Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xwayland for openSUSE:Factory checked in at 2026-07-08 17:35:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xwayland (Old) and /work/SRC/openSUSE:Factory/.xwayland.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xwayland" Wed Jul 8 17:35:29 2026 rev:51 rq:1364437 version:24.1.12 Changes: -------- --- /work/SRC/openSUSE:Factory/xwayland/xwayland.changes 2026-06-02 19:47:15.628983672 +0200 +++ /work/SRC/openSUSE:Factory/.xwayland.new.1982/xwayland.changes 2026-07-08 17:37:29.887485030 +0200 @@ -1,0 +2,38 @@ +Wed Jul 8 08:22:16 UTC 2026 - Stefan Dirsch <[email protected]> + +- bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch + * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999, bsc#1268893) +- bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch + * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-55999, bsc#1268893) +- bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch + * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000, bsc#1268894) + +------------------------------------------------------------------- +Mon Jul 6 09:51:41 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 24.1.12: + * This release contains the fixes for the issues reported in this + security advisory: + https://lists.x.org/archives/xorg-announce/2026-June/003702.html + - Font Alias Stack-based Buffer Overflow + - XSYNC Use-After-Free in miSyncDestroyFence() + - XKB Key Types Stack-based Buffer Overflow + - XKB SetMap Request Stack-based Buffer Overflow + - XSYNC Use-After-Free in FreeCounter() + - XSYNC Use-After-Free in SyncChangeCounter() + - GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write + - CreateSaverWindow Use-After-Free Information Disclosure + * Additionally, it contains a number of other various fixes from + the stable xwayland-24.1 branch. +- Rebase U_xwayland_Dont_run_key_behaviors_and_actions.patch with + quilt. +- Drop patches fixed upstream: + * bsc1266294_CVE-2026-XXXX1_0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch + * bsc1266295_CVE-2026-XXXX2_0001-sync-fix-deletion-of-counters-and-fences.patch + * bsc1266296_CVE-2026-XXXX3_0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch + * bsc1266297_CVE-2026-XXXX4_0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch + * bsc1266299_CVE-2026-XXXX6_0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch + * bsc1266300_CVE-2026-XXXX7_0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch + * bsc1266301_CVE-2026-XXXX8_0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch + +------------------------------------------------------------------- Old: ---- bsc1266294_CVE-2026-XXXX1_0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch bsc1266295_CVE-2026-XXXX2_0001-sync-fix-deletion-of-counters-and-fences.patch bsc1266296_CVE-2026-XXXX3_0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch bsc1266297_CVE-2026-XXXX4_0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch bsc1266299_CVE-2026-XXXX6_0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch bsc1266300_CVE-2026-XXXX7_0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch bsc1266301_CVE-2026-XXXX8_0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch xwayland-24.1.11.tar.xz xwayland-24.1.11.tar.xz.sig New: ---- bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch xwayland-24.1.12.tar.xz xwayland-24.1.12.tar.xz.sig ----------(Old B)---------- Old:- Drop patches fixed upstream: * bsc1266294_CVE-2026-XXXX1_0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch * bsc1266295_CVE-2026-XXXX2_0001-sync-fix-deletion-of-counters-and-fences.patch Old: * bsc1266294_CVE-2026-XXXX1_0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch * bsc1266295_CVE-2026-XXXX2_0001-sync-fix-deletion-of-counters-and-fences.patch * bsc1266296_CVE-2026-XXXX3_0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch Old: * bsc1266295_CVE-2026-XXXX2_0001-sync-fix-deletion-of-counters-and-fences.patch * bsc1266296_CVE-2026-XXXX3_0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch * bsc1266297_CVE-2026-XXXX4_0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch Old: * bsc1266296_CVE-2026-XXXX3_0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch * bsc1266297_CVE-2026-XXXX4_0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch * bsc1266299_CVE-2026-XXXX6_0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch Old: * bsc1266297_CVE-2026-XXXX4_0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch * bsc1266299_CVE-2026-XXXX6_0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch * bsc1266300_CVE-2026-XXXX7_0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch Old: * bsc1266299_CVE-2026-XXXX6_0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch * bsc1266300_CVE-2026-XXXX7_0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch * bsc1266301_CVE-2026-XXXX8_0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch Old: * bsc1266300_CVE-2026-XXXX7_0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch * bsc1266301_CVE-2026-XXXX8_0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch ----------(Old E)---------- ----------(New B)---------- New: - bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999, bsc#1268893) New: * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999, bsc#1268893) - bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-55999, bsc#1268893) New: * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-55999, bsc#1268893) - bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000, bsc#1268894) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xwayland.spec ++++++ --- /var/tmp/diff_new_pack.C8jGCL/_old 2026-07-08 17:37:30.827517791 +0200 +++ /var/tmp/diff_new_pack.C8jGCL/_new 2026-07-08 17:37:30.831517930 +0200 @@ -27,7 +27,7 @@ %endif Name: xwayland -Version: 24.1.11 +Version: 24.1.12 Release: 0 URL: http://xorg.freedesktop.org Summary: Xwayland Xserver @@ -37,13 +37,10 @@ Source1: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig Source2: xwayland.keyring Patch3: U_xwayland_Dont_run_key_behaviors_and_actions.patch -Patch1266294: bsc1266294_CVE-2026-XXXX1_0007-dix-increase-XLFDMAXFONTNAMELEN-to-match-libXfont2-s.patch -Patch1266295: bsc1266295_CVE-2026-XXXX2_0001-sync-fix-deletion-of-counters-and-fences.patch -Patch1266296: bsc1266296_CVE-2026-XXXX3_0003-xkb-reject-key-types-with-num_levels-exceeding-XkbMa.patch -Patch1266297: bsc1266297_CVE-2026-XXXX4_0004-xkb-clamp-nMaps-to-mapWidths-buffer-size-in-CheckKey.patch -Patch1266299: bsc1266299_CVE-2026-XXXX6_0002-sync-restart-trigger-list-iteration-in-SyncChangeCou.patch -Patch1266300: bsc1266300_CVE-2026-XXXX7_0005-glx-fix-reversed-length-check-in-ChangeDrawableAttri.patch -Patch1266301: bsc1266301_CVE-2026-XXXX8_0006-saver-re-fetch-screen-private-after-CheckScreenPriva.patch +Patch1268893: bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch +Patch1268894: bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch +Patch1268895: bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch + BuildRequires: meson BuildRequires: ninja BuildRequires: pkgconfig ++++++ U_xwayland_Dont_run_key_behaviors_and_actions.patch ++++++ --- /var/tmp/diff_new_pack.C8jGCL/_old 2026-07-08 17:37:30.851518627 +0200 +++ /var/tmp/diff_new_pack.C8jGCL/_new 2026-07-08 17:37:30.855518767 +0200 @@ -46,11 +46,11 @@ xkb/xkbPrKeyEv.c | 2 +- 4 files changed, 14 insertions(+), 6 deletions(-) -Index: xwayland-24.1.9/hw/xwayland/xwayland-input.c +Index: xwayland-24.1.12/hw/xwayland/xwayland-input.c =================================================================== ---- xwayland-24.1.9.orig/hw/xwayland/xwayland-input.c -+++ xwayland-24.1.9/hw/xwayland/xwayland-input.c -@@ -1284,11 +1284,12 @@ keyboard_handle_modifiers(void *data, st +--- xwayland-24.1.12.orig/hw/xwayland/xwayland-input.c ++++ xwayland-24.1.12/hw/xwayland/xwayland-input.c +@@ -1292,11 +1292,12 @@ keyboard_handle_modifiers(void *data, st old_state = dev->key->xkbInfo->state; new_state = &dev->key->xkbInfo->state; @@ -65,7 +65,7 @@ XkbComputeDerivedState(dev->key->xkbInfo); -@@ -1680,6 +1681,7 @@ add_device(struct xwl_seat *xwl_seat, +@@ -1688,6 +1689,7 @@ add_device(struct xwl_seat *xwl_seat, dev->public.devicePrivate = xwl_seat; dev->type = SLAVE; dev->spriteInfo->spriteOwner = FALSE; @@ -73,7 +73,7 @@ return dev; } -@@ -3601,6 +3603,7 @@ InitInput(int argc, char *argv[]) +@@ -3619,6 +3621,7 @@ InitInput(int argc, char *argv[]) mieqInit(); @@ -81,10 +81,10 @@ xwl_screen->input_registry = wl_display_get_registry(xwl_screen->display); wl_registry_add_listener(xwl_screen->input_registry, &input_listener, xwl_screen); -Index: xwayland-24.1.9/include/inputstr.h +Index: xwayland-24.1.12/include/inputstr.h =================================================================== ---- xwayland-24.1.9.orig/include/inputstr.h -+++ xwayland-24.1.9/include/inputstr.h +--- xwayland-24.1.12.orig/include/inputstr.h ++++ xwayland-24.1.12/include/inputstr.h @@ -631,6 +631,8 @@ typedef struct _DeviceIntRec { DeviceSendEventsProc sendEventsProc; @@ -94,11 +94,11 @@ } DeviceIntRec; typedef struct { -Index: xwayland-24.1.9/xkb/xkbActions.c +Index: xwayland-24.1.12/xkb/xkbActions.c =================================================================== ---- xwayland-24.1.9.orig/xkb/xkbActions.c -+++ xwayland-24.1.9/xkb/xkbActions.c -@@ -1368,9 +1368,12 @@ XkbHandleActions(DeviceIntPtr dev, Devic +--- xwayland-24.1.12.orig/xkb/xkbActions.c ++++ xwayland-24.1.12/xkb/xkbActions.c +@@ -1374,9 +1374,12 @@ XkbHandleActions(DeviceIntPtr dev, Devic (event->type == ET_ButtonPress)); if (pressEvent) { @@ -114,10 +114,10 @@ act = XkbGetButtonAction(kbd, dev, key); key |= BTN_ACT_FLAG; } -Index: xwayland-24.1.9/xkb/xkbPrKeyEv.c +Index: xwayland-24.1.12/xkb/xkbPrKeyEv.c =================================================================== ---- xwayland-24.1.9.orig/xkb/xkbPrKeyEv.c -+++ xwayland-24.1.9/xkb/xkbPrKeyEv.c +--- xwayland-24.1.12.orig/xkb/xkbPrKeyEv.c ++++ xwayland-24.1.12/xkb/xkbPrKeyEv.c @@ -68,7 +68,7 @@ XkbProcessKeyboardEvent(DeviceEvent *eve /* do anything to implement the behavior, but it *does* report that */ /* key is hardwired */ ++++++ bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch ++++++ @@ -, +, @@ dimensions --- fb/fbglyph.c | 4 +- glamor/glamor_glyphblt.c | 2 +- mi/miglblt.c | 2 +- test/pyxtest/meson.build | 1 + test/pyxtest/test_fb.py | 176 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 181 insertions(+), 4 deletions(-) create mode 100644 test/pyxtest/test_fb.py --- a/fb/fbglyph.c +++ a/fb/fbglyph.c @@ -95,7 +95,7 @@ fbPolyGlyphBlt(DrawablePtr pDrawable, pglyph = FONTGLYPHBITS(pglyphBase, pci); gWidth = GLYPHWIDTHPIXELS(pci); gHeight = GLYPHHEIGHTPIXELS(pci); - if (gWidth && gHeight) { + if (gWidth > 0 && gHeight > 0) { gx = x + pci->metrics.leftSideBearing; gy = y - pci->metrics.ascent; if (glyph && gWidth <= sizeof(FbStip) * 8 && @@ -197,7 +197,7 @@ fbImageGlyphBlt(DrawablePtr pDrawable, pglyph = FONTGLYPHBITS(pglyphBase, pci); gWidth = GLYPHWIDTHPIXELS(pci); gHeight = GLYPHHEIGHTPIXELS(pci); - if (gWidth && gHeight) { + if (gWidth > 0 && gHeight > 0) { gx = x + pci->metrics.leftSideBearing; gy = y - pci->metrics.ascent; if (glyph && gWidth <= sizeof(FbStip) * 8 && --- a/glamor/glamor_glyphblt.c +++ a/glamor/glamor_glyphblt.c @@ -90,7 +90,7 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc, int h = GLYPHHEIGHTPIXELS(charinfo); uint8_t *glyphbits = FONTGLYPHBITS(NULL, charinfo); - if (w && h) { + if (w > 0 && h > 0) { int glyph_x = x + charinfo->metrics.leftSideBearing; int glyph_y = y - charinfo->metrics.ascent; int glyph_stride = GLYPHWIDTHBYTESPADDED(charinfo); --- a/mi/miglblt.c +++ a/mi/miglblt.c @@ -143,7 +143,7 @@ miPolyGlyphBlt(DrawablePtr pDrawable, GC * pGC, int x, int y, unsigned int nglyp pglyph = FONTGLYPHBITS(pglyphBase, pci); gWidth = GLYPHWIDTHPIXELS(pci); gHeight = GLYPHHEIGHTPIXELS(pci); - if (gWidth && gHeight) { + if (gWidth > 0 && gHeight > 0) { nbyGlyphWidth = GLYPHWIDTHBYTESPADDED(pci); nbyPadGlyph = BitmapBytePad(gWidth); -- ++++++ bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch ++++++ --- a/glamor/glamor_font.c +++ a/glamor/glamor_font.c @@ -77,6 +77,9 @@ glamor_font_get(ScreenPtr screen, FontPtr font) glyph_width_pixels = font->info.maxbounds.rightSideBearing - font->info.minbounds.leftSideBearing; glyph_height = font->info.maxbounds.ascent + font->info.maxbounds.descent; + if (glyph_width_pixels <= 0 || glyph_height <= 0) + return NULL; + glyph_width_bytes = (glyph_width_pixels + 7) >> 3; glamor_font->glyph_width_pixels = glyph_width_pixels; @@ -136,7 +139,28 @@ glamor_font_get(ScreenPtr screen, FontPtr font) if (count) { char *dst; char *src = glyph->bits; - unsigned y; + int gw = GLYPHWIDTHBYTES(glyph); + int gh = GLYPHHEIGHTPIXELS(glyph); + + /* Reject fonts where any per-glyph metric is negative + * or exceeds the atlas slot size derived from maxbounds. + * The PCF parser in libXfont2 does not recompute + * maxbounds from per-glyph data, so a crafted PCF file + * can violate the maxbounds invariant. + * + * gw is passed as size_t to memcpy and a negative value + * would thus result in OOB access. + * + * Returning NULL makes glamor fall back to software + * rendering. + */ + if (gw < 0 || gh < 0 || + gw > glyph_width_bytes || gh > glyph_height) { + glDeleteTextures(1, &glamor_font->texture_id); + glamor_font->texture_id = 0; + free(bits); + return NULL; + } dst = bits; /* get offset of start of first row */ @@ -145,8 +169,8 @@ glamor_font_get(ScreenPtr screen, FontPtr font) dst += (row & 1) ? glamor_font->row_width : 0; dst += col * glyph_width_bytes; - for (y = 0; y < GLYPHHEIGHTPIXELS(glyph); y++) { - memcpy(dst, src, GLYPHWIDTHBYTES(glyph)); + for (int y = 0; y < gh; y++) { + memcpy(dst, src, gw); dst += overall_width; src += GLYPHWIDTHBYTESPADDED(glyph); } ++++++ bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch ++++++ diff --git a/glx/vndcmds.c b/glx/vndcmds.c index cb3732d2aa..97a6b685e9 100644 --- a/glx/vndcmds.c +++ b/glx/vndcmds.c @@ -256,6 +256,11 @@ static int CommonMakeCurrent(ClientPtr client, if (ret != Success) { return ret; } + // Free the old tag before calling CommonMakeNewCurrent(), + // which may call GlxAllocContextTag() and realloc the + // contextTags array, invalidating the oldTag pointer. + GlxFreeContextTag(oldTag); + oldTag = NULL; } if (newVendor != NULL) { @@ -266,9 +271,6 @@ static int CommonMakeCurrent(ClientPtr client, } else { reply.contextTag = 0; } - - GlxFreeContextTag(oldTag); - oldTag = NULL; } reply.contextTag = GlxCheckSwap(client, reply.contextTag); ++++++ xwayland-24.1.11.tar.xz -> xwayland-24.1.12.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/Xext/saver.c new/xwayland-24.1.12/Xext/saver.c --- old/xwayland-24.1.11/Xext/saver.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/Xext/saver.c 2026-06-02 02:09:01.000000000 +0200 @@ -348,6 +348,9 @@ dixSaveScreens(serverClient, SCREEN_SAVER_FORCER, ScreenSaverActive); } CheckScreenPrivate(pScreen); + /* CheckScreenPrivate may have freed pPriv (same pattern as + * CreateSaverWindow fix for ZDI-CAN-30168). */ + pPriv = NULL; return TRUE; } @@ -479,6 +482,8 @@ UninstallSaverColormap(pScreen); pPriv->hasWindow = FALSE; CheckScreenPrivate(pScreen); + /* Re-fetch pPriv since CheckScreenPrivate may have freed it */ + pPriv = GetScreenPrivate(pScreen); } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/Xext/sync.c new/xwayland-24.1.12/Xext/sync.c --- old/xwayland-24.1.11/Xext/sync.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/Xext/sync.c 2026-06-02 02:09:01.000000000 +0200 @@ -721,8 +721,29 @@ /* run through triggers to see if any become true */ for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) { pnext = ptl->next; - if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval)) + if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval)) { (*ptl->pTrigger->TriggerFired) (ptl->pTrigger); + /* TriggerFired may have called SyncDeleteTriggerFromSyncObject + * for sibling triggers in the same Await group, freeing their + * trigger list nodes - potentially including pnext. Verify + * pnext is still on the counter's trigger list; if not, + * restart from the list head. + * + * Unlike miSyncTriggerFence() we cannot use a do/while + * restart loop here: counter trigger lists may contain alarm + * triggers which are not removed after firing and would cause + * an infinite loop when delta is 0. + */ + if (pnext) { + SyncTriggerList *tmp; + for (tmp = pCounter->sync.pTriglist; tmp; tmp = tmp->next) { + if (tmp == pnext) + break; + } + if (!tmp) + pnext = pCounter->sync.pTriglist; + } + } } if (IsSystemCounter(pCounter)) { @@ -1163,9 +1184,12 @@ SyncTriggerList *ptl, *pnext; /* tell all the counter's triggers that counter has been destroyed */ - for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) { - (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger); - pnext = ptl->next; + nt_list_for_each_entry_safe(ptl, pnext, pCounter->sync.pTriglist, next) { + /* Remove it from the list first so CounterDestroyed + * callbacks have a valid list to iterate */ + pCounter->sync.pTriglist = pnext; + if (ptl->pTrigger) + (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger); free(ptl); /* destroy the trigger list as we go */ } if (IsSystemCounter(pCounter)) { @@ -1197,13 +1221,28 @@ for (numwaits = pAwaitUnion->header.num_waitconditions; numwaits; numwaits--, pAwait++) { - /* If the counter is being destroyed, FreeCounter will delete - * the trigger list itself, so don't do it here. + /* If the counter is being destroyed, FreeCounter/miSyncDestroyFence + * will delete the trigger list itself, so don't do it here. + * However, we must NULL out the pTrigger pointer in the trigger list + * node so the destroy loop knows not to dereference it - the backing + * SyncAwait memory is about to be freed below. */ SyncObject *pSync = pAwait->trigger.pSync; - if (pSync && !pSync->beingDestroyed) - SyncDeleteTriggerFromSyncObject(&pAwait->trigger); + if (pSync) { + if (!pSync->beingDestroyed) { + SyncDeleteTriggerFromSyncObject(&pAwait->trigger); + } else { + SyncTriggerList *ptl; + + nt_list_for_each_entry(ptl, pSync->pTriglist, next) { + if (ptl->pTrigger == &pAwait->trigger) { + ptl->pTrigger = NULL; + break; + } + } + } + } } free(pAwaitUnion); return Success; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/Xi/xipassivegrab.c new/xwayland-24.1.12/Xi/xipassivegrab.c --- old/xwayland-24.1.11/Xi/xipassivegrab.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/Xi/xipassivegrab.c 2026-06-02 02:09:01.000000000 +0200 @@ -332,7 +332,9 @@ if ((stuff->grab_type == XIGrabtypeEnter || stuff->grab_type == XIGrabtypeFocusIn || - stuff->grab_type == XIGrabtypeTouchBegin) && stuff->detail != 0) { + stuff->grab_type == XIGrabtypeTouchBegin || + stuff->grab_type == XIGrabtypeGesturePinchBegin || + stuff->grab_type == XIGrabtypeGestureSwipeBegin) && stuff->detail != 0) { client->errorValue = stuff->detail; return BadValue; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/dix/dixfonts.c new/xwayland-24.1.12/dix/dixfonts.c --- old/xwayland-24.1.11/dix/dixfonts.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/dix/dixfonts.c 2026-06-02 02:09:01.000000000 +0200 @@ -670,6 +670,10 @@ * is BadFontName, indicating the alias resolution * is complete. */ + if (resolvedlen > XLFDMAXFONTNAMELEN) { + err = BadFontName; + goto ContBadFontName; + } memcpy(tmp_pattern, resolved, resolvedlen); if (c->haveSaved) { char *tmpname; @@ -932,6 +936,10 @@ memcpy(c->savedName, name, namelen + 1); aliascount = 20; } + if (namelen > XLFDMAXFONTNAMELEN) { + err = BadFontName; + goto ContBadFontName; + } memmove(c->current.pattern, name, namelen); c->current.patlen = namelen; c->current.max_names = 1; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/glx/glxcmds.c new/xwayland-24.1.12/glx/glxcmds.c --- old/xwayland-24.1.11/glx/glxcmds.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/glx/glxcmds.c 2026-06-02 02:09:01.000000000 +0200 @@ -1144,8 +1144,7 @@ ClientPtr client = cl->client; xGLXGetFBConfigsSGIXReq *req = (xGLXGetFBConfigsSGIXReq *) pc; - /* work around mesa bug, don't use REQUEST_SIZE_MATCH */ - REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq); + REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq); return DoGetFBConfigs(cl, req->screen); } @@ -1366,9 +1365,7 @@ ClientPtr client = cl->client; xGLXDestroyPixmapReq *req = (xGLXDestroyPixmapReq *) pc; - /* should be REQUEST_SIZE_MATCH, but mesa's glXDestroyPixmap used to set - * length to 3 instead of 2 */ - REQUEST_AT_LEAST_SIZE(xGLXDestroyPixmapReq); + REQUEST_SIZE_MATCH(xGLXDestroyPixmapReq); return DoDestroyDrawable(cl, req->glxpixmap, GLX_DRAWABLE_PIXMAP); } @@ -1524,14 +1521,8 @@ client->errorValue = req->numAttribs; return BadValue; } -#if 0 - /* mesa sends an additional 8 bytes */ + REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3); -#else - if (((sizeof(xGLXChangeDrawableAttributesReq) + - (req->numAttribs << 3)) >> 2) < client->req_len) - return BadLength; -#endif return DoChangeDrawableAttributes(cl->client, req->drawable, req->numAttribs, (CARD32 *) (req + 1)); @@ -1598,8 +1589,7 @@ ClientPtr client = cl->client; xGLXDestroyWindowReq *req = (xGLXDestroyWindowReq *) pc; - /* mesa's glXDestroyWindow used to set length to 3 instead of 2 */ - REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq); + REQUEST_SIZE_MATCH(xGLXDestroyWindowReq); return DoDestroyDrawable(cl, req->glxwindow, GLX_DRAWABLE_WINDOW); } @@ -1960,8 +1950,7 @@ ClientPtr client = cl->client; xGLXGetDrawableAttributesReq *req = (xGLXGetDrawableAttributesReq *) pc; - /* this should be REQUEST_SIZE_MATCH, but mesa sends an additional 4 bytes */ - REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq); + REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq); return DoGetDrawableAttributes(cl, req->drawable); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/glx/glxcmdsswap.c new/xwayland-24.1.12/glx/glxcmdsswap.c --- old/xwayland-24.1.11/glx/glxcmdsswap.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/glx/glxcmdsswap.c 2026-06-02 02:09:01.000000000 +0200 @@ -235,7 +235,7 @@ __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_AT_LEAST_SIZE(xGLXGetFBConfigsSGIXReq); + REQUEST_SIZE_MATCH(xGLXGetFBConfigsSGIXReq); __GLX_SWAP_INT(&req->screen); return __glXDisp_GetFBConfigsSGIX(cl, pc); @@ -327,7 +327,7 @@ __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_AT_LEAST_SIZE(xGLXDestroyGLXPixmapReq); + REQUEST_SIZE_MATCH(xGLXDestroyGLXPixmapReq); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->glxpixmap); @@ -440,9 +440,7 @@ client->errorValue = req->numAttribs; return BadValue; } - if (((sizeof(xGLXChangeDrawableAttributesReq) + - (req->numAttribs << 3)) >> 2) < client->req_len) - return BadLength; + REQUEST_FIXED_SIZE(xGLXChangeDrawableAttributesReq, req->numAttribs << 3); attribs = (CARD32 *) (req + 1); __GLX_SWAP_INT_ARRAY(attribs, req->numAttribs << 1); @@ -514,7 +512,7 @@ __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_AT_LEAST_SIZE(xGLXDestroyWindowReq); + REQUEST_SIZE_MATCH(xGLXDestroyWindowReq); __GLX_SWAP_INT(&req->glxwindow); @@ -723,7 +721,7 @@ __GLX_DECLARE_SWAP_VARIABLES; - REQUEST_AT_LEAST_SIZE(xGLXGetDrawableAttributesReq); + REQUEST_SIZE_MATCH(xGLXGetDrawableAttributesReq); __GLX_SWAP_SHORT(&req->length); __GLX_SWAP_INT(&req->drawable); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/glx/single2.c new/xwayland-24.1.12/glx/single2.c --- old/xwayland-24.1.11/glx/single2.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/glx/single2.c 2026-06-02 02:09:01.000000000 +0200 @@ -61,6 +61,10 @@ pc += __GLX_SINGLE_HDR_SIZE; size = *(GLsizei *) (pc + 0); type = *(GLenum *) (pc + 4); + if (size < 0) { + cl->client->errorValue = size; + return BadValue; + } if (cx->feedbackBufSize < size) { cx->feedbackBuf = reallocarray(cx->feedbackBuf, (size_t) size, __GLX_SIZE_FLOAT32); @@ -91,6 +95,10 @@ pc += __GLX_SINGLE_HDR_SIZE; size = *(GLsizei *) (pc + 0); + if (size < 0) { + cl->client->errorValue = size; + return BadValue; + } if (cx->selectBufSize < size) { cx->selectBuf = reallocarray(cx->selectBuf, (size_t) size, __GLX_SIZE_CARD32); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/glx/single2swap.c new/xwayland-24.1.12/glx/single2swap.c --- old/xwayland-24.1.11/glx/single2swap.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/glx/single2swap.c 2026-06-02 02:09:01.000000000 +0200 @@ -62,6 +62,10 @@ __GLX_SWAP_INT(pc + 4); size = *(GLsizei *) (pc + 0); type = *(GLenum *) (pc + 4); + if (size < 0) { + cl->client->errorValue = size; + return BadValue; + } if (cx->feedbackBufSize < size) { cx->feedbackBuf = reallocarray(cx->feedbackBuf, (size_t) size, __GLX_SIZE_FLOAT32); @@ -96,6 +100,10 @@ pc += __GLX_SINGLE_HDR_SIZE; __GLX_SWAP_INT(pc + 0); size = *(GLsizei *) (pc + 0); + if (size < 0) { + cl->client->errorValue = size; + return BadValue; + } if (cx->selectBufSize < size) { cx->selectBuf = reallocarray(cx->selectBuf, (size_t) size, __GLX_SIZE_CARD32); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/include/closestr.h new/xwayland-24.1.12/include/closestr.h --- old/xwayland-24.1.11/include/closestr.h 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/include/closestr.h 2026-06-02 02:09:01.000000000 +0200 @@ -57,7 +57,12 @@ /* ListFontsWithInfo */ -#define XLFDMAXFONTNAMELEN 256 +/* libXfont2 allows font names/aliases up to MAXFONTNAMELEN (1024) bytes in + * fonts.alias files. The server's pattern buffers must be large enough to + * hold resolved alias targets returned by the font library. + * ZDI-CAN-30136 + */ +#define XLFDMAXFONTNAMELEN 1024 typedef struct _LFWIstate { char pattern[XLFDMAXFONTNAMELEN]; int patlen; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/meson.build new/xwayland-24.1.12/meson.build --- old/xwayland-24.1.11/meson.build 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/meson.build 2026-06-02 02:09:01.000000000 +0200 @@ -3,10 +3,10 @@ 'buildtype=debugoptimized', 'c_std=gnu99', ], - version: '24.1.11', + version: '24.1.12', meson_version: '>= 0.56.0', ) -release_date = '2026-04-27' +release_date = '2026-06-02' add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc']) cc = meson.get_compiler('c') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/miext/sync/misync.c new/xwayland-24.1.12/miext/sync/misync.c --- old/xwayland-24.1.11/miext/sync/misync.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/miext/sync/misync.c 2026-06-02 02:09:01.000000000 +0200 @@ -115,10 +115,14 @@ SyncScreenPrivPtr pScreenPriv = SYNC_SCREEN_PRIV(pScreen); SyncTriggerList *ptl, *pNext; - /* tell all the fence's triggers that the counter has been destroyed */ - for (ptl = pFence->sync.pTriglist; ptl; ptl = pNext) { - (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger); - pNext = ptl->next; + /* tell all the fence's triggers that the fence has been destroyed. + * Update pTriglist before each callback and free so that FreeAwait + * sees a valid list head when scanning for triggers to NULL out. + */ + nt_list_for_each_entry_safe(ptl, pNext, pFence->sync.pTriglist, next) { + pFence->sync.pTriglist = pNext; + if (ptl->pTrigger) + (*ptl->pTrigger->CounterDestroyed) (ptl->pTrigger); free(ptl); /* destroy the trigger list as we go */ } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/present/present_notify.c new/xwayland-24.1.12/present/present_notify.c --- old/xwayland-24.1.11/present/present_notify.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/present/present_notify.c 2026-06-02 02:09:01.000000000 +0200 @@ -92,6 +92,8 @@ added++; } + + *p_notifies = notifies; return Success; bail: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/xkb/XKBGAlloc.c new/xwayland-24.1.12/xkb/XKBGAlloc.c --- old/xwayland-24.1.11/xkb/XKBGAlloc.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/xkb/XKBGAlloc.c 2026-06-02 02:09:01.000000000 +0200 @@ -769,7 +769,7 @@ return doodad; } if (section) { - if ((section->num_doodads >= geom->sz_doodads) && + if ((section->num_doodads >= section->sz_doodads) && (_XkbAllocDoodads(section, 1) != Success)) { return NULL; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/xkb/xkb.c new/xwayland-24.1.12/xkb/xkb.c --- old/xwayland-24.1.11/xkb/xkb.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/xkb/xkb.c 2026-06-02 02:09:01.000000000 +0200 @@ -1616,6 +1616,11 @@ *nMapsRtrn = _XkbErrCode4(0x02, req->firstType, req->nTypes, 4); return 0; } + if (nMaps > XkbMaxLegalKeyCode + 1) { + *nMapsRtrn = _XkbErrCode4(0x02, req->firstType, req->nTypes, + XkbMaxLegalKeyCode + 1); + return 0; + } } else if (req->present & XkbKeyTypesMask) { nMaps = xkb->map->num_types; @@ -1647,7 +1652,7 @@ } n = i + req->firstType; width = wire->numLevels; - if (width < 1) { + if (width < 1 || width > XkbMaxShiftLevel) { *nMapsRtrn = _XkbErrCode3(0x04, n, width); return 0; } @@ -1857,6 +1862,11 @@ if (req->nKeyActs % 4) wire += 4 - (req->nKeyActs % 4); *wireRtrn = (CARD8 *) (((XkbAnyAction *) wire) + nActs); + if (nActs > 0 && + !_XkbCheckRequestBounds(client, req, wire, *wireRtrn)) { + *nActsRtrn = _XkbErrCode2(0x25, nActs); + return 0; + } *nActsRtrn = nActs; return 1; } @@ -5357,6 +5367,8 @@ } CHK_ATOM_ONLY(olWire->name); ol = XkbAddGeomOverlay(section, olWire->name, olWire->nRows); + if (!ol) + return BadAlloc; rWire = (xkbOverlayRowWireDesc *) &olWire[1]; for (r = 0; r < olWire->nRows; r++) { register int k; @@ -5366,12 +5378,14 @@ if (!_XkbCheckRequestBounds(client, req, rWire, rWire + 1)) return BadLength; - if (rWire->rowUnder > section->num_rows) { + if (rWire->rowUnder >= section->num_rows) { client->errorValue = _XkbErrCode4(0x20, r, section->num_rows, rWire->rowUnder); return BadMatch; } row = XkbAddGeomOverlayRow(ol, rWire->rowUnder, rWire->nKeys); + if (!row) + return BadAlloc; kWire = (xkbOverlayKeyWireDesc *) &rWire[1]; for (k = 0; k < rWire->nKeys; k++, kWire++) { if (!_XkbCheckRequestBounds(client, req, kWire, kWire + 1)) @@ -5561,10 +5575,22 @@ ol->num_points = olWire->nPoints; olWire = (xkbOutlineWireDesc *)ptWire; } - if (shapeWire->primaryNdx != XkbNoShape) + if (shapeWire->primaryNdx != XkbNoShape) { + if (shapeWire->primaryNdx >= shapeWire->nOutlines) { + client->errorValue = _XkbErrCode3(0x08, shapeWire->primaryNdx, + shapeWire->nOutlines); + return BadValue; + } shape->primary = &shape->outlines[shapeWire->primaryNdx]; - if (shapeWire->approxNdx != XkbNoShape) + } + if (shapeWire->approxNdx != XkbNoShape) { + if (shapeWire->approxNdx >= shapeWire->nOutlines) { + client->errorValue = _XkbErrCode3(0x08, shapeWire->approxNdx, + shapeWire->nOutlines); + return BadValue; + } shape->approx = &shape->outlines[shapeWire->approxNdx]; + } shapeWire = (xkbShapeWireDesc *) olWire; } wire = (char *) shapeWire; @@ -5614,12 +5640,12 @@ client->errorValue = _XkbErrCode3(0x01, 2, req->nColors); return BadValue; } - if (req->baseColorNdx > req->nColors) { + if (req->baseColorNdx >= req->nColors) { client->errorValue = _XkbErrCode3(0x03, req->nColors, req->baseColorNdx); return BadMatch; } - if (req->labelColorNdx > req->nColors) { + if (req->labelColorNdx >= req->nColors) { client->errorValue = _XkbErrCode3(0x03, req->nColors, req->labelColorNdx); return BadMatch; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.11/xkb/xkbtext.c new/xwayland-24.1.12/xkb/xkbtext.c --- old/xwayland-24.1.11/xkb/xkbtext.c 2026-04-27 09:25:48.000000000 +0200 +++ new/xwayland-24.1.12/xkb/xkbtext.c 2026-06-02 02:09:01.000000000 +0200 @@ -138,11 +138,11 @@ len = strlen(tmp) + 1; if (format == XkbCFile) - len += 4; + len += 5; rtrn = tbGetBuffer(len); if (format == XkbCFile) { strcpy(rtrn, "vmod_"); - strncpy(&rtrn[5], tmp, len - 4); + strncpy(&rtrn[5], tmp, len - 5); } else strncpy(rtrn, tmp, len);
