)
2026-10-17 18:59:23 +02:00
..
.gitignore
callback.h dix: unexport callback manager init / teardown functions 2024-03-12 15:18:17 +00:00
client.h os: unexport client id retrieval functions 2024-10-10 13:45:29 +00:00
closure.h
colormap.h dix: unexport ResizeVisualArray() 2025-06-12 17:21:46 +02:00
colormapst.h dix: move SHAREDCOLOR struct declaration out of public header 2025-06-12 17:21:43 +02:00
cursor.h dix: drop superfluous XineramaGetCursorScreen() 2024-09-02 16:43:29 +00:00
cursorstr.h
displaymode.h hw/xfree86: re-calculate the clock and refresh rate 2023-12-22 05:02:05 +00:00
dix-config-apple-verbatim.h include: add/fix include guards where missing/broken 2025-06-27 13:58:05 +02:00
dix.h dix: make LEGAL_NEW_RESOURCE() macro private 2025-06-12 17:21:43 +02:00
dixaccess.h
dixfont.h include: drop unused including of closure.h 2024-03-03 22:42:41 +00:00
dixfontstr.h include: dixfontstr.h: drop silent dependency on libxfont2 2024-09-01 17:45:13 +00:00
dixstruct.h os: split off internal definitions from client.h 2024-10-10 13:45:29 +00:00
events.h
eventstr.h mi: reset the PointerWindows reference on screen switch 2023-10-25 00:37:47 +00:00
exevents.h XI: unexport XIPropToInt() and XIPropToFloat() 2025-06-12 16:25:48 +02:00
extension.h
extinit.h present: unexport present_extension_init() 2025-06-12 17:21:45 +02:00
extnsionst.h
fd_notify.h os: move X_NOTIFY_* defines to separate header 2025-08-05 16:53:28 +02:00
fourcc.h glamor: xv: add rgb565 2023-11-29 21:18:29 +00:00
gc.h dix: unexport SetClipRects() 2024-04-15 23:10:31 +00:00
gcstruct.h fix name clash on 'GC' between Xlib and Xserver 2025-06-12 16:52:25 +02:00
globals.h include: unexport no*Extension flags 2025-02-07 12:00:58 +01:00
glx_extinit.h Xext/glx: exports symbols to make extension shared 2026-08-24 13:37:54 +02:00
glxvndabi.h
hotplug.h config: unexport config_pre_init() 2025-02-06 16:24:01 +01:00
input.h include: move private definitions out of input.h 2024-09-01 17:59:23 +00:00
inputstr.h Xi: unexport AssignTypeAndName() 2025-06-12 17:21:46 +02:00
inpututils.h
list.h include: list.h: add duplicate checking add/append functions 2025-06-12 17:21:48 +02:00
meson.build Revert "SDK: define BSD console macros unconditionally for driver builds" 2026-09-18 15:58:09 +02:00
misc.h meson: move MAXCLIENTS and LIMITCLIENTS into dix-config.h 2025-08-05 12:31:52 +02:00
miscstruct.h
nonsdk_extinit.h include: move private definitions out of extinit.h 2024-04-30 00:47:38 +00:00
opaque.h os: unexport fields from opaque.h not used by modules / drivers 2024-06-23 21:19:27 +00:00
optionstr.h
os.h include: os.h: fix extra ; 2025-08-29 19:04:14 +02:00
pixmap.h
pixmapstr.h treewide: drop COMPOSITE symbol 2025-06-12 16:47:01 +02:00
privates.h dix: remove unused NAMESPACE private type 2025-06-16 10:32:48 +02:00
probes.h
property.h dix: unexport DeleteAllWindowProperties() 2024-09-02 17:50:47 +00:00
propertyst.h
protocol-versions.h xvmc: move over protocol version defines into xvmc.c 2025-02-06 23:29:10 +00:00
ptrveloc.h dix: unexport SetAccelerationProfile() 2024-03-09 18:01:52 +00:00
region.h
regionstr.h include: use calloc() instead of malloc() 2025-06-12 16:49:49 +02:00
resource.h dix: add dixAllocServerXID() 2025-06-12 17:21:48 +02:00
rgb.h
screenint.h Revert "dix: unexport AttachOutputGPU() and DetachOutputGPU()" 2024-09-01 20:38:01 +00:00
scrnintstr.h dix: add screen hook for post-close 2025-07-02 15:41:37 +02:00
servermd.h
swaprep.h dix: write out X_ListProperties reply directly 2025-06-12 17:21:42 +02:00
swapreq.h dix: unexport events related request handlers 2025-06-12 16:16:45 +02:00
validate.h
vidmodestr.h
window.h dix: unexport MakeWindowOptional() 2025-06-12 17:21:48 +02:00
windowstr.h dix: replace wClient() macro by dixClientForWindow() inline function 2025-06-12 16:53:13 +02:00
xkb-config.h.in
xkbrules.h xkb: unexport XkbRF_VarDefsRec struct 2025-06-12 17:21:47 +02:00
xkbsrv.h xkb: unexport XkbCopyControls() 2025-06-12 17:21:45 +02:00
xkbstr.h xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int 2026-10-17 18:59:23 +02:00
xorg-config.h.meson.in bsd: drop PCCONS support 2025-06-12 16:52:31 +02:00
xorg-server.h.meson.in Revert "SDK: define BSD console macros unconditionally for driver builds" 2026-09-18 15:58:09 +02:00
Xprintf.h os: drop Xasprintf() and Xvasprintf() 2025-06-12 16:54:13 +02:00
xserver-properties.h
Xserver.d
xwin-config.h.meson.in include: add/fix include guards where missing/broken 2025-06-27 13:58:05 +02:00