xserver: Branch 'server-21.1-branch' - 2 commits

[GitLab Mirror]

 configure.ac |    4 ++--
 meson.build  |    4 ++--
 os/io.c      |    2 ++
 3 files changed, 6 insertions(+), 4 deletions(-)

New commits:
commit 2403cd5352b2a60d045b7f53c3c30002eb877f57
Author: Olivier Fourdan <ofourdan at redhat.com>
Date:   Wed Jun 18 17:55:42 2025 +0200

    xserver 21.1.18
    
    Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
    Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2029>

diff --git a/configure.ac b/configure.ac
index fdfc0b45e..de588e342 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 21.1.17, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
-RELEASE_DATE="2025-06-17"
+AC_INIT([xorg-server], 21.1.18, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
+RELEASE_DATE="2025-06-18"
 RELEASE_NAME="Caramel Ice Cream"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
diff --git a/meson.build b/meson.build
index 557b7d8d5..fff9a6cad 100644
--- a/meson.build
+++ b/meson.build
@@ -3,10 +3,10 @@ project('xserver', 'c',
             'buildtype=debugoptimized',
             'c_std=gnu99',
         ],
-        version: '21.1.17',
+        version: '21.1.18',
         meson_version: '>= 0.47.0',
 )
-release_date = '2025-06-17'
+release_date = '2025-06-18'
 
 add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
 cc = meson.get_compiler('c')
commit a659519ffa3eae4c94218b03e704a2b6d26adf6f
Author: Olivier Fourdan <ofourdan at redhat.com>
Date:   Wed Jun 18 08:39:02 2025 +0200

    os: Check for integer overflow on BigRequest length
    
    Check for another possible integer overflow once we get a complete xReq
    with BigRequest.
    
    Related to CVE-2025-49176
    
    Signed-off-by: Olivier Fourdan <ofourdan at redhat.com>
    Suggested-by: Peter Harris <pharris2 at rocketsoftware.com>
    (cherry picked from commit 4fc4d76b2c7aaed61ed2653f997783a3714c4fe1)
    
    Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2029>

diff --git a/os/io.c b/os/io.c
index 26f9161ef..83986af92 100644
--- a/os/io.c
+++ b/os/io.c
@@ -395,6 +395,8 @@ ReadRequestFromClient(ClientPtr client)
                     needed = get_big_req_len(request, client);
             }
             client->req_len = needed;
+            if (needed > MAXINT >> 2)
+                return -(BadLength);
             needed <<= 2;
         }
         if (gotnow < needed) {