Enrico Weigelt, metux IT consult
d9edf30a90
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int ...
Fields in XkbClientMapRec and XkbServerMapRec that denote size/num
and are unsigned short can result in truncations. For example
when XkbResizeKeyType() computes the new size_syms value as
(nTotal * 15) / 10, the result may be implicitly truncated to 16
bits on assignment. This causes an undersized calloc allocation, and the
subsequent copy loop writes based on the actual (untruncated) key count,
resulting in a heap buffer overflow. A similar truncation may happen
in XkbResizeKeySyms() and XkbResizeKeyActions().
Widen the fields from unsigned short to unsigned int. These are internal
server structures, not wire protocol types.
This vulnerability was discovered by:
Anonymous working with TrendAI Zero Day Initiative
ZDI-CAN-31834
CVE-2026-93518
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2341 >
2026-10-09 12:19:53 +02:00
Fix spelling/wording issues
2020-07-05 13:07:33 -07:00
include: misc.h: drop duplicate definition of CallbackListPtr
2025-09-25 09:36:53 +02:00
include: drop including dix-config.h
2026-02-10 11:48:39 +01:00
dix: unexport ResizeVisualArray()
2025-06-12 17:21:46 +02:00
dix: move SHAREDCOLOR struct declaration out of public header
2025-06-12 17:21:43 +02:00
include: compiler.h: restore MIPS port I/O port access (12-year-old bug)
2026-08-24 13:36:53 +02:00
composite: move public SDK header to include/
2026-02-12 13:21:41 +01:00
dix: drop superfluous XineramaGetCursorScreen()
2024-09-02 16:43:29 +00:00
include: unexport CURSOR_BITS_SIZE() and CURSOR_REC_SIZE() macros
2025-11-08 10:45:43 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF
2026-10-02 14:37:46 +02:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
include: drop including dix-config.h
2026-02-10 11:48:39 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: dixfontstr.h: drop unused PADGLYPHWIDTHBYTES defines
2025-11-07 09:32:40 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
xfree86: dri: move over public SDK headers to include/
2026-02-12 18:28:35 +01:00
include: dri2.h: fix missing include of "dix.h"
2026-04-24 16:44:17 +02:00
dri3: move public dri3.h sdk header to include/
2026-02-12 14:24:36 +01:00
Fix typos
2026-04-19 12:32:26 +02:00
xfree86: ddc: move public SDK headers to include/
2026-02-12 19:18:54 +01:00
xi: Implement internal gesture event struct
2021-05-30 13:26:31 +03:00
mi: reset the PointerWindows reference on screen switch
2023-10-25 00:37:47 +00:00
Fix typos
2026-04-19 12:32:26 +02:00
dix: unexport XIUnregisterPropertyHandler() and XIDeleteAllDeviceProperties()
2025-11-20 19:21:37 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: update comment about exported noPanoramiXExtension
2025-09-15 10:26:11 +02:00
include: extnsionst.h: drop unnecessary includes
2026-06-18 13:50:05 +02:00
fb: move over public SDK headers to include/
2026-02-12 14:39:31 +01:00
xfree86: fbdevhw: move over public SDK header to include/
2026-02-12 16:26:30 +01:00
fb: move over public SDK headers to include/
2026-02-12 14:39:31 +01:00
fb: move over public SDK headers to include/
2026-02-12 14:39:31 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
os: move X_NOTIFY_* defines to separate header
2025-07-25 15:21:13 +02:00
glamor: xv: add rgb565
2023-11-29 21:18:29 +00:00
dix: unexport SetClipRects()
2024-04-15 23:10:31 +00:00
include: replace DDXPoint by xPoint
2026-02-10 15:58:55 +01:00
glamor_egl: remove unneeded xf86 includes/GLAMOR_FOR_XORG
2026-05-12 14:50:18 +02:00
Add Support for DPI Auto-Detection
2026-10-07 14:50:24 +02:00
Xext/glx: exports symbols to make extension shared
2026-08-24 13:38:06 +02:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
render: move over public SDK headers to include/
2026-02-12 17:43:44 +01:00
xfree86: i2c: move over public SDK headers to include/
2026-02-12 19:50:11 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: inputstr.h: drop assert()
2026-06-19 19:24:57 +02:00
include: list.h: add duplicate checking add/append functions
2025-06-12 17:21:48 +02:00
include: glamor/glamor_egl: Use EGL extensions string macros for build-time compat
2026-06-15 16:48:40 +02:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
render: move over public SDK headers to include/
2026-02-12 17:43:44 +01:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
os: add header for math related functions (possibly OS optimized)
2025-11-27 19:58:33 +01:00
Drop trailing whitespaces
2014-11-12 10:25:00 +10:00
mi: move over public SDK headers to include/
2026-02-12 16:21:38 +01:00
Xext: move over public SDK headers to include/
2026-02-12 19:00:42 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
dix: unexport enableIndirectGLX
2025-11-20 19:25:41 +01:00
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
dix: dixfonts: move closure structures into consumer source file
2026-04-28 14:39:41 +02:00
Fix typos
2026-04-19 12:32:26 +02:00
render: move over public SDK headers to include/
2026-02-12 17:43:44 +01:00
dix: Remove pScratchPixmap and other associated ABI changes
2022-12-30 01:32:25 +00:00
include: pixmapstr.h: inline PixmapBox() and fix signedness
2025-09-18 20:26:31 +02:00
present: move over public SDK header to include/
2026-02-12 16:21:20 +01:00
dix: privates: update docs on dixRegisterPrivateKey()
2025-10-29 11:45:04 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
Drop trailing whitespaces
2014-11-12 10:25:00 +10:00
xvmc: move over protocol version defines into xvmc.c
2025-02-06 23:29:10 +00:00
dix: unexport SetAccelerationProfile()
2024-03-09 18:01:52 +00:00
randr: don't ifdef on RANDR_10_INTERFACE anymore
2026-02-13 14:00:41 +01:00
Drop trailing whitespaces
2014-11-12 10:25:00 +10:00
include: regionstr.h: drop unused legacy macros
2025-11-12 15:39:50 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
Drop trailing whitespaces
2014-11-12 10:25:00 +10:00
randr: move over public SDK headers to include/
2026-02-12 15:35:58 +01:00
xfree86: dri: move over public SDK headers to include/
2026-02-12 18:28:35 +01:00
Revert "dix: unexport AttachOutputGPU() and DetachOutputGPU()"
2024-09-01 20:38:01 +00:00
include: scrnintstr.h: mark private area of ScreenRec
2026-05-08 13:58:15 +02:00
include: drop including dix-config.h
2026-02-10 11:48:39 +01:00
miext: shadow: move over public SDK header to include/
2026-02-12 14:39:55 +01:00
xfree86: shadowfb: move public SDK headers into include/
2026-02-13 10:11:07 +01:00
Xext: move over public SDK headers to include/
2026-02-12 19:00:42 +01:00
Xext: move over public SDK headers to include/
2026-02-12 19:00:42 +01:00
mi: move ValidateRec to mi_priv.h and rename to MiValidateRec
2026-02-10 18:27:41 +01:00
xfree86: int10: move public SDK headers to include/
2026-02-13 10:25:17 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
xfree86: vgahw: move over public SDK header to include/
2026-02-12 17:08:29 +01:00
include: drop including dix-config.h
2026-02-10 11:48:39 +01:00
glx: move over vndserver.h public SDK header to include/
2026-02-12 14:25:12 +01:00
fb: move over public SDK headers to include/
2026-02-12 14:39:31 +01:00
include: window.h: drop duplicate typedef of WindowPtr
2026-05-06 19:32:33 +02:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
xf86: mark wasset unused in xf86UnblockSIGIO() compatibility wrapper
2026-10-09 09:21:13 +02:00
xfree86: common: move public SDK headers to include/
2026-02-12 19:51:51 +01:00
xfree86: common: move public SDK headers to include/
2026-02-12 19:51:51 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
xf86: check return value of XF86_CRTC_CONFIG_PTR in xf86CompatOutput()
2026-03-16 13:14:07 +01:00
xfree86: ramdac: move over public SDK headers to include/
2026-02-13 11:40:38 +01:00
xfree86: ddc: move public SDK headers to include/
2026-02-12 19:18:54 +01:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
xfree86: i2c: move over public SDK headers to include/
2026-02-12 19:50:11 +01:00
xfree86: int10: move public SDK headers to include/
2026-02-13 10:25:17 +01:00
xfree86: modes: move public SDK headers to include/
2026-02-12 19:03:56 +01:00
Fix typos
2026-04-19 12:32:26 +02:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
include: dont include xorg-config.h
2026-02-13 14:00:33 +01:00
include: dont include xorg-config.h
2026-02-13 14:00:33 +01:00
treewide: fix typos
2026-03-16 13:11:07 +01:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
xfree86: modes: move public SDK headers to include/
2026-02-12 19:03:56 +01:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: new header for fundamental pointer types
2026-02-12 18:28:35 +01:00
include: fix missing includes of <X11/Xfuncproto.h>
2026-04-24 13:04:40 +02:00
Move to autoconf standard function name checks & defines
2011-12-05 14:32:45 -08:00
xkb: unexport XkbRF_VarDefsRec struct
2025-06-12 17:21:47 +02:00
Add docs for some internal methods
2026-03-16 13:20:45 +01:00
xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
2026-10-09 12:19:53 +02:00
include: xlibre_ptrtypes: protect from double declaration of ClientPtr
2026-04-30 14:39:39 +02:00
xfree86: move over public SDK headers to include/
2026-02-12 16:21:02 +01:00
include: fix warning on XNFvasprintf() prototype
2025-12-04 17:28:58 +01:00
Treewide: Fix typos
2026-03-16 13:11:07 +01:00
Remove "All rights reserved" from Oracle copyright notices
2023-02-25 09:40:41 -08:00
Xext: move over public SDK headers to include/
2026-02-12 19:00:42 +01:00
Xext: move over public SDK headers to include/
2026-02-12 19:00:42 +01:00
treewide: Pull DEFAULT_LOGDIR into dix-config.h
2026-03-18 14:09:52 +01:00
d9edf30a90