Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xwayland for openSUSE:Factory checked in at 2026-04-28 14:30:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xwayland (Old) and /work/SRC/openSUSE:Factory/.xwayland.new.11940 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xwayland" Tue Apr 28 14:30:07 2026 rev:49 rq:1349592 version:24.1.11 Changes: -------- --- /work/SRC/openSUSE:Factory/xwayland/xwayland.changes 2026-04-15 16:05:19.368854318 +0200 +++ /work/SRC/openSUSE:Factory/.xwayland.new.11940/xwayland.changes 2026-04-28 14:30:49.459584841 +0200 @@ -1,0 +2,20 @@ +Mon Apr 27 12:18:50 UTC 2026 - Stefan Dirsch <[email protected]> + +- Update to 24.1.11 +- This release addresses a number of regressions found in Xwayland 24.1.10: + * Avoids spurious focus changes with KDE when listening for mouse buttons + is enabled for legacy X11 application support + * Fix tablet tools not working anymore as "slave" devices + * Fix a crash when running some XTS tests + * Fix a crash in window damage handling caused a NULL pointer dereference +- supersedes the folloging security patches for CVE-2026-33999, + CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 + (bsc#1260922, bsc#1260923, bsc#1260924, bsc#1260925, bsc#1260926) + * bsc1260922_CVE-2026-33999_xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch + * bsc1260923_CVE-2026-34000_xkb-Fix-bounds-check-in-_CheckSetGeom.patch + * bsc1260924_CVE-2026-34001_miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch + * bsc1260925_CVE-2026-34002_0001-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch + * bsc1260925_CVE-2026-34002_0002-xkb-Add-more-_XkbCheckRequestBounds.patch + * bsc1260926_CVE-2026-34003_0001-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch + +------------------------------------------------------------------- Old: ---- bsc1260922_CVE-2026-33999_xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch bsc1260923_CVE-2026-34000_xkb-Fix-bounds-check-in-_CheckSetGeom.patch bsc1260924_CVE-2026-34001_miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch bsc1260925_CVE-2026-34002_0001-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch bsc1260925_CVE-2026-34002_0002-xkb-Add-more-_XkbCheckRequestBounds.patch bsc1260926_CVE-2026-34003_0001-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch xwayland-24.1.9.tar.xz xwayland-24.1.9.tar.xz.sig New: ---- xwayland-24.1.11.tar.xz xwayland-24.1.11.tar.xz.sig ----------(Old B)---------- Old: (bsc#1260922, bsc#1260923, bsc#1260924, bsc#1260925, bsc#1260926) * bsc1260922_CVE-2026-33999_xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch * bsc1260923_CVE-2026-34000_xkb-Fix-bounds-check-in-_CheckSetGeom.patch Old: * bsc1260922_CVE-2026-33999_xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch * bsc1260923_CVE-2026-34000_xkb-Fix-bounds-check-in-_CheckSetGeom.patch * bsc1260924_CVE-2026-34001_miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch Old: * bsc1260923_CVE-2026-34000_xkb-Fix-bounds-check-in-_CheckSetGeom.patch * bsc1260924_CVE-2026-34001_miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch * bsc1260925_CVE-2026-34002_0001-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch Old: * bsc1260924_CVE-2026-34001_miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch * bsc1260925_CVE-2026-34002_0001-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch * bsc1260925_CVE-2026-34002_0002-xkb-Add-more-_XkbCheckRequestBounds.patch Old: * bsc1260925_CVE-2026-34002_0001-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch * bsc1260925_CVE-2026-34002_0002-xkb-Add-more-_XkbCheckRequestBounds.patch * bsc1260926_CVE-2026-34003_0001-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch Old: * bsc1260925_CVE-2026-34002_0002-xkb-Add-more-_XkbCheckRequestBounds.patch * bsc1260926_CVE-2026-34003_0001-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xwayland.spec ++++++ --- /var/tmp/diff_new_pack.NOVTxb/_old 2026-04-28 14:30:50.079609853 +0200 +++ /var/tmp/diff_new_pack.NOVTxb/_new 2026-04-28 14:30:50.083610014 +0200 @@ -27,7 +27,7 @@ %endif Name: xwayland -Version: 24.1.9 +Version: 24.1.11 Release: 0 URL: http://xorg.freedesktop.org Summary: Xwayland Xserver @@ -38,13 +38,6 @@ Source2: xwayland.keyring Patch3: U_xwayland_Dont_run_key_behaviors_and_actions.patch -Patch1260922: bsc1260922_CVE-2026-33999_xkb-fix-buffer-re-use-in-_XkbSetCompatMap.patch -Patch1260923: bsc1260923_CVE-2026-34000_xkb-Fix-bounds-check-in-_CheckSetGeom.patch -Patch1260924: bsc1260924_CVE-2026-34001_miext-sync-Fix-use-after-free-in-miSyncTriggerFence.patch -Patch1260925: bsc1260925_CVE-2026-34002_0001-xkb-Fix-out-of-bounds-read-in-CheckModifierMap.patch -Patch1260926: bsc1260925_CVE-2026-34002_0002-xkb-Add-more-_XkbCheckRequestBounds.patch -Patch1260927: bsc1260926_CVE-2026-34003_0001-xkb-Add-additional-bound-checking-in-CheckKeyTypes.patch - BuildRequires: meson BuildRequires: ninja BuildRequires: pkgconfig ++++++ xwayland-24.1.9.tar.xz -> xwayland-24.1.11.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/COPYING new/xwayland-24.1.11/COPYING --- old/xwayland-24.1.9/COPYING 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/COPYING 2026-04-27 09:25:48.000000000 +0200 @@ -314,6 +314,11 @@ OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +Except as contained in this notice, the name of Silicon Graphics, Inc. +shall not be used in advertising or otherwise to promote the sale, use or +other dealings in this Software without prior written authorization from +Silicon Graphics, Inc. + Copyright (c) 1994, 1995 Hewlett-Packard Company @@ -1778,6 +1783,8 @@ USE OR OTHER DEALINGS IN THE SOFTWARE. +Author: Eamon Walsh <[email protected]> + Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that this permission notice appear in supporting documentation. This permission diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/SECURITY.md new/xwayland-24.1.11/SECURITY.md --- old/xwayland-24.1.9/SECURITY.md 1970-01-01 01:00:00.000000000 +0100 +++ new/xwayland-24.1.11/SECURITY.md 2026-04-27 09:25:48.000000000 +0200 @@ -0,0 +1,31 @@ +# Reporting Security Issues + +Please notify us of any security issues by sending mail to +<[email protected]>. + +See https://www.x.org/wiki/Development/Security/Organization/ +for more information about the X.Org security team. + +# Learning about Security Fixes + +X.Org announces security bugs and bug fix releases on the xorg-announce +mailing list. See the archives at https://lists.x.org/archives/xorg-announce/ +and see https://lists.x.org/mailman/listinfo/xorg-announce to subscribe. + +Security advisories are also listed on our wiki at +https://www.x.org/wiki/Development/Security/ and mailed to the +https://oss-security.openwall.org/wiki/mailing-lists/oss-security mailing list. + +# Security model and trust boundaries + +Xwayland is expected to run with only the privileges of the user who started +the server. It should not require direct access to any devices. + +Access control for which clients can connect to the X server is provided by +a number of mechanisms, see the Xsecurity(7) man page for details. Once a +client is authenticated via those mechanisms and has an active connection, +we do not consider it a security vulnerability for them to be able to take +any actions described in the X11 protocol or extension specifications, such +as changing monitor configurations or killing other clients, though we will +accept non-security bug reports for clients doing so in a manner or via +requests not documented in the protocol specs as doing those operations. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/Xext/panoramiX.c new/xwayland-24.1.11/Xext/panoramiX.c --- old/xwayland-24.1.9/Xext/panoramiX.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/Xext/panoramiX.c 2026-04-27 09:25:48.000000000 +0200 @@ -743,8 +743,8 @@ j = PanoramiXNumDepths; PanoramiXNumDepths++; - PanoramiXDepths = reallocarray(PanoramiXDepths, - PanoramiXNumDepths, sizeof(DepthRec)); + PanoramiXDepths = XNFreallocarray(PanoramiXDepths, + PanoramiXNumDepths, sizeof(DepthRec)); PanoramiXDepths[j].depth = pDepth->depth; PanoramiXDepths[j].numVids = 0; PanoramiXDepths[j].vids = NULL; @@ -816,11 +816,11 @@ for (i = 0; i < pScreen->numVisuals; i++) PanoramiXMaybeAddVisual(pVisual++); - root = malloc(sizeof(PanoramiXRes)); + root = XNFcallocarray(1, sizeof(PanoramiXRes)); root->type = XRT_WINDOW; - defmap = malloc(sizeof(PanoramiXRes)); + defmap = XNFcallocarray(1, sizeof(PanoramiXRes)); defmap->type = XRT_COLORMAP; - saver = malloc(sizeof(PanoramiXRes)); + saver = XNFcallocarray(1, sizeof(PanoramiXRes)); saver->type = XRT_WINDOW; FOR_NSCREENS(i) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/Xext/xf86bigfont.c new/xwayland-24.1.11/Xext/xf86bigfont.c --- old/xwayland-24.1.9/Xext/xf86bigfont.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/Xext/xf86bigfont.c 2026-04-27 09:25:48.000000000 +0200 @@ -58,6 +58,10 @@ #include <X11/X.h> #include <X11/Xproto.h> +#include <X11/extensions/xf86bigfproto.h> +#include <X11/fonts/fontstruct.h> +#include <X11/fonts/libxfont2.h> + #include "misc.h" #include "os.h" #include "dixstruct.h" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/dix/dixfonts.c new/xwayland-24.1.11/dix/dixfonts.c --- old/xwayland-24.1.9/dix/dixfonts.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/dix/dixfonts.c 2026-04-27 09:25:48.000000000 +0200 @@ -639,9 +639,8 @@ } if (err == FontNameAlias) { free(resolved); - resolved = malloc(resolvedlen + 1); - if (resolved) - memcpy(resolved, tmpname, resolvedlen + 1); + resolved = XNFalloc(resolvedlen + 1); + memcpy(resolved, tmpname, resolvedlen + 1); } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/dix/events.c new/xwayland-24.1.11/dix/events.c --- old/xwayland-24.1.9/dix/events.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/dix/events.c 2026-04-27 09:25:48.000000000 +0200 @@ -4735,7 +4735,9 @@ xKeymapEvent ke = { .type = KeymapNotify }; +#ifdef XACE ClientPtr client = grab ? rClient(grab) : wClient(pWin); +#endif int rc; rc = XaceHook(XACE_DEVICE_ACCESS, client, keybd, DixReadAccess); @@ -4846,7 +4848,9 @@ xKeymapEvent ke = { .type = KeymapNotify }; +#ifdef XACE ClientPtr client = wClient(pWin); +#endif int rc; rc = XaceHook(XACE_DEVICE_ACCESS, client, dev, DixReadAccess); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/dix/gc.c new/xwayland-24.1.11/dix/gc.c --- old/xwayland-24.1.9/dix/gc.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/dix/gc.c 2026-04-27 09:25:48.000000000 +0200 @@ -441,6 +441,7 @@ vals[i].val = pC32[i]; for (i = 0; i < ARRAY_SIZE(xidfields); ++i) { int offset, rc; + XID id; if (!(mask & xidfields[i].mask)) continue; @@ -449,11 +450,13 @@ vals[offset].ptr = NullPixmap; continue; } - rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val, + /* save the id, since dixLookupResourceByType overwrites &vals[offset] */ + id = vals[offset].val; + rc = dixLookupResourceByType(&vals[offset].ptr, id, xidfields[i].type, client, xidfields[i].access_mode); if (rc != Success) { - client->errorValue = vals[offset].val; + client->errorValue = id; return rc; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/glamor/glamor.c new/xwayland-24.1.11/glamor/glamor.c --- old/xwayland-24.1.9/glamor/glamor.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/glamor/glamor.c 2026-04-27 09:25:48.000000000 +0200 @@ -223,6 +223,9 @@ else pixmap = fbCreatePixmap(screen, 0, 0, depth, usage); + if (!pixmap) + return NullPixmap; + pixmap_priv = glamor_get_pixmap_private(pixmap); pixmap_priv->is_cbcr = (GLAMOR_CREATE_FORMAT_CBCR & usage) == GLAMOR_CREATE_FORMAT_CBCR; @@ -840,23 +843,25 @@ glamor_priv->saved_procs.bitmap_to_region = screen->BitmapToRegion; screen->BitmapToRegion = glamor_bitmap_to_region; - glamor_priv->saved_procs.composite = ps->Composite; - ps->Composite = glamor_composite; + if (ps) { + glamor_priv->saved_procs.composite = ps->Composite; + ps->Composite = glamor_composite; - glamor_priv->saved_procs.trapezoids = ps->Trapezoids; - ps->Trapezoids = glamor_trapezoids; + glamor_priv->saved_procs.trapezoids = ps->Trapezoids; + ps->Trapezoids = glamor_trapezoids; - glamor_priv->saved_procs.triangles = ps->Triangles; - ps->Triangles = glamor_triangles; + glamor_priv->saved_procs.triangles = ps->Triangles; + ps->Triangles = glamor_triangles; - glamor_priv->saved_procs.addtraps = ps->AddTraps; - ps->AddTraps = glamor_add_traps; + glamor_priv->saved_procs.addtraps = ps->AddTraps; + ps->AddTraps = glamor_add_traps; - glamor_priv->saved_procs.composite_rects = ps->CompositeRects; - ps->CompositeRects = glamor_composite_rectangles; + glamor_priv->saved_procs.composite_rects = ps->CompositeRects; + ps->CompositeRects = glamor_composite_rectangles; - glamor_priv->saved_procs.glyphs = ps->Glyphs; - ps->Glyphs = glamor_composite_glyphs; + glamor_priv->saved_procs.glyphs = ps->Glyphs; + ps->Glyphs = glamor_composite_glyphs; + } glamor_init_vbo(screen); @@ -923,11 +928,13 @@ screen->BitmapToRegion = glamor_priv->saved_procs.bitmap_to_region; screen->BlockHandler = glamor_priv->saved_procs.block_handler; - ps->Composite = glamor_priv->saved_procs.composite; - ps->Trapezoids = glamor_priv->saved_procs.trapezoids; - ps->Triangles = glamor_priv->saved_procs.triangles; - ps->CompositeRects = glamor_priv->saved_procs.composite_rects; - ps->Glyphs = glamor_priv->saved_procs.glyphs; + if (ps) { + ps->Composite = glamor_priv->saved_procs.composite; + ps->Trapezoids = glamor_priv->saved_procs.trapezoids; + ps->Triangles = glamor_priv->saved_procs.triangles; + ps->CompositeRects = glamor_priv->saved_procs.composite_rects; + ps->Glyphs = glamor_priv->saved_procs.glyphs; + } screen_pixmap = screen->GetScreenPixmap(screen); glamor_pixmap_destroy_fbo(screen_pixmap); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/glamor/glamor_core.c new/xwayland-24.1.11/glamor/glamor_core.c --- old/xwayland-24.1.9/glamor/glamor_core.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/glamor/glamor_core.c 2026-04-27 09:25:48.000000000 +0200 @@ -200,6 +200,8 @@ */ if (changes & GCTile) { if (!gc->tileIsPixel) { + assert(gc->tile.pixmap != NullPixmap); + glamor_pixmap_private *pixmap_priv = glamor_get_pixmap_private(gc->tile.pixmap); if ((!GLAMOR_PIXMAP_PRIV_HAS_FBO(pixmap_priv)) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/glamor/glamor_dash.c new/xwayland-24.1.11/glamor/glamor_dash.c --- old/xwayland-24.1.9/glamor/glamor_dash.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/glamor/glamor_dash.c 2026-04-27 09:25:48.000000000 +0200 @@ -149,7 +149,7 @@ dash_pixmap = glamor_get_dash_pixmap(gc); dash_priv = glamor_get_pixmap_private(dash_pixmap); - if (!GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv)) + if (!dash_priv || !GLAMOR_PIXMAP_PRIV_HAS_FBO(dash_priv)) goto bail; glamor_make_current(glamor_priv); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/glamor/glamor_egl.c new/xwayland-24.1.11/glamor/glamor_egl.c --- old/xwayland-24.1.9/glamor/glamor_egl.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/glamor/glamor_egl.c 2026-04-27 09:25:48.000000000 +0200 @@ -730,6 +730,7 @@ if (!eglQueryDmaBufModifiersEXT(glamor_egl->display, format, num, (EGLuint64KHR *) *modifiers, NULL, &num)) { free(*modifiers); + *modifiers = NULL; return FALSE; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/glamor/glamor_largepixmap.c new/xwayland-24.1.11/glamor/glamor_largepixmap.c --- old/xwayland-24.1.9/glamor/glamor_largepixmap.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/glamor/glamor_largepixmap.c 2026-04-27 09:25:48.000000000 +0200 @@ -77,6 +77,10 @@ clipped_regions = calloc((end_block_x - start_block_x + 1) * (end_block_y - start_block_y + 1), sizeof(*clipped_regions)); + if (clipped_regions == NULL) { + *n_region = 0; + return NULL; + } DEBUGF("startx %d starty %d endx %d endy %d \n", start_x, start_y, end_x, end_y); @@ -216,6 +220,11 @@ inner_block_w) * ((block_h + inner_block_h - 1) / inner_block_h), sizeof(*result_regions)); + if (result_regions == NULL) { + *n_region = 0; + free(clipped_regions); + return NULL; + } k = 0; for (i = 0; i < *n_region; i++) { x = box_array[clipped_regions[i].block_idx].x1; @@ -362,10 +371,14 @@ DEBUGRegionPrint(region); if (glamor_pixmap_priv_is_small(pixmap_priv)) { clipped_regions = calloc(1, sizeof(*clipped_regions)); - clipped_regions[0].region = RegionCreate(NULL, 1); - clipped_regions[0].block_idx = 0; - RegionCopy(clipped_regions[0].region, region); - *n_region = 1; + if (clipped_regions) { + clipped_regions[0].region = RegionCreate(NULL, 1); + clipped_regions[0].block_idx = 0; + RegionCopy(clipped_regions[0].region, region); + *n_region = 1; + } + else + *n_region = 0; return clipped_regions; } @@ -1172,6 +1185,8 @@ /* XXX self-copy... */ need_free_source_pixmap_priv = source_pixmap_priv; source_pixmap_priv = malloc(sizeof(*source_pixmap_priv)); + if (source_pixmap_priv == NULL) + return FALSE; *source_pixmap_priv = *need_free_source_pixmap_priv; need_free_source_pixmap_priv = source_pixmap_priv; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/glamor/glamor_render.c new/xwayland-24.1.11/glamor/glamor_render.c --- old/xwayland-24.1.9/glamor/glamor_render.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/glamor/glamor_render.c 2026-04-27 09:25:48.000000000 +0200 @@ -1573,7 +1573,7 @@ if (source && ((!source->pDrawable && (source->pSourcePict->type != SourcePictTypeSolidFill)) - || (source->pDrawable + || (source->pDrawable && source_pixmap && !GLAMOR_PIXMAP_PRIV_HAS_FBO(source_pixmap_priv) && (source_pixmap->drawable.width != width || source_pixmap->drawable.height != height)))) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/hw/xwayland/xwayland-input.c new/xwayland-24.1.11/hw/xwayland/xwayland-input.c --- old/xwayland-24.1.9/hw/xwayland/xwayland-input.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/hw/xwayland/xwayland-input.c 2026-04-27 09:25:48.000000000 +0200 @@ -24,6 +24,7 @@ * SOFTWARE. */ +#include <math.h> #include <xwayland-config.h> #include <linux/input.h> @@ -522,7 +523,9 @@ int sx, sy; int dx, dy; ScreenPtr pScreen = xwl_screen->screen; + xwl_seat->pointer_enter_count++; ValuatorMask mask; + DeviceEvent enter; /* There's a race here where if we create and then immediately * destroy a surface, we might end up in a state where the Wayland @@ -553,8 +556,10 @@ (*pScreen->SetCursorPosition) (dev, pScreen, dx + sx, dy + sy, TRUE); miPointerInvalidateSprite(master); + init_device_event(&enter, dev, currentTime.milliseconds, EVENT_SOURCE_FOCUS); + enter.type = ET_Enter; - CheckMotion(NULL, master); + CheckMotion(&enter, master); /* Ideally, X clients shouldn't see these button releases. When * the pointer leaves a window with buttons down, it means that @@ -613,6 +618,9 @@ Bool focus_lost = FALSE; xwl_screen->serial = serial; + BUG_WARN(xwl_seat->pointer_enter_count == 0); + if (xwl_seat->pointer_enter_count > 0) + xwl_seat->pointer_enter_count--; /* The pointer has left a known xwindow, save it for a possible match * in sprite_check_lost_focus() @@ -1916,7 +1924,10 @@ release_touch(xwl_seat); } - xwl_seat->xwl_screen->expecting_event--; + if (xwl_seat->caps_initialized == FALSE) { + xwl_seat->caps_initialized = TRUE; + xwl_seat->xwl_screen->expecting_event--; + } } static void @@ -1967,6 +1978,7 @@ wl_registry_bind(xwl_screen->registry, id, &wl_seat_interface, min(version, seat_version)); xwl_seat->id = id; + xwl_seat->caps_initialized = FALSE; xwl_cursor_init(&xwl_seat->cursor, xwl_seat->xwl_screen, xwl_seat_update_cursor); @@ -3183,6 +3195,7 @@ { DeviceIntPtr device, master; struct xwl_seat *xwl_seat; + Bool pointer_crossing; for (device = inputInfo.devices; device; device = device->next) { /* Ignore non-wayland devices */ @@ -3198,6 +3211,7 @@ if (!xwl_seat) return FALSE; + pointer_crossing = (xwl_seat->pointer_enter_count > 0); master = GetMaster(device, POINTER_OR_FLOAT); if (!master || !master->lastSlave) return FALSE; @@ -3220,7 +3234,7 @@ IsParent(xwl_seat->last_focus_window->toplevel, window))) return TRUE; - return FALSE; + return !pointer_crossing; } static WindowPtr @@ -3271,26 +3285,30 @@ { struct zwp_locked_pointer_v1 *locked_pointer = warp_emulator->locked_pointer; + struct xwl_window *focus_window; WindowPtr window; int sx, sy; if (!warp_emulator->locked_pointer) return; - if (!warp_emulator->xwl_seat->focus_window) + focus_window = warp_emulator->xwl_seat->focus_window; + if (!focus_window) return; - window = warp_emulator->xwl_seat->focus_window->toplevel; + window = focus_window->toplevel; if (x >= window->drawable.x || y >= window->drawable.y || x < (window->drawable.x + window->drawable.width) || y < (window->drawable.y + window->drawable.height)) { - sx = x - window->drawable.x; - sy = y - window->drawable.y; + sx = round((double) (x - window->drawable.x) / + focus_window->viewport_scale_x); + sy = round((double) (y - window->drawable.y) / + focus_window->viewport_scale_y); zwp_locked_pointer_v1_set_cursor_position_hint(locked_pointer, wl_fixed_from_int(sx), wl_fixed_from_int(sy)); - wl_surface_commit(warp_emulator->xwl_seat->focus_window->surface); + wl_surface_commit(focus_window->surface); } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/hw/xwayland/xwayland-input.h new/xwayland-24.1.11/hw/xwayland/xwayland-input.h --- old/xwayland-24.1.9/hw/xwayland/xwayland-input.h 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/hw/xwayland/xwayland-input.h 2026-04-27 09:25:48.000000000 +0200 @@ -76,6 +76,8 @@ struct xwl_window *tablet_focus_window; uint32_t id; uint32_t pointer_enter_serial; + uint8_t pointer_enter_count; + Bool caps_initialized; struct xorg_list link; CursorPtr x_cursor; OsTimerPtr x_cursor_timer; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/hw/xwayland/xwayland-screen.c new/xwayland-24.1.11/hw/xwayland/xwayland-screen.c --- old/xwayland-24.1.9/hw/xwayland/xwayland-screen.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/hw/xwayland/xwayland-screen.c 2026-04-27 09:25:48.000000000 +0200 @@ -181,6 +181,7 @@ xwl_window_update_property(xwl_window, rec); } +#ifdef XACE #define readOnlyPropertyAccessMask (DixReadAccess |\ DixGetAttrAccess |\ DixListPropAccess |\ @@ -207,6 +208,7 @@ } #undef readOnlyPropertyAccessMask +#endif /* XACE */ static void xwl_root_window_finalized_callback(CallbackListPtr *pcbl, @@ -237,7 +239,9 @@ xwl_dmabuf_feedback_destroy(&xwl_screen->default_feedback); #endif DeleteCallback(&PropertyStateCallback, xwl_property_callback, screen); +#ifdef XACE XaceDeleteCallback(XACE_PROPERTY_ACCESS, xwl_access_property_callback, screen); +#endif xorg_list_for_each_entry_safe(xwl_output, next_xwl_output, &xwl_screen->output_list, link) @@ -1168,7 +1172,9 @@ AddCallback(&PropertyStateCallback, xwl_property_callback, pScreen); AddCallback(&RootWindowFinalizeCallback, xwl_root_window_finalized_callback, pScreen); +#ifdef XACE XaceRegisterCallback(XACE_PROPERTY_ACCESS, xwl_access_property_callback, pScreen); +#endif xwl_screen_setup_custom_vector(xwl_screen); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/hw/xwayland/xwayland-window.c new/xwayland-24.1.11/hw/xwayland/xwayland-window.c --- old/xwayland-24.1.9/hw/xwayland/xwayland-window.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/hw/xwayland/xwayland-window.c 2026-04-27 09:25:48.000000000 +0200 @@ -295,10 +295,15 @@ static void damage_report(DamagePtr pDamage, RegionPtr pRegion, void *data) { - struct xwl_window *xwl_window = data; - struct xwl_screen *xwl_screen = xwl_window->xwl_screen; + WindowPtr window = data; + struct xwl_window *xwl_window = xwl_window_from_window(window); + ScreenPtr screen = window->drawable.pScreen; + struct xwl_screen *xwl_screen = xwl_screen_get(screen); PixmapPtr window_pixmap; + if (!xwl_window) + return; + if (xwl_window->surface_window_damage && RegionNotEmpty(pRegion)) { if (!RegionNotEmpty(xwl_window->surface_window_damage)) @@ -315,7 +320,7 @@ if (xorg_list_is_empty(&xwl_window->link_damage)) xorg_list_add(&xwl_window->link_damage, &xwl_screen->damage_window_list); - window_pixmap = xwl_screen->screen->GetWindowPixmap(xwl_window->surface_window); + window_pixmap = screen->GetWindowPixmap(xwl_window->surface_window); if (xwl_is_client_pixmap(window_pixmap)) xwl_screen->screen->DestroyPixmap(xwl_window_swap_pixmap(xwl_window, FALSE)); } @@ -326,38 +331,36 @@ } static Bool -register_damage(struct xwl_window *xwl_window) +register_damage(WindowPtr window) { - WindowPtr surface_window = xwl_window->surface_window; DamagePtr damage; damage = DamageCreate(damage_report, damage_destroy, DamageReportNonEmpty, - FALSE, surface_window->drawable.pScreen, xwl_window); + FALSE, window->drawable.pScreen, window); if (damage == NULL) { ErrorF("Failed creating damage\n"); return FALSE; } - DamageRegister(&surface_window->drawable, damage); - dixSetPrivate(&surface_window->devPrivates, &xwl_damage_private_key, damage); + DamageRegister(&window->drawable, damage); + dixSetPrivate(&window->devPrivates, &xwl_damage_private_key, damage); return TRUE; } static void -unregister_damage(struct xwl_window *xwl_window) +unregister_damage(WindowPtr window) { - WindowPtr surface_window = xwl_window->surface_window; DamagePtr damage; - damage = dixLookupPrivate(&surface_window->devPrivates, &xwl_damage_private_key); + damage = dixLookupPrivate(&window->devPrivates, &xwl_damage_private_key); if (!damage) return; DamageUnregister(damage); DamageDestroy(damage); - dixSetPrivate(&surface_window->devPrivates, &xwl_damage_private_key, NULL); + dixSetPrivate(&window->devPrivates, &xwl_damage_private_key, NULL); } static Bool @@ -1436,14 +1439,14 @@ if (window_damage) { RegionInit(&damage_region, NullBox, 1); RegionCopy(&damage_region, DamageRegion(window_damage)); - unregister_damage(xwl_window); + unregister_damage(xwl_window->surface_window); } if (surface_window->drawable.depth != xwl_window->surface_window->drawable.depth) xwl_window_buffers_dispose(xwl_window, FALSE); xwl_window->surface_window = surface_window; - register_damage(xwl_window); + register_damage(surface_window); if (window_damage) { RegionPtr new_region = DamageRegion(window_get_damage(surface_window)); @@ -1593,13 +1596,19 @@ } } + if (xwl_screen->rootless ? + (window->drawable.class == InputOutput && + window->parent == window->drawable.pScreen->root) : + !window->parent) { + if (!register_damage(window)) + return FALSE; + } + xwl_window = ensure_surface_for_window(window); - if (!xwl_window) + if (!xwl_window) { + unregister_damage(window); return FALSE; - - if (window == xwl_window->surface_window && - !window_get_damage(window)) - return register_damage(xwl_window); + } return TRUE; } @@ -1746,19 +1755,23 @@ { ScreenPtr screen = window->drawable.pScreen; struct xwl_screen *xwl_screen = xwl_screen_get(screen); - struct xwl_window *xwl_window = xwl_window_get(window); + struct xwl_window *xwl_window = xwl_window_from_window(window); Bool ret; - if (xwl_window) { - unregister_damage(xwl_window); - xwl_window_dispose(xwl_window); - } - screen->UnrealizeWindow = xwl_screen->UnrealizeWindow; ret = (*screen->UnrealizeWindow) (window); xwl_screen->UnrealizeWindow = screen->UnrealizeWindow; screen->UnrealizeWindow = xwl_unrealize_window; + if (xwl_window) { + if (window == xwl_window->toplevel) { + unregister_damage(window); + xwl_window_dispose(xwl_window); + } else if (window == xwl_window->surface_window) { + xwl_window_update_surface_window(xwl_window); + } + } + return ret; } @@ -1869,6 +1882,7 @@ ScreenPtr screen = window->drawable.pScreen; struct xwl_screen *xwl_screen = xwl_screen_get(screen); WindowPtr parent = window->parent; + ClientPtr current_client; Bool *is_wm_window; if (xwl_screen->ReparentWindow) { @@ -1878,8 +1892,10 @@ screen->ReparentWindow = xwl_reparent_window; } + current_client = GetCurrentClient(); if (!parent->parent || - GetCurrentClient()->index != xwl_screen->wm_client_id) + !current_client || + current_client->index != xwl_screen->wm_client_id) return; /* If the WM client reparents a window, mark the new parent as a WM window */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/meson.build new/xwayland-24.1.11/meson.build --- old/xwayland-24.1.9/meson.build 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/meson.build 2026-04-27 09:25:48.000000000 +0200 @@ -3,10 +3,10 @@ 'buildtype=debugoptimized', 'c_std=gnu99', ], - version: '24.1.9', + version: '24.1.11', meson_version: '>= 0.56.0', ) -release_date = '2025-10-28' +release_date = '2026-04-27' add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc']) cc = meson.get_compiler('c') @@ -273,7 +273,7 @@ sha1_dep = libsha1_dep endif elif t == 'libnettle' - nettle_dep = dependency('nettle', required: false) + nettle_dep = dependency('nettle', version: '>= 2.6', required: false) if nettle_dep.found() sha1_found = true sha1_dep = nettle_dep @@ -452,7 +452,7 @@ if get_option('xselinux') == 'true' build_xselinux = true else - build_xselinux = dep_selinux.found() and dep_audit.found() + build_xselinux = dep_selinux.found() and dep_audit.found() and build_xace endif if build_xselinux @@ -460,6 +460,10 @@ common_dep += dep_audit endif endif +if build_xselinux and not build_xace + error('cannot build SELinux extension without X-ACE') +endif + socket_dep = [] if host_machine.system() == 'windows' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/miext/sync/misync.c new/xwayland-24.1.11/miext/sync/misync.c --- old/xwayland-24.1.9/miext/sync/misync.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/miext/sync/misync.c 2026-04-27 09:25:48.000000000 +0200 @@ -131,16 +131,22 @@ void miSyncTriggerFence(SyncFence * pFence) { - SyncTriggerList *ptl, *pNext; + SyncTriggerList *ptl; + Bool triggered; pFence->funcs.SetTriggered(pFence); /* run through triggers to see if any fired */ - for (ptl = pFence->sync.pTriglist; ptl; ptl = pNext) { - pNext = ptl->next; - if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, 0)) - (*ptl->pTrigger->TriggerFired) (ptl->pTrigger); - } + do { + triggered = FALSE; + for (ptl = pFence->sync.pTriglist; ptl; ptl = ptl->next) { + if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, 0)) { + (*ptl->pTrigger->TriggerFired) (ptl->pTrigger); + triggered = TRUE; + break; + } + } + } while (triggered); } SyncScreenFuncsPtr diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/os/connection.c new/xwayland-24.1.11/os/connection.c --- old/xwayland-24.1.9/os/connection.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/os/connection.c 2026-04-27 09:25:48.000000000 +0200 @@ -281,6 +281,7 @@ int fd = _XSERVTransGetConnectionNumber(ListenTransConns[i]); ListenTransFds[i] = fd; + _XSERVTransSetOption(ListenTransConns[i], TRANS_CLOSEONEXEC, 0); SetNotifyFd(fd, EstablishNewConnections, X_NOTIFY_READ, NULL); if (!_XSERVTransIsLocal(ListenTransConns[i])) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/os/fmt.c new/xwayland-24.1.11/os/fmt.c --- old/xwayland-24.1.9/os/fmt.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/os/fmt.c 2026-04-27 09:25:48.000000000 +0200 @@ -16,12 +16,14 @@ void FormatInt64(int64_t num, char *string) { + uint64_t unum = num; + if (num < 0) { string[0] = '-'; - num *= -1; + unum = num * -1; string++; } - FormatUInt64(num, string); + FormatUInt64(unum, string); } /* Format a number into a string in a signal safe manner. The string should be diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/os/ospoll.c new/xwayland-24.1.11/os/ospoll.c --- old/xwayland-24.1.9/os/ospoll.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/os/ospoll.c 2026-04-27 09:25:48.000000000 +0200 @@ -24,6 +24,7 @@ #include <dix-config.h> #endif +#include <assert.h> #include <X11/X.h> #include <X11/Xproto.h> #include <stdlib.h> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/os/utils.c new/xwayland-24.1.11/os/utils.c --- old/xwayland-24.1.9/os/utils.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/os/utils.c 2026-04-27 09:25:48.000000000 +0200 @@ -1406,7 +1406,9 @@ iop = fopen(file, type); if (seteuid(euid) == -1) { - fclose(iop); + if (iop) { + fclose(iop); + } return NULL; } return iop; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/os/xsha1.c new/xwayland-24.1.11/os/xsha1.c --- old/xwayland-24.1.9/os/xsha1.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/os/xsha1.c 2026-04-27 09:25:48.000000000 +0200 @@ -155,7 +155,8 @@ #elif defined(HAVE_SHA1_IN_LIBNETTLE) /* Use libnettle for SHA1 */ -#include <nettle/sha.h> +#include <nettle/sha1.h> +#include <nettle/version.h> void * x_sha1_init(void) @@ -178,7 +179,11 @@ int x_sha1_final(void *ctx, unsigned char result[20]) { +#if NETTLE_VERSION_MAJOR < 4 sha1_digest(ctx, 20, result); +#else + sha1_digest(ctx, result); +#endif free(ctx); return 1; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/randr/rroutput.c new/xwayland-24.1.11/randr/rroutput.c --- old/xwayland-24.1.9/randr/rroutput.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/randr/rroutput.c 2026-04-27 09:25:48.000000000 +0200 @@ -374,6 +374,8 @@ { RROutputPtr output = (RROutputPtr) value; ScreenPtr pScreen = output->pScreen; + ScreenPtr primary; + rrScrPrivPtr primarysp; int m; if (pScreen) { @@ -394,6 +396,15 @@ if (pScrPriv->primaryOutput == output) pScrPriv->primaryOutput = NULL; + if (pScreen->isGPU) { + primary = pScreen->current_primary; + if (primary) { + primarysp = rrGetScrPriv(primary); + if (primarysp->primaryOutput == output) + primarysp->primaryOutput = NULL; + } + } + for (i = 0; i < pScrPriv->numOutputs; i++) { if (pScrPriv->outputs[i] == output) { memmove(pScrPriv->outputs + i, pScrPriv->outputs + i + 1, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/render/picture.c new/xwayland-24.1.11/render/picture.c --- old/xwayland-24.1.9/render/picture.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/render/picture.c 2026-04-27 09:25:48.000000000 +0200 @@ -913,6 +913,7 @@ initGradient(pPicture->pSourcePict, nStops, stops, colors, error); if (*error) { + free(pPicture->pSourcePict); free(pPicture); return 0; } @@ -958,6 +959,7 @@ initGradient(pPicture->pSourcePict, nStops, stops, colors, error); if (*error) { + free(pPicture->pSourcePict); free(pPicture); return 0; } @@ -996,6 +998,7 @@ initGradient(pPicture->pSourcePict, nStops, stops, colors, error); if (*error) { + free(pPicture->pSourcePict); free(pPicture); return 0; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/xkb/xkb.c new/xwayland-24.1.11/xkb/xkb.c --- old/xwayland-24.1.9/xkb/xkb.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/xkb/xkb.c 2026-04-27 09:25:48.000000000 +0200 @@ -1638,6 +1638,10 @@ for (i = 0; i < req->nTypes; i++) { unsigned width; + if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) { + *nMapsRtrn = _XkbErrCode3(0x0b, req->nTypes, i); + return 0; + } if (client->swapped && doswap) { swaps(&wire->virtualMods); } @@ -1663,7 +1667,18 @@ xkbModsWireDesc *preWire; mapWire = (xkbKTSetMapEntryWireDesc *) &wire[1]; + if (!_XkbCheckRequestBounds(client, req, mapWire, + &mapWire[wire->nMapEntries])) { + *nMapsRtrn = _XkbErrCode3(0x0c, i, wire->nMapEntries); + return 0; + } preWire = (xkbModsWireDesc *) &mapWire[wire->nMapEntries]; + if (wire->preserve && + !_XkbCheckRequestBounds(client, req, preWire, + &preWire[wire->nMapEntries])) { + *nMapsRtrn = _XkbErrCode3(0x0d, i, wire->nMapEntries); + return 0; + } for (n = 0; n < wire->nMapEntries; n++) { if (client->swapped && doswap) { swaps(&mapWire[n].virtualMods); @@ -1736,6 +1751,11 @@ KeySym *pSyms; register unsigned nG; + /* Check we received enough data to read the next xkbSymMapWireDesc */ + if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) { + *errorRtrn = _XkbErrCode3(0x18, i + req->firstKeySym, i); + return 0; + } if (client->swapped && doswap) { swaps(&wire->nSyms); } @@ -1774,6 +1794,12 @@ return 0; } pSyms = (KeySym *) &wire[1]; + if (wire->nSyms != 0) { + if (!_XkbCheckRequestBounds(client, req, pSyms, &pSyms[wire->nSyms])) { + *errorRtrn = _XkbErrCode3(0x19, i + req->firstKeySym, wire->nSyms); + return 0; + } + } wire = (xkbSymMapWireDesc *) &pSyms[wire->nSyms]; } @@ -1797,11 +1823,12 @@ } static int -CheckKeyActions(XkbDescPtr xkb, - xkbSetMapReq * req, - int nTypes, - CARD8 *mapWidths, - CARD16 *symsPerKey, CARD8 **wireRtrn, int *nActsRtrn) +CheckKeyActions(ClientPtr client, + XkbDescPtr xkb, + xkbSetMapReq * req, + int nTypes, + CARD8 *mapWidths, + CARD16 *symsPerKey, CARD8 **wireRtrn, int *nActsRtrn) { int nActs; CARD8 *wire = *wireRtrn; @@ -1812,6 +1839,11 @@ CHK_REQ_KEY_RANGE2(0x21, req->firstKeyAct, req->nKeyActs, req, (*nActsRtrn), 0); for (nActs = i = 0; i < req->nKeyActs; i++) { + /* Check we received enough data to read the next byte on the wire */ + if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) { + *nActsRtrn = _XkbErrCode3(0x24, i + req->firstKeyAct, i); + return 0; + } if (wire[0] != 0) { if (wire[0] == symsPerKey[i + req->firstKeyAct]) nActs += wire[0]; @@ -1830,7 +1862,8 @@ } static int -CheckKeyBehaviors(XkbDescPtr xkb, +CheckKeyBehaviors(ClientPtr client, + XkbDescPtr xkb, xkbSetMapReq * req, xkbBehaviorWireDesc ** wireRtrn, int *errorRtrn) { @@ -1856,6 +1889,11 @@ } for (i = 0; i < req->totalKeyBehaviors; i++, wire++) { + /* Check we received enough data to read the next behavior */ + if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) { + *errorRtrn = _XkbErrCode3(0x36, first, i); + return 0; + } if ((wire->key < first) || (wire->key > last)) { *errorRtrn = _XkbErrCode4(0x33, first, last, wire->key); return 0; @@ -1881,7 +1919,8 @@ } static int -CheckVirtualMods(XkbDescRec * xkb, +CheckVirtualMods(ClientPtr client, + XkbDescRec * xkb, xkbSetMapReq * req, CARD8 **wireRtrn, int *errorRtrn) { register CARD8 *wire = *wireRtrn; @@ -1893,12 +1932,18 @@ if (req->virtualMods & bit) nMods++; } + /* Check we received enough data for the number of virtual mods expected */ + if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbPaddedSize(nMods))) { + *errorRtrn = _XkbErrCode3(0x37, nMods, i); + return 0; + } *wireRtrn = (wire + XkbPaddedSize(nMods)); return 1; } static int -CheckKeyExplicit(XkbDescPtr xkb, +CheckKeyExplicit(ClientPtr client, + XkbDescPtr xkb, xkbSetMapReq * req, CARD8 **wireRtrn, int *errorRtrn) { register CARD8 *wire = *wireRtrn; @@ -1924,6 +1969,11 @@ } start = wire; for (i = 0; i < req->totalKeyExplicit; i++, wire += 2) { + /* Check we received enough data to read the next two bytes */ + if (!_XkbCheckRequestBounds(client, req, wire, wire + 2)) { + *errorRtrn = _XkbErrCode4(0x54, first, last, i); + return 0; + } if ((wire[0] < first) || (wire[0] > last)) { *errorRtrn = _XkbErrCode4(0x53, first, last, wire[0]); return 0; @@ -1939,8 +1989,8 @@ } static int -CheckModifierMap(XkbDescPtr xkb, xkbSetMapReq * req, CARD8 **wireRtrn, - int *errRtrn) +CheckModifierMap(ClientPtr client, XkbDescPtr xkb, xkbSetMapReq * req, + CARD8 **wireRtrn, int *errRtrn) { register CARD8 *wire = *wireRtrn; CARD8 *start; @@ -1964,6 +2014,10 @@ } start = wire; for (i = 0; i < req->totalModMapKeys; i++, wire += 2) { + if (!_XkbCheckRequestBounds(client, req, wire, wire + 2)) { + *errRtrn = _XkbErrCode3(0x64, req->totalModMapKeys, i); + return 0; + } if ((wire[0] < first) || (wire[0] > last)) { *errRtrn = _XkbErrCode4(0x63, first, last, wire[0]); return 0; @@ -1975,7 +2029,8 @@ } static int -CheckVirtualModMap(XkbDescPtr xkb, +CheckVirtualModMap(ClientPtr client, + XkbDescPtr xkb, xkbSetMapReq * req, xkbVModMapWireDesc ** wireRtrn, int *errRtrn) { @@ -1999,6 +2054,11 @@ return 0; } for (i = 0; i < req->totalVModMapKeys; i++, wire++) { + /* Check we received enough data to read the next virtual mod map key */ + if (!_XkbCheckRequestBounds(client, req, wire, wire + 1)) { + *errRtrn = _XkbErrCode3(0x74, first, i); + return 0; + } if ((wire->key < first) || (wire->key > last)) { *errRtrn = _XkbErrCode4(0x73, first, last, wire->key); return 0; @@ -2542,7 +2602,7 @@ } if ((req->present & XkbKeyActionsMask) && - (!CheckKeyActions(xkb, req, nTypes, mapWidths, symsPerKey, + (!CheckKeyActions(client, xkb, req, nTypes, mapWidths, symsPerKey, (CARD8 **) &values, &nActions))) { client->errorValue = nActions; return BadValue; @@ -2550,29 +2610,29 @@ if ((req->present & XkbKeyBehaviorsMask) && (!CheckKeyBehaviors - (xkb, req, (xkbBehaviorWireDesc **) &values, &error))) { + (client, xkb, req, (xkbBehaviorWireDesc **) &values, &error))) { client->errorValue = error; return BadValue; } if ((req->present & XkbVirtualModsMask) && - (!CheckVirtualMods(xkb, req, (CARD8 **) &values, &error))) { + (!CheckVirtualMods(client, xkb, req, (CARD8 **) &values, &error))) { client->errorValue = error; return BadValue; } if ((req->present & XkbExplicitComponentsMask) && - (!CheckKeyExplicit(xkb, req, (CARD8 **) &values, &error))) { + (!CheckKeyExplicit(client, xkb, req, (CARD8 **) &values, &error))) { client->errorValue = error; return BadValue; } if ((req->present & XkbModifierMapMask) && - (!CheckModifierMap(xkb, req, (CARD8 **) &values, &error))) { + (!CheckModifierMap(client, xkb, req, (CARD8 **) &values, &error))) { client->errorValue = error; return BadValue; } if ((req->present & XkbVirtualModMapMask) && (!CheckVirtualModMap - (xkb, req, (xkbVModMapWireDesc **) &values, &error))) { + (client, xkb, req, (xkbVModMapWireDesc **) &values, &error))) { client->errorValue = error; return BadValue; } @@ -3002,7 +3062,7 @@ return BadAlloc; } } - else if (req->truncateSI) { + else if (req->truncateSI || req->firstSI + req->nSI > compat->num_si) { compat->num_si = req->firstSI + req->nSI; } sym = &compat->sym_interpret[req->firstSI]; @@ -3947,7 +4007,8 @@ register CARD32 *atm; for (i = 0; i < rep->nTypes; i++, type++) { - *desc++ = type->num_levels; + /* Either no name or all of them, even empty ones */ + *desc++ = (type->level_names) ? type->num_levels : 0; } desc += XkbPaddedSize(rep->nTypes) - rep->nTypes; @@ -5601,7 +5662,7 @@ } for (i = 0; i < req->nKeyAliases; i++) { - if (!_XkbCheckRequestBounds(client, req, wire, wire + XkbKeyNameLength)) + if (!_XkbCheckRequestBounds(client, req, wire, wire + 2 * XkbKeyNameLength)) return BadLength; if (XkbAddGeomKeyAlias(geom, &wire[XkbKeyNameLength], wire) == NULL) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/xkb/xkbActions.c new/xwayland-24.1.11/xkb/xkbActions.c --- old/xwayland-24.1.9/xkb/xkbActions.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/xkb/xkbActions.c 2026-04-27 09:25:48.000000000 +0200 @@ -1233,6 +1233,12 @@ dev->key->xkbInfo->state.locked_mods = master->key->xkbInfo->state.locked_mods; + dev->key->xkbInfo->state.locked_group = + master->key->xkbInfo->state.locked_group; + dev->key->xkbInfo->state.latched_mods = + master->key->xkbInfo->state.latched_mods; + dev->key->xkbInfo->state.latched_group = + master->key->xkbInfo->state.latched_group; _XkbApplyState(dev, genStateNotify, evtype, key); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.9/xkb/xkbUtils.c new/xwayland-24.1.11/xkb/xkbUtils.c --- old/xwayland-24.1.9/xkb/xkbUtils.c 2025-10-28 14:27:03.000000000 +0100 +++ new/xwayland-24.1.11/xkb/xkbUtils.c 2026-04-27 09:25:48.000000000 +0200 @@ -1044,7 +1044,7 @@ if (dtype->num_levels && dtype->level_names && i < dst->map->num_types) free(dtype->level_names); - dtype->num_levels = 0; + dtype->num_levels = stype->num_levels; dtype->level_names = NULL; }
