Commit Graph

19027 Commits

Author SHA1 Message Date
Enrico Weigelt, metux IT consult 4742790351 mi: unexport mieqFini()
Not used by any driver/module, so no need to keep it public.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1727>
2025-02-06 16:45:20 +02:00
Enrico Weigelt, metux IT consult 5ac361cce9 mi: unexport mieqInit()
Not used by any drivers/modules so no need to keep it public.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1727>
2025-02-06 16:45:20 +02:00
Enrico Weigelt, metux IT consult 8a6bbc80f3 mi: unexport miStepDash()
Not used by any module/driver, so no need to keep it public.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1727>
2025-02-06 16:45:20 +02:00
Enrico Weigelt, metux IT consult aaaa0a35e5 mi: unexport miWideArc()
It's not used by any modules/drivers, so no need to keep it public.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1727>
2025-02-06 16:45:20 +02:00
Enrico Weigelt, metux IT consult 12c507cd1f mi: make CopyGetMasterEvent() static
It's not used outside mieq.c, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1727>
2025-02-06 16:45:20 +02:00
Enrico Weigelt, metux IT consult 6dbb957922 mi: make miRecolorCursor() static
It's only used inside mipointer.c, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1727>
2025-02-06 16:45:20 +02:00
Enrico Weigelt, metux IT consult 471147d4b9 mi: unexport miPointerPrivKeyRec
Not used by any (known) driver, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult 8ca88b8f75 mi: unexport miPointerUpdateSprite()
Not used by any (known) drivers, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult 4933780f28 mi: unexport miPointerInvalidateSprite()
Not used by any drivers, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult fdd509f345 mi: unexport miPointerUpdateSprite()
Not used by any (known) driver, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult 64cd343569 mi: unexport miPointerSetScreen()
Not used by any (known) drivers, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult 6c04f94f3b mi: unexport miPointerWarpCursor()
Not used by any known drivers, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult 44c2e08877 mi: unexport miPointerInitialize()
It's not used by any drivers/modules, so no need to keep it exported.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1505>
2025-02-06 14:38:05 +00:00
Enrico Weigelt, metux IT consult c8daf76c3e glx: drop obsolete warnings on files being generated
These files haven't been auto-generated, but instead manually changed for
at least over a decade now, so these warnings have become wrong.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1728>
2025-02-06 14:29:54 +00:00
Enrico Weigelt, metux IT consult 2d8af9cc5e glx: drop obsolete glxbyteorder.h
It's just a local header, doing nothing more than including misc.h,
so we can just include misc.h directly and drop glxbyteorder.h

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1728>
2025-02-06 14:29:54 +00:00
Olivier Fourdan e8784b7d89 xwayland/glamor: Disable GLAMOR after GBM cleanup
The cleanup function for GBM is called on the various error paths.

Once xwl_glamor_gbm_cleanup() has been called, GBM support is no longer
usable (and the corresponding data structures are freed), so there is
no way we can keep using GLAMOR after that point.

Make sure to explicitly disable GLAMOR support in that case, so we do
not crash later on trying to use GBM.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1768>
2025-02-04 11:46:25 +01:00
Michel Dänzer b27b5cd5f3 xwayland/glamor: Clean-up GBM's screen private on failure
If we bail out initializing GBM glamor backend, the screen private for
the GBM backend may remain, pointing at freed memory.

To avoid that issue, make sure to clear up the screen's private for the
GBM backend.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1785
Signed-off-by: Michel Dänzer <michel@daenzer.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1768>
2025-02-04 11:45:56 +01:00
Julian Orth 45c1d22ff6 xwayland: Don't run key behaviors and actions
Consider the following keymap:

```xkb
xkb_keymap {
    xkb_keycodes {
        <compose> = 135;
    };
    xkb_symbols {
        key <compose> {
            [ SetGroup(group = +1) ]
        };
    };
};
```

When the user presses the compose key, the following happens:

1. The compositor forwards the key to Xwayland.
2. Xwayland executes the SetGroup action and sets the base_group to 1
   and the effective group to 1.
3. The compositor updates its own state and sends the effective group,
   1, to Xwayland.
4. Xwayland sets the locked group to 1 and the effective group to
   1 + 1 = 2.

This is wrong since pressing compose should set the effective group to 1
but to X applications the effective group appears to be 2.

This commit makes it so that Xwayland completely ignores the key
behaviors and actions of the keymap and only updates the modifier and
group components in response to the wayland modifiers events.

Signed-off-by: Julian Orth <ju.orth@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1758>
2025-02-03 05:37:48 +00:00
Julian Orth 8d9184db5f xwayland: copy repeat settings from the compositor map
Previously the repeat settings sent by the compositor were completely
ignored.

Signed-off-by: Julian Orth <ju.orth@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1759>
2025-01-28 15:32:20 +01:00
Alan Coopersmith 6cc358dfb4 os: if inet_ntop() is available, use it for IPv4 addresses as well
Support for using inet_ntop() was originally added to support IPv6,
and only used for IPv6 addresses in AuthAudit().  Two decades later,
support for inet_ntop() is ubiquitous and OS'es have marked inet_ntoa()
as deprecated, so use the modern interface for IPv4 as well now.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1760>
2025-01-27 22:34:51 +00:00
Alan Coopersmith 2ffe0f8a35 os: if getaddrinfo() is available, use it, even if IPv6 support is disabled
Support for using getaddrinfo() was originally added to support IPv6,
and only used if IPv6 support was enabled.  Two decades later, support
for getaddrinfo() is ubiquitous and OS'es have marked gethostbyname()
as deprecated, so use the modern interface whenever we can now.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1760>
2025-01-27 22:34:51 +00:00
Pierre-Eric Pelloux-Prayer 5397854877 glamor: reject configs using unsupported rgbBits size
The supported color depths is a hardcoded list for now, so we
need to honor the value exposed there otherwise we'll get
inconsistencies between what glXGetFBConfigs and XListDepths
report to applications.

Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1764>
2025-01-21 09:16:52 +00:00
Pierre-Eric Pelloux-Prayer 83b13387ab glamor: use gbm_format_for_depth instead of open-coding it
This way glamor_back_pixmap_from_fd deals with the same depth
values as glamor_pixmap_from_fds.

Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1764>
2025-01-21 09:16:52 +00:00
Pierre-Eric Pelloux-Prayer 87afcc7699 glamor: return the result of gbm_format_for_depth
This way the caller knows if the conversion failed.
While at it, check for width/height at the same time.

Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1764>
2025-01-21 09:16:52 +00:00
Olivier Fourdan 080fb49eff os/connection: Make sure partial is initialized
Following the change in Xtrans 1.5 that allows for partial connections
to succeed, we need to make sure partial is properly initialized at
first, otherwise we rely on an uninitialized variable.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Twaik Yont <twaikyont@gmail.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1783
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1765>
2025-01-17 08:24:19 +00:00
Olivier Fourdan 92bcebfd7e xkb: Always use MAP_LENGTH keymap size
Generating the modifier modmap, the helper function generate_modkeymap()
would check the entire range up to the MAP_LENGTH.

However, the given keymap might have less keycodes than MAP_LENGTH, in
which case we would go beyond the size of the modmap, as reported by
ASAN:

==ERROR: AddressSanitizer: heap-buffer-overflow
READ of size 1 at 0x5110001c225b thread T0
    #0 0x5e7369393873 in generate_modkeymap ../dix/inpututils.c:309
    #1 0x5e736930dcce in ProcGetModifierMapping ../dix/devices.c:1794
    #2 0x5e7369336489 in Dispatch ../dix/dispatch.c:550
    #3 0x5e736934407d in dix_main ../dix/main.c:275
    #5 0x7e46d47b2ecb in __libc_start_main
    #6 0x5e73691be324 in _start (xserver/build/hw/xwayland/Xwayland)

Address is located 0 bytes after 219-byte region
allocated by thread T0 here:
    #0 0x7e46d4cfc542 in realloc
    #1 0x5e73695aa90e in _XkbCopyClientMap ../xkb/xkbUtils.c:1142
    #2 0x5e73695aa90e in XkbCopyKeymap ../xkb/xkbUtils.c:1966
    #3 0x5e73695b1b2f in XkbDeviceApplyKeymap ../xkb/xkbUtils.c:2023
    #4 0x5e73691c6c18 in keyboard_handle_keymap ../hw/xwayland/xwayland-input.c:1194

As MAP_LENGTH is used in various code paths where the max keycode might
not be easily available, best is to always use MAP_LENGTH to allocate the
keymaps so that the code never run past the buffer size.

If the max key code is smaller than the MAP_LENGTH limit, fill-in the gap
with zeros.

That also simplifies the code slightly as we do not constantly need to
reallocate the keymap to adjust to the max key code size.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1780
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1762>
2025-01-13 11:44:11 +01:00
Olivier Fourdan 8707d2835c xwayland: Do not keep the cursor's pixmap around
Currently, Xwayland creates a pixmap backed by shared memory buffer as
soon as an X11 cursor is realized, which is destroyed when the cursor is
eventually unrealized.

If an X11 client is leaking cursors, Xwayland will be creating new
pixmaps continuously, which will eventually cause an error once the
limit is reached, and get Xwayland killed.

However, we do not need the shared memory buffer to stay around, we
already have the buffer retention mechanism which will take care of
keeping the buffer around until the Wayland compositor is done with it,
so we could just create and destroy the pixmap as needed when setting
the cursor.

That would not fix the leak in the X11 application, yet that would
mitigate the risk of Xwayland being killed by reaching the shared memory
limits, until the client itself reaches the limit of X11 resources.

v2: Don't increase the pixmap refcnt to destroy it just after (Michel)

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Michel Dänzer <michel@daenzer.net>
See-also: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1773
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1754>
2024-12-20 09:29:03 +01:00
Matt Turner bdacb100bf hw/xfree86: Fix -Wincompatible-pointer-types sbus compile failure
```
../hw/xfree86/common/xf86sbusBus.c: In function ‘xf86SbusConfigureNewDev’:
../hw/xfree86/common/xf86sbusBus.c:751:21: error: passing argument 1 of ‘XNFasprintf’ from incompatible pointer type [-Wincompatible-pointer-types]
  751 |         XNFasprintf(&GDev->busID, "SBUS:%s", promPath);
      |                     ^~~~~~~~~~~~
      |                     |
      |                     const char **
```

Apply the same fix as in commit e1e01d2e3 ("xfree86/common: Warning
fixes. Mostly const string handling.")

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1751>
2024-12-16 22:41:47 -05:00
Matt Turner 00a96cd82a hw/xfree86: Fix -Wmissing-prototypes warnings
None of these functions are used elsewhere in the Xserver nor in any of
the xf86-video-sun* DDXs.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1751>
2024-12-16 22:41:04 -05:00
Peter Hutterer 298c5dcb02 Ignore the coding style change commit during git blame
git supports ignoring specific revs during git blame, configured via

  $ git config blame.ignoreRevsFile .git-blame-ignore-revs

Let's make this easier for developers to set up, starting with the
one massive coding style change commit.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1748>
2024-12-06 09:55:53 +10:00
Olivier Fourdan e4804d11e8 xwayland: Add xdg-system-bell support
For the Wayland compositors who do not implement XkbBellNotifyMask but
support the Wayland protocol xdg-system-bell, use that to ring the
bell.

v2: Be more selective on the device, make sure it's a keyboard and it
    has core events.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1742>
2024-12-02 08:55:34 +00:00
Olivier Fourdan 1ccc19d1df build: Bump wayland-protocols requirement to 1.38
To get xdg-system-bell-v1 protocol.

This is just preparation work for the next commits.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1742>
2024-12-02 08:55:34 +00:00
Olivier Fourdan a55ed3309b ci: Install wayland-protocols 1.38
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1742>
2024-12-02 08:55:34 +00:00
Olivier Fourdan d98b36461a ci: Check for DDXen to be built
Add a script in CI to check for the mere presence of the expected DDXen
to be built.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1743>
2024-11-19 09:19:15 +01:00
Olivier Fourdan fbedb9b12b ci: Force build of default DDXen in the default target
If any dependency that a DDX requires is missing, the build of the DDX
will be automatically disabled, and the CI check will succeed.

We want the build to fail if any of the expected DDX cannot be built in
the CI, so let's force-enable them at build time.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>

v2: Use a variable for the DDX build args (Peter Hutterer
    <peter.hutterer@who-t.net>)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1743>
2024-11-19 09:19:15 +01:00
Alan Coopersmith cac0d08102 Revert "xfree86: os-support: move CONSOLE_X_BELL into bsd_bell.c"
This reverts commit 8958a99c02.
It broke the build of the xf86-input-keyboard driver, which relies
on CONSOLE_X_BELL in src/bsd_kbd.c.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1741>
2024-11-13 16:47:52 -08:00
Alan Coopersmith 5268fbd7cf xkbtext_priv.h: fix typo in header guard definition
Found by clang 13.0.1:

../xkb/xkbtext_priv.h:5:9: warning: '_XSERVER_XKB_XKBTEXT_PRIV_H' is used
 as a header guard here, followed by #define of a different macro
 [-Wheader-guard]
#ifndef _XSERVER_XKB_XKBTEXT_PRIV_H
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
../xkb/xkbtext_priv.h:6:9: note: '_XSERVER_XKB_XKBTEXt_PRIV_H' is defined
 here; did you mean '_XSERVER_XKB_XKBTEXT_PRIV_H'?
#define _XSERVER_XKB_XKBTEXt_PRIV_H
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
        _XSERVER_XKB_XKBTEXT_PRIV_H

Fixes: 434044cb0 ("xkb: unexport functions from xkbtext.c")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1740>
2024-11-10 12:51:10 -08:00
Sérgio Basto 4cd7e2e819 Revert "fb: Declare wfbFinishScreenInit, wfbScreenInit for !FB_ACCESS_WRAPPER"
This reverts commit 34a430a16e

Signed-off-by: Sérgio M. Basto <sergio@serjux.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1720>
2024-11-08 17:42:09 +00:00
Michel Dänzer 8c4b137237 xwayland: Always decrement expecting_event in xwl_output_create
If we bail without decrementing it, xwl_screen_init will keep waiting
indefinitely for an event which never arrives.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1739>
2024-11-05 09:28:46 +00:00
Michel Dänzer 375c35a5e4 xwayland/glamor: Drop expecting_event bailing from xwl_drm_handle_device
If we bail without decrementing xwl_screen->expecting_event,
xwl_screen_init will keep waiting indefinitely for an event which never
arrives.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1648
Fixes: 2f113d68f6 ("xwayland: Add glamor and DRI3 support")
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1739>
2024-11-05 09:28:46 +00:00
Alan Coopersmith a1b5aa5a7f dix-config.h: add HAVE_SOCKLEN_T definition
Needed to build with IPv6 disabled using gcc 14 on some platforms to avoid:

In file included from /usr/X11/include/X11/Xtrans/transport.c:67,
                 from xstrans.c:17:
/usr/X11/include/X11/Xtrans/Xtranssock.c: In function ‘_XSERVTransSocketOpen’:
/usr/X11/include/X11/Xtrans/Xtranssock.c:467:28: error: passing argument 5
 of ‘getsockopt’ from incompatible pointer type [-Wincompatible-pointer-types]
  467 |             (char *) &val, &len) == 0 && val < 64 * 1024)
      |                            ^~~~
      |                            |
      |                            size_t * {aka long unsigned int *}

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1736>
2024-10-30 12:26:58 -07:00
Michel Dänzer 56ba0b2a5f xwayland/present: Check allow_commits in xwl_present_flip
We're not supposed to call wl_surface_commit while
xwl_window->allow_commits is false. Bailing results in falling back to
a copy.

Noticed by inspection while looking into an issue which turned out to be
due to something else.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1764
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1732>
2024-10-30 10:56:31 +00:00
Matthieu Herrb 85b7765714 xkb: Fix buffer overflow in _XkbSetCompatMap()
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.

However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.

This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).

CVE-2024-9632, ZDI-CAN-24756

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1733>
2024-10-29 14:41:59 +01:00
Alan Coopersmith bf63d9b34e modesetting: avoid memory leak when ms_present_check_unflip() returns FALSE
Found by Oracle Parfait 13.3 static analyzer:
   Memory leak [memory-leak]:
      Memory leak of pointer event allocated with calloc(1, 16)
        at line 470 of hw/xfree86/drivers/modesetting/present.c in
	function 'ms_present_unflip'.
          event allocated at line 431 with calloc(1, 16)
          event leaks when ms_present_check_unflip(...) == 0 at line 438
              and i >= config->num_crtc at line 445

Fixes: 13c7d53df ("modesetting: Implement page flipping support for Present.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
2024-10-28 05:38:25 +00:00
Alan Coopersmith b65eea43dd dix: limit checks to MAX_VALUATORS when generating Xi events
Previously, it was looping through sizeof(ev->valuators.mask) * 8
valuators, where valuators.mask is defined as an array of
(MAX_VALUATORS + 7) / 8 entries.  Since MAX_VALUATORS is defined as 36,
this made it actually loop through 40 entries.  The last 4 bits in this
array should never be set, so we should never access memory outside the
bounds of the arrays defined to be exactly MAX_VALUATORS in length, but
we can make the static analyzer happier and not waste time checking bits
that should never be set.

Found by Oracle Parfait 13.3 static analyzer:

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 741 of dix/eventconvert.c in function 'eventToDeviceEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 808 of dix/eventconvert.c in function 'eventToRawEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data_raw[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 809 of dix/eventconvert.c in function 'eventToRawEvent'.

Fixes: b2ba77bac ("dix: add EventToXI2 and GetXI2Type.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
2024-10-28 05:38:25 +00:00
Alan Coopersmith 4b073d65bb dix: fix button offset when generating DeviceButtonStateNotify events
Found by Oracle Parfait 13.3 static analyzer:
   Buffer Overflow in STD C function [buffer-overflow-call-stdc]:
      Buffer overflow in call to memcpy. Buffer &bev->buttons[4] of
       size 24 is written at an offset of 28
      Array size is 28 bytes, index is 32
        at line 743 of dix/enterleave.c in function
	 'DeliverStateNotifyEvent'.

Fixes: a85f0d6b9 ("Xi: fix use of button->down - bitflags instead of int arrays.")
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
2024-10-28 05:38:25 +00:00
Alan Coopersmith 7af077dd2f render: avoid NULL pointer dereference if PictureFindVisual returns NULL
Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer pVisual
        at line 257 of dix/colormap.c in function 'CreateColormap'.
          Null pointer introduced at line 412 of render/picture.c in
	   function 'PictureFindVisual'.
          Constant 'NULL' passed into function CreateColormap, argument
	   pVisual, from call at line 431 in function
	   'PictureInitIndexedFormat'.
          Function PictureFindVisual may return constant 'NULL' at
	   line 412, called at line 429.

Fixes: d4a101d4e ("Integration of DAMAGE-XFIXES branch to trunk")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
2024-10-28 05:38:25 +00:00
Alan Coopersmith d10589cc09 Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL
The comments in that function say "This only happens if master is a
slave device. don't do that" but static analysis doesn't respect that.

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestptr
        at line 274 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 273 of Xi/xichangehierarchy.c in function
	   'remove_master'.
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestkeybd
        at line 279 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 278 of Xi/xichangehierarchy.c in function
	   'remove_master'.

Fixes: 0814f511d ("input: store the master device's ID in the devPrivate for XTest devices.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
2024-10-28 05:38:25 +00:00
Alan Coopersmith fa711c486a xfree86: avoid memory leak on realloc failure
Found by Oracle Parfait 13.3 static analyzer:
   Memory leak [memory-leak]:
      Memory leak of pointer optname allocated with asprintf(&optname,
      "\"%s\"", p->name)
        at line 326 of hw/xfree86/common/xf86Configure.c in function
	'configureDeviceSection'.
          optname allocated at line 309 with asprintf(&optname, "\"%s\"",
	  p->name)

Fixes: code inherited from XFree86
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
2024-10-28 05:38:25 +00:00
Alan Coopersmith 45c485bfdf dix: Use __builtin_popcountl if available to replace Ones()
If the compiler knows of a better algorithm for counting the number of
bits set in a word for the target CPU, let it use that, instead of the
classic algorithm optimized for PDP-6.

Based on xorg/lib/libxext@490a25e6f8a4d2482af4364c700b68ad11a4d10b

v2: make old version static inline, stop exporting after !1695

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1674>
2024-10-26 10:04:13 -07:00