Olivier Fourdan a1e44d3c4f xfixes: Check request length for SetClientDisconnectMode ... The handler of XFixesSetClientDisconnectMode does not check the client request length. A client could send a shorter request and read data from a former request. Fix the issue by checking the request size matches. CVE-2025-49177 This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and reported by Julian Suleder via ERNW Vulnerability Disclosure. Fixes: e167299f6 - xfixes: Add ClientDisconnectMode Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>		2025-06-17 20:01:25 +02:00
..
cursor.c	xfixes: XFixesSelectCursorInput() use calloc()	2025-06-12 17:21:44 +02:00
disconnect.c	xfixes: Check request length for SetClientDisconnectMode	2025-06-17 20:01:25 +02:00
meson.build	xfixes: Add ClientDisconnectMode	2021-06-07 17:28:05 +02:00
region.c	dix: clean up MakeWindowOptional() calls and add alloc fault checks	2025-06-12 17:21:48 +02:00
saveset.c	xfixes: simplify dispatcher	2025-06-12 17:21:44 +02:00
select.c	dix: add selection filtering hooks	2025-06-12 17:21:48 +02:00
xfixes.c	miext: move over extinit_priv.h from include	2025-06-12 17:21:46 +02:00
xfixes.h	xfixes: Unexport xfixes.h	2015-07-08 16:40:58 -04:00
xfixesint.h	dix: move over private defintions from selection.h to private header	2025-06-12 17:21:46 +02:00