xserver: Branch 'server-21.1-branch' - 6 commits
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Wed Dec 15 11:01:46 UTC 2021
Xext/saver.c | 2 +-
hw/xfree86/common/meson.build | 4 ++++
hw/xfree86/common/xf86Init.c | 13 -------------
hw/xfree86/os-support/meson.build | 2 +-
record/record.c | 4 ++--
render/render.c | 9 +++++++++
xfixes/cursor.c | 6 ++++--
7 files changed, 21 insertions(+), 19 deletions(-)
New commits:
commit 9fe2991075aca3321d59d03f3e45faca6cb718b8
Author: Sam James <sam at gentoo.org>
Date: Wed Dec 15 10:41:22 2021 +0200
hw/xfree86: fix sbus build for SPARC
Initially reported downstream in Gentoo. Manifests with errors like:
```
gnu/bin/ld: hw/xfree86/common/libxorg_common.a(xf86fbBus.c.o): in function `xf86ClaimFbSlot':
xf86fbBus.c:(.text+0x20): undefined reference to `sbusSlotClaimed'
/usr/lib/gcc/sparc-unknown-linux-gnu/11.2.0/../../../../sparc-unknown-linux-gnu/bin/ld: xf86fbBus.c:(.text+0x2c): undefined reference to `sbusSlotClaimed'
```
While we use the headers in meson.build, we don't reference xf86sbusBus.c
which defines the missing symbols like sbusSlotClaimed.
Bug: https://bugs.gentoo.org/828513
Signed-off-by: Sam James <sam at gentoo.org>
(cherry picked from commit 6c1a1fcc4bff90546ebc954f428c6df97005ea50)
diff --git a/hw/xfree86/common/meson.build b/hw/xfree86/common/meson.build
index 8f68556d8..7dc19c6f9 100644
--- a/hw/xfree86/common/meson.build
+++ b/hw/xfree86/common/meson.build
@@ -71,6 +71,10 @@ endif
if get_option('pciaccess')
srcs_xorg_common += ['xf86pciBus.c', 'xf86VGAarbiter.c']
+
+ if host_machine.cpu() == 'sparc' or host_machine.cpu() == 'sparc64'
+ srcs_xorg_common += 'xf86sbusBus.c'
+ endif
endif
srcs_xorg_common += custom_target(
diff --git a/hw/xfree86/os-support/meson.build b/hw/xfree86/os-support/meson.build
index 1f490a668..b6069ee85 100644
--- a/hw/xfree86/os-support/meson.build
+++ b/hw/xfree86/os-support/meson.build
@@ -19,7 +19,7 @@ if get_option('pciaccess')
if host_machine.system() != 'linux'
srcs_xorg_os_support += 'bus/bsd_pci.c'
endif
- if host_machine.cpu() == 'sparc'
+ if host_machine.cpu() == 'sparc' or host_machine.cpu() == 'sparc64'
srcs_xorg_os_support += 'bus/Sbus.c'
install_data('bus/xf86Sbus.h', install_dir: xorgsdkdir)
endif
commit 0b67785cd13e65d37416f75ab938bdc49cf4732f
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Wed Dec 15 10:41:21 2021 +0200
render: Fix out of bounds access in SProcRenderCompositeGlyphs()
ZDI-CAN-14192, CVE-2021-4008
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60)
diff --git a/render/render.c b/render/render.c
index c376090ca..456f156d4 100644
--- a/render/render.c
+++ b/render/render.c
@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
i = elt->len;
if (i == 0xff) {
+ if (buffer + 4 > end) {
+ return BadLength;
+ }
swapl((int *) buffer);
buffer += 4;
}
@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
buffer += i;
break;
case 2:
+ if (buffer + i * 2 > end) {
+ return BadLength;
+ }
while (i--) {
swaps((short *) buffer);
buffer += 2;
}
break;
case 4:
+ if (buffer + i * 4 > end) {
+ return BadLength;
+ }
while (i--) {
swapl((int *) buffer);
buffer += 4;
commit 7209982d2a89f2e27d2f83f8952e9512be813aa4
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Wed Dec 15 10:41:20 2021 +0200
Xext: Fix out of bounds access in SProcScreenSaverSuspend()
ZDI-CAN-14951, CVE-2021-4010
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit 6c4c53010772e3cb4cb8acd54950c8eec9c00d21)
diff --git a/Xext/saver.c b/Xext/saver.c
index 1d7e3cadf..f813ba08d 100644
--- a/Xext/saver.c
+++ b/Xext/saver.c
@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client)
REQUEST(xScreenSaverSuspendReq);
swaps(&stuff->length);
- swapl(&stuff->suspend);
REQUEST_SIZE_MATCH(xScreenSaverSuspendReq);
+ swapl(&stuff->suspend);
return ProcScreenSaverSuspend(client);
}
commit 6f09e7d3913a8188e32062f5e196bebb06bab140
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Wed Dec 15 10:41:19 2021 +0200
xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
ZDI-CAN-14950, CVE-2021-4009
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02)
diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 60580b88f..c5d4554b2 100644
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
{
REQUEST(xXFixesCreatePointerBarrierReq);
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
LEGAL_NEW_RESOURCE(stuff->barrier, client);
return XICreatePointerBarrier(client, stuff);
@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
swaps(&stuff->length);
swaps(&stuff->num_devices);
- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices));
+ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
+ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
swapl(&stuff->barrier);
swapl(&stuff->window);
commit a82d523edb30e5856adca9f258ac716108c71f19
Author: Povilas Kanapickas <povilas at radix.lt>
Date: Wed Dec 15 10:41:18 2021 +0200
record: Fix out of bounds access in SwapCreateRegister()
ZDI-CAN-14952, CVE-2021-4011
This vulnerability was discovered and the fix was suggested by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Povilas Kanapickas <povilas at radix.lt>
(cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768)
diff --git a/record/record.c b/record/record.c
index be154525d..e123867a7 100644
--- a/record/record.c
+++ b/record/record.c
@@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
swapl(pClientID);
}
if (stuff->nRanges >
- client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
- - stuff->nClients)
+ (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
+ - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
return BadLength;
RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
return Success;
commit a39218d99c6961dda0142d9956eb7404a37d9bd2
Author: Matthieu Herrb <matthieu at herrb.eu>
Date: Wed Dec 15 10:41:17 2021 +0200
remove the PRE_RELEASE message.
With the new numbering scheme, XORG_VERISON_SNAP doesn't mean
a pre-release version anymore.
Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
(cherry picked from commit 4de9666b6d3c86660d728ddfc13d88700e5ff20d)
diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 361781e0e..5695e71ac 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -110,23 +110,10 @@ static PixmapFormatRec formats[MAXFORMATS] = {
static int numFormats = 7;
static Bool formatsDone = FALSE;
-#ifndef PRE_RELEASE
-#define PRE_RELEASE XORG_VERSION_SNAP
-#endif
static void
xf86PrintBanner(void)
{
-#if PRE_RELEASE
- xf86ErrorFVerb(0, "\n"
- "This is a pre-release version of the X server from "
- XVENDORNAME ".\n" "It is not supported in any way.\n"
- "Bugs may be filed in the bugzilla at http://bugs.freedesktop.org/.\n"
- "Select the \"xorg\" product for bugs you find in this release.\n"
- "Before reporting bugs in pre-release versions please check the\n"
- "latest version in the X.Org Foundation git repository.\n"
- "See http://wiki.x.org/wiki/GitPage for git access instructions.\n");
-#endif
xf86ErrorFVerb(0, "\nX.Org X Server %d.%d.%d",
XORG_VERSION_MAJOR, XORG_VERSION_MINOR, XORG_VERSION_PATCH);
#if XORG_VERSION_SNAP > 0
More information about the xorg-commit
mailing list