XLibre Xserver
Go to file
Peter Hutterer 3e290b3c7c mi: reset the PointerWindows reference on screen switch
PointerWindows[] keeps a reference to the last window our sprite
entered - changes are usually handled by CheckMotion().

If we switch between screens via XWarpPointer our
dev->spriteInfo->sprite->win is set to the new screen's root window.
If there's another window at the cursor location CheckMotion() will
trigger the right enter/leave events later. If there is not, it skips
that process and we never trigger LeaveWindow() - PointerWindows[] for
the device still refers to the previous window.

If that window is destroyed we have a dangling reference that will
eventually cause a use-after-free bug when checking the window hierarchy
later.

To trigger this, we require:
- two protocol screens
- XWarpPointer to the other screen's root window
- XDestroyWindow before entering any other window

This is a niche bug so we hack around it by making sure we reset the
PointerWindows[] entry so we cannot have a dangling pointer. This
doesn't handle Enter/Leave events correctly but the previous code didn't
either.

CVE-2023-5380, ZDI-CAN-21608

This vulnerability was discovered by:
Sri working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit 564ccf2ce9)
2023-10-25 10:51:18 +10:00
.gitlab-ci ci: Install libxcvt from git 2021-08-06 11:29:29 +00:00
Xext Xext: fix invalid event type mask in XTestSwapFakeInput 2022-12-19 13:49:37 +10:00
Xi Xi/randr: fix handling of PropModeAppend/Prepend 2023-10-25 10:51:17 +10:00
composite composite: Fix use-after-free of the COW 2023-03-29 14:20:26 +02:00
config config: Fix platform busid parsing when there is no ID_PATH prop 2021-06-25 13:24:51 +03:00
damageext More missing version checks in SProcs 2021-08-08 12:43:01 +00:00
dbe meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
dix mi: reset the PointerWindows reference on screen switch 2023-10-25 10:51:18 +10:00
doc meson: Implement developer documentation build 2021-08-20 10:26:07 +00:00
dri3 meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
exa exa: rename some badly named variables 2020-07-10 06:17:40 +10:00
fb meson: hide C API if Xorg is disabled (like autotools) 2021-03-11 00:22:36 +00:00
glamor glamor: fix free of uninitialised pointers 2021-12-04 18:05:29 +02:00
glx glx/dri: Filter out fbconfigs that don't have a supported pixmap format 2022-01-01 14:46:19 +02:00
hw xquartz: Disable COMPOSITE at runtime 2023-01-17 15:19:10 -08:00
include mi: reset the PointerWindows reference on screen switch 2023-10-25 10:51:18 +10:00
m4 Add ax_pthread.m4 to m4/ 2016-05-29 19:20:51 -07:00
man Drop DMX DDX 2021-09-07 09:34:31 +00:00
mi mi: reset the PointerWindows reference on screen switch 2023-10-25 10:51:18 +10:00
miext rootless: Add additional debug logging to help triage XQuartz fb/rootless/damage crashes 2022-12-21 01:23:50 -08:00
os Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
present present: Send a PresentConfigureNotify event for destroyed windows 2023-04-24 10:13:27 +02:00
pseudoramiX Unvalidated lengths 2017-10-10 23:33:34 +02:00
randr Xi/randr: fix handling of PropModeAppend/Prepend 2023-10-25 10:51:17 +10:00
record record: Fix out of bounds access in SwapCreateRegister() 2021-12-15 10:41:18 +02:00
render render: Fix build with gcc 12 2022-01-28 10:36:28 +01:00
test tests: Fix build failure from missing micmap.c 2022-06-26 03:03:26 -07:00
xfixes xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() 2021-12-15 10:41:19 +02:00
xkb xkbUtils: use existing symbol names instead of deleted deprecated ones 2023-03-29 10:14:00 +02:00
.appveyor.yml Drop DMX DDX 2021-09-07 09:34:31 +00:00
.dir-locals.el .dir-locals.el: Add missing final newline 2019-10-01 17:05:28 +00:00
.gitignore .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
.gitlab-ci.yml ci: Install libxcvt from git 2021-08-06 11:29:29 +00:00
.travis.yml travis: Add OSX meson build to matrix 2019-05-02 15:42:58 +00:00
COPYING modesetting: Merge modesetting's COPYING into the xserver's. 2014-09-15 12:46:02 -07:00
Makefile.am Makefile.am: Add missing meson build files to release tarball 2021-11-06 21:22:23 +02:00
README.md Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
autogen.sh autogen: Set a default subject prefix for patches 2016-02-08 17:41:38 -05:00
configure.ac Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
devbook.am doc: Create a script to filter xmlto output 2015-01-05 14:24:06 -08:00
docbook.am docbook.am: embed css styles inside the HTML HEAD element 2011-09-21 14:07:49 -07:00
manpages.am man: Fix automake seddery 2018-05-08 12:15:30 -04:00
meson.build Switch to libbsd-overlay 2023-10-23 23:30:14 -04:00
meson_options.txt meson: Provide options to set CFBundleVersion and CFBundleVersionString in XQuartz 2022-06-19 23:10:48 -07:00
xorg-server.m4 xorg-server.m4: just all cflags instead of just sdkdir 2018-09-20 20:12:24 +01:00
xorg-server.pc.in xfree86: link modules against Xorg symbols on Cygwin 2012-04-05 21:57:07 -05:00
xserver.ent.in

X Server

The X server accepts requests from client applications to create windows, which are (normally rectangular) "virtual screens" that the client program can draw into.

Windows are then composed on the actual screen by the X server (or by a separate composite manager) as directed by the window manager, which usually communicates with the user via graphical controls such as buttons and draggable titlebars and borders.

For a comprehensive overview of X Server and X Window System, consult the following article: https://en.wikipedia.org/wiki/X_server

All questions regarding this software should be directed at the Xorg mailing list:

https://lists.freedesktop.org/mailman/listinfo/xorg

The primary development code repository can be found at:

https://gitlab.freedesktop.org/xorg/xserver

For patch submission instructions, see:

https://www.x.org/wiki/Development/Documentation/SubmittingPatches

As with other projects hosted on freedesktop.org, X.Org follows its Code of Conduct, based on the Contributor Covenant. Please conduct yourself in a respectful and civilized manner when using the above mailing lists, bug trackers, etc:

https://www.freedesktop.org/wiki/CodeOfConduct