Needed by the int10 module, so has to be in the symbol table.
But still not supposed to be used by out-of-tree drivers.
Reported-by: stefan11111 <stefan11111@shitposting.expert>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Needed by the int10 module, so has to be in the symbol table.
But still not supposed to be used by out-of-tree drivers.
Reported-by: stefan11111 <stefan11111@shitposting.expert>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Check for another possible integer overflow once we get a complete xReq
with BigRequest.
Related to CVE-2025-49176
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
When reading requests from the clients, the input buffer might be shared
and used between different clients.
If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.
To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.
CVE-2025-49178
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
The BigRequest extension allows requests larger than the 16-bit length
limit.
It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.
In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.
To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.
The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.
To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.
CVE-2025-49176
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
Protect from NULL parameter to %s directive.
See also: https://github.com/X11Libre/xserver/issues/36
Signed-off-by: Herman Semenov <GermanAizek@yandex.ru>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This loads the configuration (simple text file) passed via command line.
For now just supporting static configuration, that's loaded on server
startup.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Parses an option that may either be used for setting an integer value or
given one or multiple times (without argument) to increase an value
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The variables that can be set via this function are all now being
accessed directly. Not callers left, so drop it.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need for extra call to some demuxer function for nothing but setting a
simple bool variable. Setting the sync flag really is nothing more than just
writing some value into a variable, so it's trivial to just to do that, instead
of having an unncessarily complex "universal setter" for that.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need for extra call to some demuxer function for nothing but setting a
simple int variable. Setting verbosity level really is nothing more than just
writing some value into a variable, so it's trivial to just to do that, instead
of having an unncessarily complex "universal setter" for that.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need for extra call to some demuxer function for nothing but setting a
simple int variable. Setting verbosity level really is nothing more than just
writing some value into a variable, so it's trivial to just to do that, instead
of having an unncessarily complex "universal setter" for that.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Lots of logging functions, especially init and teardown aren't called
by any drivers/modules, so no need to keep them exported.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
On SunOS, the BSD socket API as well as hostname lookups isn't
implemented in libc, but separate libraries. We need to link them
explicitly.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Several feature defines need to be set before including system headers,
otherwise build breaks:
> /usr/include/X11/Xtrans/Xtranssock.c: In function '_XSERVTransSocketRead':
> /usr/include/X11/Xtrans/Xtranssock.c:2161:14: error: 'struct msghdr' has no member named 'msg_control'
> 2161 | .msg_control = cmsgbuf.buf,
> | ^~~~~~~~~~~
> /usr/include/X11/Xtrans/Xtranssock.c:2162:14: error: 'struct msghdr' has no member named 'msg_controllen'
> 2162 | .msg_controllen = CMSG_LEN(MAX_FDS * sizeof(int))
> | ^~~~~~~~~~~~~~
>
> ../os/access.c:339:14: error: implicit declaration of function 'asprintf'; did you mean 'Xasprintf'? [-Werror=implicit-function-declaration]
> 339 | length = asprintf(addr, "%s%c%s", type, delimiter, value);
> | ^~~~~~~~
> | Xasprintf
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Since most of the extension init logic (and on/off switches for them)
is driven from miext, this seems the appropriate place for the header.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Instead of having lots of #ifdef's, consolidating the conditionally
compiled fsync() call into a tiny inline helper.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Since we're not indirectly writing via FILE anymore, this option has
become meaningless: it meant flushing out our in-process buffer to
the kernel, but we're now doing direct write() calls anyways.
xf86 still accepts the "flush" config file flag for backwards compatibility,
but it hasn't any practical meaning anymore.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Instead of maintaining both the logfile fd, as well as ANSI FILE pointer,
simplify it to just a fd.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Not used by any drivers, and wouldn't even make sense doing so,
thus no need to keep it exported.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Not used by any external drivers/modules, so no need to keep it public.
Since modesetting is using it, still needs _X_EXPORT, as long as it's
a module.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Only key difference that calloc(), in contrast to rellocarray(),
is zero-initializing. The overhead is hard to measure on today's
machines, and it's safer programming practise to always allocate
zero-initialized, so one can't forget to do it explicitly.
Cocci rule:
@@
expression COUNT;
expression LEN;
@@
- xallocarray(COUNT,LEN)
+ calloc(COUNT,LEN)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Not used by any external modules, and an implementation
detail anyways, so no need to keep it in public header.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The supported platforms already have asprintf() and vasprintf(),
so there's no need for having our own implementation anymore.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Protect the Add() proto funcs from adding duplicate auth keys.
If adding a duplicate is attempted, the XID of the already
existing one is returned instead.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need for loading the address into temporary variable and later doing
indirect call, since we can easily do direct call in each branch.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
XID = 0 already is used as sign for error in several places,
so let's use that here, too.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Generate the auth object XIDs inside the proto funcs and only
on success, so we don't unnecessarily allocate XIDs.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
No need to explicitly hard-code strings lengths when we can use
standard strlen(). Those code pathes are so cold that trying to
spare a few cycled for an (usually inlined) strlen() doesn't seem
to justify any extra care.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The code is easier to understand, but also more robust (eg. against struct
layout changes) if structs are initialized with explicit field names
instead of as lists.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Using calloc() instead of malloc() as preventive measure, so there
never can be any hidden bugs or leaks due uninitialized memory.
The extra cost of using this compiler intrinsic should be practically
impossible to measure - in many cases a good compiler can even deduce
if certain areas really don't need to be zero'd (because they're written
to right after allocation) and create more efficient machine code.
The code pathes in question are pretty cold anyways, so it's probably
not worth even thinking about potential extra runtime costs.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Enrico Weigelt, metux IT consult
Olivier Fourdan
Hermann Semenov
dasha_uwu
dec05eba