Commit Graph

4 Commits

Author SHA1 Message Date
Michel Dänzer 919f1f46fc xfree86: Take second reference for SavedCursor in xf86CursorSetCursor
The same pointer is kept in CurrentCursor as well, therefore two
RefCursor calls are needed.

Fixes use-after-free after switching VTs.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067
2020-08-31 12:10:43 +02:00
Dave Airlie ea47af87f6 xserver/output: rename some badly named variables/APIs.
This is an API and ABI break

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2020-07-10 06:17:44 +10:00
Martin Weber 7ae221ad57 hw/xfree86: Avoid cursor use after free
During a VT-Switch a raw pointer to the shared cursor object
is saved which is then freed (in case of low refcount) by a call to
xf86CursorSetCursor with argument pCurs = NullCursor.
This leads to a dangling pointer which can follow in a use after free.

This fix ensures that there is a shared handle saved for the VT-Switch cycle.

Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
2020-06-24 08:02:59 +00:00
Mihail Konev 45546219e1 tests: Avoid libtool message
The "copying selected object files" message appears as some source
files have the same name, and some objects are included twice.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Mihail Konev <k.mvc@ya.ru>
2017-01-12 13:25:52 -05:00