frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

composite: Handle failure to redirect in compRedirectWindow() 

The function compCheckRedirect() may fail if it cannot allocate the
backing pixmap.

In that case, compRedirectWindow() will return a BadAlloc error.

However that failure code path will shortcut the validation of the
window tree marked just before, which leaves the validate data partly
initialized.

That causes a use of uninitialized pointer later.

The fix is to not shortcut the call to compHandleMarkedWindows() even in
the case of compCheckRedirect() returning an error.

CVE-2025-26599, ZDI-CAN-25851

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
This commit is contained in:
Olivier Fourdan 2024-12-17 15:19:45 +01:00
parent bba9df1a9d
commit c1ff84bef2
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
composite/compalloc.c
View File

@ -138,6 +138,7 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen); CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen);
WindowPtr pLayerWin; WindowPtr pLayerWin;
Bool anyMarked = FALSE; Bool anyMarked = FALSE;
int status = Success;
if (pWin == cs->pOverlayWin) { if (pWin == cs->pOverlayWin) {
return Success; return Success;
@ -216,13 +217,13 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
if (!compCheckRedirect(pWin)) { if (!compCheckRedirect(pWin)) {
FreeResource(ccw->id, X11_RESTYPE_NONE); FreeResource(ccw->id, X11_RESTYPE_NONE);
return BadAlloc; status = BadAlloc;
} }
if (anyMarked) if (anyMarked)
compHandleMarkedWindows(pWin, pLayerWin); compHandleMarkedWindows(pWin, pLayerWin);
return Success; return status;
} }
void void