frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
XLibre Xserver
17,801 Commits 293 Branches 13 Tags 61 MiB
C 96.4%
Roff 1.1%
Objective-C 1%
Meson 0.8%
Shell 0.2%
Other 0.3%
Go to file
Olivier Fourdan 42113ab289 xwayland/present: Fix use-after-free in xwl_unrealize_window() 
When a window is unrealized, Xwayland would destroy the Wayland surface
prior to unrealizing the present window.

xwl_present_flip() will then do a wl_surface_commit() of that surface,
hence causing a use-after-free:

 Invalid read of size 8
    at 0x49F7FD4: wl_proxy_marshal_array_flags (wayland-client.c:852)
    by 0x49F823A: wl_proxy_marshal_flags (wayland-client.c:784)
    by 0x42B877: wl_surface_commit (wayland-client-protocol.h:3914)
    by 0x42CAA7: xwl_present_flip (xwayland-present.c:717)
    by 0x42CD0E: xwl_present_execute (xwayland-present.c:783)
    by 0x42C26D: xwl_present_msc_bump (xwayland-present.c:416)
    by 0x42C2D1: xwl_present_timer_callback (xwayland-present.c:433)
    by 0x42BAC4: xwl_present_reset_timer (xwayland-present.c:149)
    by 0x42D1F8: xwl_present_unrealize_window (xwayland-present.c:945)
    by 0x4230E2: xwl_unrealize_window (xwayland-window.c:616)
    by 0x4FCDD8: compUnrealizeWindow (compwindow.c:292)
    by 0x4F3F5C: UnrealizeTree (window.c:2805)
  Address 0x1390b8d8 is 24 bytes inside a block of size 80 free'd
    at 0x48470E4: free (vg_replace_malloc.c:872)
    by 0x49F8029: wl_proxy_destroy_caller_locks (wayland-client.c:523)
    by 0x49F8029: wl_proxy_marshal_array_flags (wayland-client.c:861)
    by 0x49F823A: wl_proxy_marshal_flags (wayland-client.c:784)
    by 0x421984: wl_surface_destroy (wayland-client-protocol.h:3672)
    by 0x423052: xwl_unrealize_window (xwayland-window.c:599)
    by 0x4FCDD8: compUnrealizeWindow (compwindow.c:292)
    by 0x4F3F5C: UnrealizeTree (window.c:2805)
    by 0x4F424B: UnmapWindow (window.c:2863)
    by 0x4EF58C: DeleteWindow (window.c:1075)
    by 0x4E24B3: doFreeResource (resource.c:885)
    by 0x4E2ED7: FreeClientResources (resource.c:1151)
    by 0x4ACBA4: CloseDownClient (dispatch.c:3546)
  Block was alloc'd at
    at 0x4849464: calloc (vg_replace_malloc.c:1328)
    by 0x49F7F29: zalloc (wayland-private.h:233)
    by 0x49F7F29: proxy_create (wayland-client.c:422)
    by 0x49F7F29: create_outgoing_proxy (wayland-client.c:664)
    by 0x49F7F29: wl_proxy_marshal_array_flags (wayland-client.c:831)
    by 0x49F823A: wl_proxy_marshal_flags (wayland-client.c:784)
    by 0x4218CA: wl_compositor_create_surface (wayland-client-protocol.h:1291)
    by 0x422A0D: ensure_surface_for_window (xwayland-window.c:445)
    by 0x4231E8: xwl_window_set_window_pixmap (xwayland-window.c:647)
    by 0x5232D6: damageSetWindowPixmap (damage.c:1565)
    by 0x4FC7BC: compSetPixmapVisitWindow (compwindow.c:129)
    by 0x4EDB3F: TraverseTree (window.c:441)
    by 0x4FC851: compSetPixmap (compwindow.c:151)
    by 0x4F8C1A: compAllocPixmap (compalloc.c:616)
    by 0x4FC938: compCheckRedirect (compwindow.c:174)

To avoid that, call xwl_present_unrealize_window() before destroying the
Wayland surface.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
 		2022-03-15 08:59:19 +00:00
.gitlab-ci Update the CI to provide wayland-protocols 1.22 2021-12-07 10:02:29 +00:00
Xext Xext: Fix out of bounds access in SProcScreenSaverSuspend() 2021-12-14 15:00:02 +02:00
Xi dix: Correctly save replayed event into GrabInfoRec 2022-02-09 11:33:03 +00:00
composite Remove autotools support 2021-10-27 13:15:40 +03:00
config config/wscons: Always attach the "ws" driver for pointer devices, 2022-02-06 12:48:39 +02:00
damageext Remove autotools support 2021-10-27 13:15:40 +03:00
dbe Remove autotools support 2021-10-27 13:15:40 +03:00
dix dix: Don't send touch end to clients that do async grab without touches 2022-02-12 15:26:30 +00:00
doc Remove autotools support 2021-10-27 13:15:40 +03:00
dri3 Remove autotools support 2021-10-27 13:15:40 +03:00
exa Remove autotools support 2021-10-27 13:15:40 +03:00
fb Remove autotools support 2021-10-27 13:15:40 +03:00
glamor glamor: fix free of uninitialised pointers 2021-12-03 20:54:46 +11:00
glx glx/dri: Filter out fbconfigs that don't have a supported pixmap format 2021-12-19 10:26:03 +00:00
hw xwayland/present: Fix use-after-free in xwl_unrealize_window() 2022-03-15 08:59:19 +00:00
include dix: Correctly save replayed event into GrabInfoRec 2022-02-09 11:33:03 +00:00
m4 Add ax_pthread.m4 to m4/ 2016-05-29 19:20:51 -07:00
man Remove autotools support 2021-10-27 13:15:40 +03:00
mi Remove autotools support 2021-10-27 13:15:40 +03:00
miext Remove autotools support 2021-10-27 13:15:40 +03:00
os Remove autotools support 2021-10-27 13:15:40 +03:00
present present: Check for NULL to prevent crash 2022-01-19 10:23:20 -08:00
pseudoramiX Remove autotools support 2021-10-27 13:15:40 +03:00
randr randr: add new interface to allow delaying lease responses 2021-12-07 10:02:29 +00:00
record record: Fix out of bounds access in SwapCreateRegister() 2021-12-14 15:00:00 +02:00
render render: Fix build with gcc 12 2022-01-25 16:16:30 +01:00
test test: #undef NDEBUG so assert is not compiled away 2021-12-08 20:59:21 +00:00
xfixes xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier() 2021-12-14 15:00:01 +02:00
xkb xkb: fix XkbSetMap when changing a keysym without changing a keytype 2022-02-03 21:44:37 +00:00
.appveyor.yml appveyor: Add libxcvt build dep 2021-11-04 13:03:25 +00:00
.dir-locals.el .dir-locals.el: Add missing final newline 2019-10-01 17:05:28 +00:00
.gitignore .gitignore: Add new autotools file 'test-driver' 2014-04-21 13:41:42 -07:00
.gitlab-ci.yml Update the CI to provide wayland-protocols 1.22 2021-12-07 10:02:29 +00:00
.travis.yml travis: Add OSX meson build to matrix 2019-05-02 15:42:58 +00:00
COPYING modesetting: Merge modesetting's COPYING into the xserver's. 2014-09-15 12:46:02 -07:00
README.md Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
meson.build require wayland-protocols 1.22 2021-12-07 10:02:29 +00:00
meson_options.txt Fix spelling of Xwayland 2021-12-17 16:22:07 +00:00
xorg-server.m4 xorg-server.m4: just all cflags instead of just sdkdir 2018-09-20 20:12:24 +01:00
xorg-server.pc.in xfree86: link modules against Xorg symbols on Cygwin 2012-04-05 21:57:07 -05:00
xserver.ent.in doc: relocate xserver.ent in the package root directory 2011-05-14 11:22:26 -07:00

README.md

X Server

The X server accepts requests from client applications to create windows, which are (normally rectangular) "virtual screens" that the client program can draw into.

Windows are then composed on the actual screen by the X server (or by a separate composite manager) as directed by the window manager, which usually communicates with the user via graphical controls such as buttons and draggable titlebars and borders.

For a comprehensive overview of X Server and X Window System, consult the following article: https://en.wikipedia.org/wiki/X_server

All questions regarding this software should be directed at the Xorg mailing list:

https://lists.freedesktop.org/mailman/listinfo/xorg

The primary development code repository can be found at:

https://gitlab.freedesktop.org/xorg/xserver

For patch submission instructions, see:

https://www.x.org/wiki/Development/Documentation/SubmittingPatches

As with other projects hosted on freedesktop.org, X.Org follows its Code of Conduct, based on the Contributor Covenant. Please conduct yourself in a respectful and civilized manner when using the above mailing lists, bug trackers, etc:

https://www.freedesktop.org/wiki/CodeOfConduct