diff --git a/dix/enterleave.h b/dix/enterleave.h index 4b833d8a3..e8af924c6 100644 --- a/dix/enterleave.h +++ b/dix/enterleave.h @@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev, extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode); -extern void LeaveWindow(DeviceIntPtr dev); - extern void CoreFocusEvent(DeviceIntPtr kbd, int type, int mode, int detail, WindowPtr pWin); diff --git a/include/eventstr.h b/include/eventstr.h index 93308f9b2..a9926eaee 100644 --- a/include/eventstr.h +++ b/include/eventstr.h @@ -335,4 +335,7 @@ union _InternalEvent { GestureEvent gesture_event; }; +extern void +LeaveWindow(DeviceIntPtr dev); + #endif diff --git a/mi/mipointer.c b/mi/mipointer.c index a638f25d4..8cf003514 100644 --- a/mi/mipointer.c +++ b/mi/mipointer.c @@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) #ifdef PANORAMIX && noPanoramiXExtension #endif - ) - UpdateSpriteForScreen(pDev, pScreen); + ) { + DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER); + /* Hack for CVE-2023-5380: if we're moving + * screens PointerWindows[] keeps referring to the + * old window. If that gets destroyed we have a UAF + * bug later. Only happens when jumping from a window + * to the root window on the other screen. + * Enter/Leave events are incorrect for that case but + * too niche to fix. + */ + LeaveWindow(pDev); + if (master) + LeaveWindow(master); + UpdateSpriteForScreen(pDev, pScreen); + } } /**