Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xwayland for openSUSE:Factory checked in at 2026-07-17 18:46:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xwayland (Old) and /work/SRC/openSUSE:Factory/.xwayland.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xwayland" Fri Jul 17 18:46:53 2026 rev:52 rq:1365909 version:24.1.13 Changes: -------- --- /work/SRC/openSUSE:Factory/xwayland/xwayland.changes 2026-07-08 17:37:29.887485030 +0200 +++ /work/SRC/openSUSE:Factory/.xwayland.new.24530/xwayland.changes 2026-07-17 18:47:08.644522120 +0200 @@ -1,0 +2,15 @@ +Wed Jul 8 08:44:08 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 24.1.13: + * This release contains the fixes for the issues reported in this + security advisory: + https://lists.x.org/archives/xorg-announce/2026-July/003716.html + * CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow + * CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent() + * In addition we have a few other smaller cleanup fixes. +- Drop patches fixed upstream: + * bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch + * bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch + * bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch + +------------------------------------------------------------------- Old: ---- bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch xwayland-24.1.12.tar.xz xwayland-24.1.12.tar.xz.sig New: ---- xwayland-24.1.13.tar.xz xwayland-24.1.13.tar.xz.sig ----------(Old B)---------- Old:- Drop patches fixed upstream: * bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch * bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch Old: * bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch * bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch * bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch Old: * bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch * bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xwayland.spec ++++++ --- /var/tmp/diff_new_pack.7K10y8/_old 2026-07-17 18:47:09.308544609 +0200 +++ /var/tmp/diff_new_pack.7K10y8/_new 2026-07-17 18:47:09.312544745 +0200 @@ -27,7 +27,7 @@ %endif Name: xwayland -Version: 24.1.12 +Version: 24.1.13 Release: 0 URL: http://xorg.freedesktop.org Summary: Xwayland Xserver @@ -37,9 +37,6 @@ Source1: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig Source2: xwayland.keyring Patch3: U_xwayland_Dont_run_key_behaviors_and_actions.patch -Patch1268893: bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch -Patch1268894: bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch -Patch1268895: bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch BuildRequires: meson BuildRequires: ninja ++++++ xwayland-24.1.12.tar.xz -> xwayland-24.1.13.tar.xz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/Xi/xichangecursor.c new/xwayland-24.1.13/Xi/xichangecursor.c --- old/xwayland-24.1.12/Xi/xichangecursor.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/Xi/xichangecursor.c 2026-07-08 03:17:38.000000000 +0200 @@ -89,6 +89,9 @@ return rc; } + if (pWin == NullWindow) + return BadWindow; + if (stuff->cursor == None) { if (pWin == pWin->drawable.pScreen->root) pCursor = rootCursor; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/dix/colormap.c new/xwayland-24.1.13/dix/colormap.c --- old/xwayland-24.1.12/dix/colormap.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/dix/colormap.c 2026-07-08 03:17:38.000000000 +0200 @@ -1288,7 +1288,7 @@ if ((pixel = *pPixel) >= size) pixel = 0; - for (pent = pentFirst + pixel, count = size; --count >= 0; pent++, pixel++) { + for (pent = pentFirst + pixel, count = size; --count >= 0;) { if (pent->refcnt > 0 && (*comp) (pent, prgb)) { switch (channel) { case REDMAP: @@ -1305,6 +1305,13 @@ } *pPixel = pixel; } + pixel++; + if (pixel >= size) { + pent = pentFirst; + pixel = 0; + } + else + pent++; } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/dix/dixfonts.c new/xwayland-24.1.13/dix/dixfonts.c --- old/xwayland-24.1.12/dix/dixfonts.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/dix/dixfonts.c 2026-07-08 03:17:38.000000000 +0200 @@ -556,7 +556,7 @@ int err = Successful; FontNamesPtr names = NULL; char *name, *resolved = NULL; - int namelen, resolvedlen; + int namelen, resolvedlen = 0; int nnames; int stringLens; int i; @@ -848,8 +848,8 @@ { FontPathElementPtr fpe; int err = Successful; - char *name; - int namelen; + char *name = NULL; + int namelen = 0; int numFonts; FontInfoRec fontInfo, *pFontInfo; xListFontsWithInfoReply *reply; @@ -912,6 +912,10 @@ * is BadFontName, indicating the alias resolution * is complete. */ + if (!name) { + err = BadFontName; + goto ContBadFontName; + } if (c->haveSaved) { char *tmpname; int tmpnamelen; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/fb/fbglyph.c new/xwayland-24.1.13/fb/fbglyph.c --- old/xwayland-24.1.12/fb/fbglyph.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/fb/fbglyph.c 2026-07-08 03:17:38.000000000 +0200 @@ -95,7 +95,7 @@ pglyph = FONTGLYPHBITS(pglyphBase, pci); gWidth = GLYPHWIDTHPIXELS(pci); gHeight = GLYPHHEIGHTPIXELS(pci); - if (gWidth && gHeight) { + if (gWidth > 0 && gHeight > 0) { gx = x + pci->metrics.leftSideBearing; gy = y - pci->metrics.ascent; if (glyph && gWidth <= sizeof(FbStip) * 8 && @@ -197,7 +197,7 @@ pglyph = FONTGLYPHBITS(pglyphBase, pci); gWidth = GLYPHWIDTHPIXELS(pci); gHeight = GLYPHHEIGHTPIXELS(pci); - if (gWidth && gHeight) { + if (gWidth > 0 && gHeight > 0) { gx = x + pci->metrics.leftSideBearing; gy = y - pci->metrics.ascent; if (glyph && gWidth <= sizeof(FbStip) * 8 && diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/glamor/glamor_font.c new/xwayland-24.1.13/glamor/glamor_font.c --- old/xwayland-24.1.12/glamor/glamor_font.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/glamor/glamor_font.c 2026-07-08 03:17:38.000000000 +0200 @@ -71,6 +71,9 @@ glyph_width_pixels = font->info.maxbounds.rightSideBearing - font->info.minbounds.leftSideBearing; glyph_height = font->info.maxbounds.ascent + font->info.maxbounds.descent; + if (glyph_width_pixels <= 0 || glyph_height <= 0) + return NULL; + glyph_width_bytes = (glyph_width_pixels + 7) >> 3; glamor_font->glyph_width_pixels = glyph_width_pixels; @@ -130,7 +133,28 @@ if (count) { char *dst; char *src = glyph->bits; - unsigned y; + int gw = GLYPHWIDTHBYTES(glyph); + int gh = GLYPHHEIGHTPIXELS(glyph); + + /* Reject fonts where any per-glyph metric is negative + * or exceeds the atlas slot size derived from maxbounds. + * The PCF parser in libXfont2 does not recompute + * maxbounds from per-glyph data, so a crafted PCF file + * can violate the maxbounds invariant. + * + * gw is passed as size_t to memcpy and a negative value + * would thus result in OOB access. + * + * Returning NULL makes glamor fall back to software + * rendering. + */ + if (gw < 0 || gh < 0 || + gw > glyph_width_bytes || gh > glyph_height) { + glDeleteTextures(1, &glamor_font->texture_id); + glamor_font->texture_id = 0; + free(bits); + return NULL; + } dst = bits; /* get offset of start of first row */ @@ -139,8 +163,8 @@ dst += (row & 1) ? glamor_font->row_width : 0; dst += col * glyph_width_bytes; - for (y = 0; y < GLYPHHEIGHTPIXELS(glyph); y++) { - memcpy(dst, src, GLYPHWIDTHBYTES(glyph)); + for (int y = 0; y < gh; y++) { + memcpy(dst, src, gw); dst += overall_width; src += GLYPHWIDTHBYTESPADDED(glyph); } @@ -154,11 +178,14 @@ glTexImage2D(GL_TEXTURE_2D, 0, GL_R8UI, overall_width, overall_height, 0, GL_RED_INTEGER, GL_UNSIGNED_BYTE, bits); glamor_priv->suppress_gl_out_of_memory_logging = false; - if (glGetError() == GL_OUT_OF_MEMORY) - return NULL; - free(bits); + if (glGetError() == GL_OUT_OF_MEMORY) { + glDeleteTextures(1, &glamor_font->texture_id); + glamor_font->texture_id = 0; + return NULL; + } + glamor_font->realized = TRUE; return glamor_font; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/glamor/glamor_glyphblt.c new/xwayland-24.1.13/glamor/glamor_glyphblt.c --- old/xwayland-24.1.12/glamor/glamor_glyphblt.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/glamor/glamor_glyphblt.c 2026-07-08 03:17:38.000000000 +0200 @@ -90,7 +90,7 @@ int h = GLYPHHEIGHTPIXELS(charinfo); uint8_t *glyphbits = FONTGLYPHBITS(NULL, charinfo); - if (w && h) { + if (w > 0 && h > 0) { int glyph_x = x + charinfo->metrics.leftSideBearing; int glyph_y = y - charinfo->metrics.ascent; int glyph_stride = GLYPHWIDTHBYTESPADDED(charinfo); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/glx/vndcmds.c new/xwayland-24.1.13/glx/vndcmds.c --- old/xwayland-24.1.12/glx/vndcmds.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/glx/vndcmds.c 2026-07-08 03:17:38.000000000 +0200 @@ -256,6 +256,11 @@ if (ret != Success) { return ret; } + // Free the old tag before calling CommonMakeNewCurrent(), + // which may call GlxAllocContextTag() and realloc the + // contextTags array, invalidating the oldTag pointer. + GlxFreeContextTag(oldTag); + oldTag = NULL; } if (newVendor != NULL) { @@ -266,9 +271,6 @@ } else { reply.contextTag = 0; } - - GlxFreeContextTag(oldTag); - oldTag = NULL; } reply.contextTag = GlxCheckSwap(client, reply.contextTag); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/glx/vndservermapping.c new/xwayland-24.1.13/glx/vndservermapping.c --- old/xwayland-24.1.12/glx/vndservermapping.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/glx/vndservermapping.c 2026-07-08 03:17:38.000000000 +0200 @@ -158,7 +158,7 @@ void GlxFreeContextTag(GlxContextTagInfo *tagInfo) { if (tagInfo != NULL) { - tagInfo->vendor = NULL; + tagInfo->client = NULL; tagInfo->vendor = NULL; tagInfo->data = NULL; tagInfo->context = None; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/meson.build new/xwayland-24.1.13/meson.build --- old/xwayland-24.1.12/meson.build 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/meson.build 2026-07-08 03:17:38.000000000 +0200 @@ -3,10 +3,10 @@ 'buildtype=debugoptimized', 'c_std=gnu99', ], - version: '24.1.12', + version: '24.1.13', meson_version: '>= 0.56.0', ) -release_date = '2026-06-02' +release_date = '2026-07-08' add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc']) cc = meson.get_compiler('c') diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/mi/miglblt.c new/xwayland-24.1.13/mi/miglblt.c --- old/xwayland-24.1.12/mi/miglblt.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/mi/miglblt.c 2026-07-08 03:17:38.000000000 +0200 @@ -143,7 +143,7 @@ pglyph = FONTGLYPHBITS(pglyphBase, pci); gWidth = GLYPHWIDTHPIXELS(pci); gHeight = GLYPHHEIGHTPIXELS(pci); - if (gWidth && gHeight) { + if (gWidth > 0 && gHeight > 0) { nbyGlyphWidth = GLYPHWIDTHBYTESPADDED(pci); nbyPadGlyph = BitmapBytePad(gWidth); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/xwayland-24.1.12/xkb/maprules.c new/xwayland-24.1.13/xkb/maprules.c --- old/xwayland-24.1.12/xkb/maprules.c 2026-06-02 02:09:01.000000000 +0200 +++ new/xwayland-24.1.13/xkb/maprules.c 2026-07-08 03:17:38.000000000 +0200 @@ -470,15 +470,19 @@ static char * _Concat(char *str1, const char *str2) { - int len; + size_t len; + char *tmp; if ((!str1) || (!str2)) return str1; + len = strlen(str1) + strlen(str2) + 1; - str1 = realloc(str1, len * sizeof(char)); - if (str1) - strcat(str1, str2); - return str1; + tmp = realloc(str1, len); + if (!tmp) + return str1; + + strcat(tmp, str2); + return tmp; } static void
