Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package xorg-x11-server for openSUSE:Factory
checked in at 2026-11-11 16:23:49
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/xorg-x11-server (Old)
and /work/SRC/openSUSE:Factory/.xorg-x11-server.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xorg-x11-server"
Wed Nov 11 16:23:49 2026 rev:456 rq:1396534 version:21.1.25
Changes:
--------
--- /work/SRC/openSUSE:Factory/xorg-x11-server/xorg-x11-server.changes
2026-10-22 19:24:57.148900935 +0200
+++
/work/SRC/openSUSE:Factory/.xorg-x11-server.new.3759290/xorg-x11-server.changes
2026-11-11 16:23:56.996399857 +0100
@@ -1,0 +2,35 @@
+Wed Nov 4 10:29:50 UTC 2026 - Stefan Dirsch <[email protected]>
+
+- U_Revert-damage-Unlink-a-damage-from-the-list-it-was-a.patch
+ * reverts commit 0fb16f3d, which mistakenly broke driver ABI
+ (boo#1289271)
+
+-------------------------------------------------------------------
+Wed Oct 21 12:51:33 UTC 2026 - Stefan Dirsch <[email protected]>
+
+- bsc1285086_CVE-2026-109091.patch
+ * X.Org Server EDID DS_RANGES Out-Of-Bounds Write
+ (bsc#1285086, CVE-2026-109091)
+- bsc1285087_CVE-2026-109092.patch
+ * X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
+ (bsc#1285087, CVE-2026-109092)
+- bsc1285088_CVE-2026-109093.patch
+ * X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
+ (bsc#1285088, CVE-2026-109093)
+- bsc1285089_CVE-2026-109094.patch
+ * X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
+ (bsc#1285089, CVE-2026-109094)
+- bsc1285090_CVE-2026-109095.patch
+ * X.Org Server glamor Xv Image Size Integer Overflow
+ (bsc#1285090, CVE-2026-109095)
+- bsc1285091_CVE-2026-109096.patch
+ * X.Org Server XvPutImage Negative Image Size Length Bypass
+ (bsc#1285091, CVE-2026-109096
+- bsc1285093_CVE-2026-109903.patch
+ * X.Org Server XRes QueryClientIds Request Size Overflow
+ (bsc#1285093, CVE-2026-109903)
+- bsc1285094_CVE-2026-109904.patch
+ * X.Org Server XRes QueryClientIds Request Size Overflow
+ (bsc#1285094, CVE-2026-109904)
+
+-------------------------------------------------------------------
New:
----
U_Revert-damage-Unlink-a-damage-from-the-list-it-was-a.patch
bsc1285086_CVE-2026-109091.patch
bsc1285087_CVE-2026-109092.patch
bsc1285088_CVE-2026-109093.patch
bsc1285089_CVE-2026-109094.patch
bsc1285090_CVE-2026-109095.patch
bsc1285091_CVE-2026-109096.patch
bsc1285093_CVE-2026-109903.patch
bsc1285094_CVE-2026-109904.patch
----------(New B)----------
New:
- U_Revert-damage-Unlink-a-damage-from-the-list-it-was-a.patch
* reverts commit 0fb16f3d, which mistakenly broke driver ABI
New:
- bsc1285086_CVE-2026-109091.patch
* X.Org Server EDID DS_RANGES Out-Of-Bounds Write
New: (bsc#1285086, CVE-2026-109091)
- bsc1285087_CVE-2026-109092.patch
* X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
New: (bsc#1285087, CVE-2026-109092)
- bsc1285088_CVE-2026-109093.patch
* X.Org Server XTestFakeInput Valuator Stack Out-Of-Bounds Write
New: (bsc#1285088, CVE-2026-109093)
- bsc1285089_CVE-2026-109094.patch
* X.Org Server XRes QueryResourceBytes Swap Path Size Overflow
New: (bsc#1285089, CVE-2026-109094)
- bsc1285090_CVE-2026-109095.patch
* X.Org Server glamor Xv Image Size Integer Overflow
New: (bsc#1285090, CVE-2026-109095)
- bsc1285091_CVE-2026-109096.patch
* X.Org Server XvPutImage Negative Image Size Length Bypass
New: (bsc#1285091, CVE-2026-109096
- bsc1285093_CVE-2026-109903.patch
* X.Org Server XRes QueryClientIds Request Size Overflow
New: (bsc#1285093, CVE-2026-109903)
- bsc1285094_CVE-2026-109904.patch
* X.Org Server XRes QueryClientIds Request Size Overflow
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ xorg-x11-server.spec ++++++
--- /var/tmp/diff_new_pack.cHyRcT/_old 2026-11-11 16:23:59.427501825 +0100
+++ /var/tmp/diff_new_pack.cHyRcT/_new 2026-11-11 16:23:59.429501909 +0100
@@ -242,6 +242,17 @@
Patch1218176: u_miCloseScreen_check_for_null_pScreen_dev_private.patch
+Patch1285086: bsc1285086_CVE-2026-109091.patch
+Patch1285087: bsc1285087_CVE-2026-109092.patch
+Patch1285088: bsc1285088_CVE-2026-109093.patch
+Patch1285089: bsc1285089_CVE-2026-109094.patch
+Patch1285090: bsc1285090_CVE-2026-109095.patch
+Patch1285091: bsc1285091_CVE-2026-109096.patch
+Patch1285093: bsc1285093_CVE-2026-109903.patch
+Patch1285094: bsc1285094_CVE-2026-109904.patch
+
+Patch1289271: U_Revert-damage-Unlink-a-damage-from-the-list-it-was-a.patch
+
%description
This package contains the X.Org Server.
@@ -395,6 +406,17 @@
%patch -P 1218176 -p1
+%patch -P 1285086 -p1
+%patch -P 1285087 -p1
+%patch -P 1285088 -p1
+%patch -P 1285089 -p1
+%patch -P 1285090 -p1
+%patch -P 1285091 -p1
+%patch -P 1285093 -p1
+%patch -P 1285094 -p1
+
+%patch -P 1289271 -p1
+
%build
# We have some -z now related errors during X default startup (boo#1197994):
# - when loading modesetting: gbm_bo_get_plane_count
++++++ U_Revert-damage-Unlink-a-damage-from-the-list-it-was-a.patch ++++++
>From a10192e7c3237a707e9bb712a566e2f14415dddd Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <[email protected]>
Date: Sat, 10 Oct 2026 12:53:56 -0700
Subject: [PATCH] Revert "damage: Unlink a damage from the list it was actually
inserted on"
This reverts commit 0fb16f3da03c077f5821f0eeb745384f5472faa5.
I missed that it broke driver ABI when I cherry-picked it from main to the
server-21.1-branch. Apologies.
Closes: #1930
Signed-off-by: Alan Coopersmith <[email protected]>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2355>
---
miext/damage/damage.c | 22 +++++-----------------
miext/damage/damagestr.h | 6 ------
2 files changed, 5 insertions(+), 23 deletions(-)
diff --git a/miext/damage/damage.c b/miext/damage/damage.c
index f08aa5915..f3ae4ebbc 100644
--- a/miext/damage/damage.c
+++ b/miext/damage/damage.c
@@ -1457,7 +1457,6 @@ damageRemoveDamage(DamagePtr * pPrev, DamagePtr pDamage)
while (*pPrev) {
if (*pPrev == pDamage) {
*pPrev = pDamage->pNext;
- pDamage->pListHead = NULL;
return;
}
pPrev = &(*pPrev)->pNext;
@@ -1468,16 +1467,6 @@ damageRemoveDamage(DamagePtr * pPrev, DamagePtr pDamage)
#endif
}
-/*
- * Link pDamage onto the list headed by pPrev, remembering that list so that
damageRemoveDamage() can later unlink it
- * from the same place.
- *
- * The list a window's damage belongs on is chosen by getDrawableDamageRef()
and depends on the window pixmap, which can
- * change while the damage is registered (Composite redirection, rootless
drawing and Present flips all swap it).
- * Re-deriving the list at removal time can therefore consult a different list
than the damage was inserted onto, in
- * which case the removal silently does nothing and leaves an unregistered --
possibly freed -- damage linked where
- * damageRegionAppend() will dereference its NULL pDrawable.
- */
static void
damageInsertDamage(DamagePtr * pPrev, DamagePtr pDamage)
{
@@ -1492,7 +1481,6 @@ damageInsertDamage(DamagePtr * pPrev, DamagePtr pDamage)
#endif
pDamage->pNext = *pPrev;
*pPrev = pDamage;
- pDamage->pListHead = pPrev;
}
static Bool
@@ -1565,9 +1553,11 @@ damageSetWindowPixmap(WindowPtr pWindow, PixmapPtr
pPixmap)
damageScrPriv(pScreen);
if ((pDamage = damageGetWinPriv(pWindow))) {
+ PixmapPtr pOldPixmap = (*pScreen->GetWindowPixmap) (pWindow);
+ DamagePtr *pPrev = getPixmapDamageRef(pOldPixmap);
+
while (pDamage) {
- if (pDamage->pListHead)
- damageRemoveDamage(pDamage->pListHead, pDamage);
+ damageRemoveDamage(pPrev, pDamage);
pDamage = pDamage->pNextWin;
}
}
@@ -1731,7 +1721,6 @@ DamageCreate(DamageReportFunc damageReport,
return 0;
pDamage->pNext = 0;
pDamage->pNextWin = 0;
- pDamage->pListHead = NULL;
RegionNull(&pDamage->damage);
RegionNull(&pDamage->pendingDamage);
@@ -1834,8 +1823,7 @@ DamageUnregister(DamagePtr pDamage)
#endif
}
pDamage->pDrawable = 0;
- if (pDamage->pListHead)
- damageRemoveDamage(pDamage->pListHead, pDamage);
+ damageRemoveDamage(getDrawableDamageRef(pDrawable), pDamage);
}
void
diff --git a/miext/damage/damagestr.h b/miext/damage/damagestr.h
index 19624192e..0d07872e5 100644
--- a/miext/damage/damagestr.h
+++ b/miext/damage/damagestr.h
@@ -35,12 +35,6 @@
typedef struct _damage {
DamagePtr pNext;
DamagePtr pNextWin;
- /*
- * Head of the pNext list this damage is currently linked on, or NULL if
it is not linked on any list. Recorded at
- * insertion time so that removal always unlinks from the list the damage
actually went onto; see
- * damageInsertDamage().
- */
- DamagePtr *pListHead;
RegionRec damage;
DamageReportLevel damageLevel;
--
2.51.0
++++++ bsc1285086_CVE-2026-109091.patch ++++++
>From 909623dff0180fbeadd10aa7ae02680b075f9fda Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <[email protected]>
Date: Fri, 2 Oct 2026 15:02:54 +0200
Subject: [PATCH xserver 01/16] xfree86: bound EDID DS_RANGES against
hsync/vrefresh array size
handle_detailed_monset() records Display-Range (DS_RANGES) descriptors
from EDID into the fixed-size MonRec hsync[] and vrefresh[] arrays
without checking nHsync / nVrefresh against MAX_HSYNC / MAX_VREFRESH.
A malicious EDID with more DS_RANGES descriptors than the array
capacity (base block plus CEA extension detailed slots) overruns those
arrays and clobbers adjacent MonRec members such as Modes, Last, and
DDC, leading to an out-of-bounds write and subsequent crash.
Clamp each store the same way the xorg.conf path already does, and
drop extra descriptors while still applying maxPixClock.
CVE-2026-109091
Reported-by: Eun0us / Espilon <[email protected]>
Signed-off-by: Olivier Fourdan <[email protected]>
Assisted-by: AI
---
hw/xfree86/modes/xf86EdidModes.c | 36 ++++++++++++++++++--------------
1 file changed, 20 insertions(+), 16 deletions(-)
diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index b0f93e2b7..b2ade1e27 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -1125,14 +1125,16 @@ handle_detailed_monset(struct detailed_monitor_section
*det_mon, void *data)
switch (det_mon->type) {
case DS_RANGES:
if (!p->have_hsync) {
- if (!p->Monitor->nHsync)
- xf86DrvMsg(scrnIndex, X_INFO,
- "Using EDID range info for horizontal sync\n");
- p->Monitor->hsync[p->Monitor->nHsync].lo =
- det_mon->section.ranges.min_h;
- p->Monitor->hsync[p->Monitor->nHsync].hi =
- det_mon->section.ranges.max_h;
- p->Monitor->nHsync++;
+ if (p->Monitor->nHsync < MAX_HSYNC) {
+ if (!p->Monitor->nHsync)
+ xf86DrvMsg(scrnIndex, X_INFO,
+ "Using EDID range info for horizontal sync\n");
+ p->Monitor->hsync[p->Monitor->nHsync].lo =
+ det_mon->section.ranges.min_h;
+ p->Monitor->hsync[p->Monitor->nHsync].hi =
+ det_mon->section.ranges.max_h;
+ p->Monitor->nHsync++;
+ }
}
else {
xf86DrvMsg(scrnIndex, X_INFO,
@@ -1140,14 +1142,16 @@ handle_detailed_monset(struct detailed_monitor_section
*det_mon, void *data)
}
if (!p->have_vrefresh) {
- if (!p->Monitor->nVrefresh)
- xf86DrvMsg(scrnIndex, X_INFO,
- "Using EDID range info for vertical refresh\n");
- p->Monitor->vrefresh[p->Monitor->nVrefresh].lo =
- det_mon->section.ranges.min_v;
- p->Monitor->vrefresh[p->Monitor->nVrefresh].hi =
- det_mon->section.ranges.max_v;
- p->Monitor->nVrefresh++;
+ if (p->Monitor->nVrefresh < MAX_VREFRESH) {
+ if (!p->Monitor->nVrefresh)
+ xf86DrvMsg(scrnIndex, X_INFO,
+ "Using EDID range info for vertical refresh\n");
+ p->Monitor->vrefresh[p->Monitor->nVrefresh].lo =
+ det_mon->section.ranges.min_v;
+ p->Monitor->vrefresh[p->Monitor->nVrefresh].hi =
+ det_mon->section.ranges.max_v;
+ p->Monitor->nVrefresh++;
+ }
}
else {
xf86DrvMsg(scrnIndex, X_INFO,
--
2.56.0
++++++ bsc1285087_CVE-2026-109092.patch ++++++
>From b0335b6e615b8e72ff6c414978c96d8222dcb72e Mon Sep 17 00:00:00 2001
From: Acts1631 <[email protected]>
Date: Tue, 21 Jul 2026 10:57:50 -0400
Subject: [PATCH xserver 03/16] Xv: prevent overflow in shared-memory bounds
check
A crafted XvShmPutImage offset could wrap the image-size addition
before range validation and pass an invalid source pointer to the DDX.
Reject negative image sizes and validate the offset and required range
with subtraction before deriving the source pointer.
CVE-2026-109092
---
Xext/xvdisp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
index 41d511553..84e6be1df 100644
--- a/Xext/xvdisp.c
+++ b/Xext/xvdisp.c
@@ -919,7 +919,8 @@ ProcXvShmPutImage(ClientPtr client)
size_needed = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage,
&width, &height,
NULL, NULL);
- if ((size_needed + stuff->offset) > shmdesc->size)
+ if (size_needed < 0 || stuff->offset > shmdesc->size ||
+ (unsigned long) size_needed > shmdesc->size - stuff->offset)
return BadAccess;
if ((width < stuff->width) || (height < stuff->height))
--
2.56.0
++++++ bsc1285088_CVE-2026-109093.patch ++++++
>From 77823ac670339033af42428264578e11878e2ed7 Mon Sep 17 00:00:00 2001
From: Acts1631 <[email protected]>
Date: Tue, 21 Jul 2026 11:32:24 -0400
Subject: [PATCH xserver 05/16] XTest: validate valuator range before writing
XTestFakeInput copied device valuators into a fixed stack array before
checking whether the record fit in the target device axis range. A
high-axis device and crafted request could write past the array.
Validate the count and range before indexing the stack array.
CVE-2026-109093
---
Xext/xtest.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
Index: xorg-server-21.1.25/Xext/xtest.c
===================================================================
--- xorg-server-21.1.25.orig/Xext/xtest.c
+++ xorg-server-21.1.25/Xext/xtest.c
@@ -257,6 +257,12 @@ ProcXTestFakeInput(ClientPtr client)
client->errorValue = dv->first_valuator;
return BadValue;
}
+ if (!dv->num_valuators || dv->num_valuators > 6 ||
+ base + dv->num_valuators > dev->valuator->numAxes ||
+ base + dv->num_valuators > MAX_VALUATORS) {
+ client->errorValue = dv->num_valuators;
+ return BadValue;
+ }
switch (dv->num_valuators) {
case 6:
valuators[base + 5] = dv->valuator5;
@@ -283,11 +289,6 @@ ProcXTestFakeInput(ClientPtr client)
base += dv->num_valuators;
numValuators += dv->num_valuators;
-
- if (firstValuator + numValuators > dev->valuator->numAxes) {
- client->errorValue = dv->num_valuators;
- return BadValue;
- }
}
type = type - XI_DeviceKeyPress + KeyPress;
++++++ bsc1285089_CVE-2026-109094.patch ++++++
>From 13876f736eec4e81b1001a8fde650544fcaeb4fc Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <[email protected]>
Date: Fri, 2 Oct 2026 15:42:42 +0200
Subject: [PATCH xserver 09/16] XRes: prevent overflow in resource bytes swap
path
SProcXResQueryResourceBytes multiplied numSpecs by the spec size
before REQUEST_FIXED_SIZE without an overflow check.
On 32-bit servers, a large numSpecs can wrap, pass length validation,
and walk the swap loop past the request buffer.
Reject numSpecs values that would cause an overflow before validating
or swapping the array, matching ProcXResQueryResourceBytes.
CVE-2026-109094
Signed-off-by: Olivier Fourdan <[email protected]>
Assisted-by: AI
---
Xext/xres.c | 2 ++
1 file changed, 2 insertions(+)
Index: xorg-server-21.1.25/Xext/xres.c
===================================================================
--- xorg-server-21.1.25.orig/Xext/xres.c
+++ xorg-server-21.1.25/Xext/xres.c
@@ -1066,6 +1066,8 @@ SProcXResQueryResourceBytes (ClientPtr c
REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq);
swapl(&stuff->numSpecs);
+ if (stuff->numSpecs > UINT32_MAX / sizeof(specs[0]))
+ return BadLength;
REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq,
stuff->numSpecs * sizeof(specs[0]));
++++++ bsc1285090_CVE-2026-109095.patch ++++++
>From b4c3257d14f0fb793a5f5a3e947683a05761d609 Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <[email protected]>
Date: Fri, 2 Oct 2026 15:58:36 +0200
Subject: [PATCH xserver 11/16] glamor: prevent overflow in Xv image size
calculation
glamor_xv_query_image_attributes() computed image sizes with 32-bit
signed ints. Large CARD16 width/height values (especially for NV12
and YV12/I420) wrap the result, so protocol length checks can accept
requests that lack the required image payload.
Compute sizes with 64-bit arithmetic and return -1 when the result
does not fit in int, so callers can reject the request.
CVE-2026-109095
Reported-by: Tristan <[email protected]>
Signed-off-by: Olivier Fourdan <[email protected]>
Assisted-by: AI
---
glamor/glamor_xv.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/glamor/glamor_xv.c b/glamor/glamor_xv.c
index 8a0677131..aa5114e03 100644
--- a/glamor/glamor_xv.c
+++ b/glamor/glamor_xv.c
@@ -330,7 +330,7 @@ glamor_xv_query_image_attributes(int id,
unsigned short *w, unsigned short *h,
int *pitches, int *offsets)
{
- int size = 0, tmp;
+ int64_t size = 0, tmp;
if (offsets)
offsets[0] = 0;
@@ -343,6 +343,8 @@ glamor_xv_query_image_attributes(int id,
if (pitches)
pitches[0] = size;
size *= *h;
+ if (size > INT_MAX)
+ return -1;
if (offsets)
offsets[1] = size;
tmp = ALIGN(*w >> 1, 4);
@@ -350,6 +352,8 @@ glamor_xv_query_image_attributes(int id,
pitches[1] = pitches[2] = tmp;
tmp *= (*h >> 1);
size += tmp;
+ if (size > INT_MAX)
+ return -1;
if (offsets)
offsets[2] = size;
size += tmp;
@@ -361,6 +365,8 @@ glamor_xv_query_image_attributes(int id,
if (pitches)
pitches[0] = size;
size *= *h;
+ if (size > INT_MAX)
+ return -1;
if (offsets)
offsets[1] = size;
tmp = ALIGN(*w, 4);
@@ -395,6 +401,8 @@ glamor_xv_query_image_attributes(int id,
size *= *h;
break;
}
+ if (size > INT_MAX)
+ return -1;
return size;
}
--
2.56.0
++++++ bsc1285091_CVE-2026-109096.patch ++++++
>From 8f6c8867fe97dbeddc41f7a57434255e292c2f4a Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <[email protected]>
Date: Fri, 2 Oct 2026 15:58:45 +0200
Subject: [PATCH xserver 13/16] Xv: reject negative image size in PutImage
ddQueryImageAttributes() can return a negative size when the
adaptor overflows during size calculation. Adding that value to
the request header size can make the length check accept a request
that does not contain the claimed image data.
Reject negative sizes before validating the request length.
CVE-2026-109096
Reported-by: Tristan <[email protected]>
Signed-off-by: Olivier Fourdan <[email protected]>
Assisted-by: AI
---
Xext/xvdisp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
index 84e6be1df..55b25b4be 100644
--- a/Xext/xvdisp.c
+++ b/Xext/xvdisp.c
@@ -853,6 +853,9 @@ ProcXvPutImage(ClientPtr client)
height = stuff->height;
size = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage, &width,
&height, NULL, NULL);
+ if (size < 0)
+ return BadValue;
+
size += sizeof(xvPutImageReq);
size = bytes_to_int32(size);
--
2.56.0
++++++ bsc1285093_CVE-2026-109903.patch ++++++
>From c015738f8659207cf6d7807ad6f3b671a5f90b3b Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <[email protected]>
Date: Fri, 2 Oct 2026 15:58:58 +0200
Subject: [PATCH xserver 15/16] Xv: reject negative image size in
QueryImageAttributes
When ddQueryImageAttributes() overflows and returns a negative size,
QueryImageAttributes would still reply with that value cast to CARD32,
reporting a bogus data_size to the client.
Reject negative sizes with BadValue.
CVE-2026-109903
Reported-by: Tristan <[email protected]>
Signed-off-by: Olivier Fourdan <[email protected]>
Assisted-by: AI
---
Xext/xvdisp.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Xext/xvdisp.c b/Xext/xvdisp.c
index 55b25b4be..1c889c2aa 100644
--- a/Xext/xvdisp.c
+++ b/Xext/xvdisp.c
@@ -1006,6 +1006,10 @@ ProcXvQueryImageAttributes(ClientPtr client)
size = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage,
&width, &height,
offsets,
pitches);
+ if (size < 0) {
+ free(offsets);
+ return BadValue;
+ }
rep = (xvQueryImageAttributesReply) {
.type = X_Reply,
--
2.56.0
++++++ bsc1285094_CVE-2026-109904.patch ++++++
>From c29f66e65c42dc80bebad30991116f64c28c06bf Mon Sep 17 00:00:00 2001
From: Acts1631 <[email protected]>
Date: Tue, 21 Jul 2026 12:13:56 -0400
Subject: [PATCH xserver 07/16] XRes: prevent overflow in client ID request
size
On 32-bit servers, a QueryClientIds request can overflow
numSpecs * sizeof(xXResClientIdSpec) before REQUEST_FIXED_SIZE
checks it. A small request with a large numSpecs can therefore
pass validation and drive the normal or swapped handler past
the request buffer.
Reject numSpecs values that cannot be represented in the
request-size calculation before validating or accessing the array.
CVE-2026-109904
---
Xext/xres.c | 4 ++++
1 file changed, 4 insertions(+)
Index: xorg-server-21.1.25/Xext/xres.c
===================================================================
--- xorg-server-21.1.25.orig/Xext/xres.c
+++ xorg-server-21.1.25/Xext/xres.c
@@ -581,6 +581,8 @@ ProcXResQueryClientIds (ClientPtr client
InitConstructClientIdCtx(&ctx);
REQUEST_AT_LEAST_SIZE(xXResQueryClientIdsReq);
+ if (stuff->numSpecs > UINT32_MAX / sizeof(specs[0]))
+ return BadLength;
REQUEST_FIXED_SIZE(xXResQueryClientIdsReq,
stuff->numSpecs * sizeof(specs[0]));
