hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-12 04:55:49 +00:00
Code Issues Projects Releases Wiki Activity
xserver/Xext
History
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Alan Coopersmith f58dbbd64b Xi: avoid memory leak when hitting bounds check for barrier events 
The fix for CVE-2026-93519 added a bounds check for barrier events in
CreatePointerBarrierClient() and if it's hit immediately returns
BadAlloc.  Unfortunately it was added after `ret` was already allocated
and before *client_out is set to `ret`, so `ret` leaks.

This fix changes it to jump to the same cleanup code to free(ret)
that the rest of the function already uses.

Fixes: 1f42cc1f0 ("Xi: add bounds check for barrier events in input_constrain_cursor")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2352>
(cherry picked from commit 8e901e6013)
2026-10-23 17:31:47 +02:00
..
bigreq Xext: bigreq: move it into it's own subdir 2026-06-18 13:07:15 +02:00
composite Xext: composite: take the pixmap reference before AddResource() on Xinerama 2026-10-13 13:05:30 +02:00
damage Xext: move remaining panoramix headers into panoramix subdir. 2026-06-17 19:01:48 +02:00
doublebuffer treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
dpms treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
dri2 xfixes: move it under the Xext/ directory 2026-06-17 15:33:32 +02:00
dri3 Xext/dri3: Copy the DRI3 info struct instead of just the pointer 2026-09-11 14:13:42 +02:00
geext Xext: geext: move it into its own subdir 2026-06-18 14:07:18 +02:00
glx glx: validate dataBytes against cmdlen in RenderLarge first request 2026-10-09 11:21:30 +02:00
namespace Xext/namespace: fix potential NULL-pointer dereference in select_ns() 2026-10-13 14:02:09 +02:00
panoramiX panoramiX: zero-init xAllocColorReply to avoid leaking uninitialised bytes 2026-08-24 12:32:10 +02:00
present present: unlink notifies from window list in present_clear_window_notifies 2026-10-12 10:34:26 +02:00
pseudoramiX pseudoramiX: move it under Xext/ 2026-06-17 08:38:34 +02:00
randr Fix DPI property not reporting accurate value when autosetDPI is TRUE 2026-10-07 14:50:24 +02:00
record treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
render render: free animated cursor timers on destruction 2026-10-13 13:58:13 +02:00
saver treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
security Xext: security: fix double free when AddResource() fails 2026-10-13 16:58:15 +02:00
shape treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
shm treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
sync Xext: sync: move it into it's own subdir 2026-06-18 15:32:45 +02:00
xcmisc treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xf86bigfont Xext/xf86bigfont: guard the Unix-only bits for mingw (Windows) 2026-07-22 10:32:26 +02:00
xfixes treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xinput Xi: avoid memory leak when hitting bounds check for barrier events 2026-10-23 17:31:47 +02:00
xkeyboard xkb: reject incomplete keymaps in GetKbdByName 2026-10-17 19:38:57 +02:00
xres treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
xselinux Xext: move xselinux into it's own subdir 2026-06-17 18:22:25 +02:00
xtest Xext: xtest: fix stack out-of-bounds write in ProcXTestFakeInput 2026-08-24 13:55:03 +02:00
xv Xext: xvideo: zero padding in ProcXvListImageFormats reply 2026-08-24 12:30:31 +02:00
hashtable.c treewide: clean up includes of misc.h 2026-06-19 19:24:57 +02:00
hashtable.h Xext: hashtable.h: unexport functions not used by drivers 2025-06-12 16:51:36 +02:00
meson.build Xext: move sleepuntil.c to dix 2026-06-19 09:37:22 +02:00
xace.c dix: replace XACE_SCREEN_ACCESS by direct callback 2025-10-22 13:53:25 +02:00
xace.h treewide: don't include <region.h> anymore 2025-11-27 19:27:27 +01:00
xacestr.h dix: replace XACE_SCREEN_ACCESS by direct callback 2025-10-22 13:53:25 +02:00