frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/dix
History
Peter Hutterer b0a09ba602 dix: keep a ref to the rootCursor 
CreateCursor returns a cursor with refcount 1 - that refcount is used by
the resource system, any caller needs to call RefCursor to get their own
reference. That happens correctly for normal cursors but for our
rootCursor we keep a variable to the cursor despite not having a ref for
ourselves.

Fix this by reffing/unreffing the rootCursor to ensure our pointer is
valid.

Related to CVE-2025-26594, ZDI-CAN-25544

Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
 		2025-02-25 11:43:01 +01:00
..
.gitignore Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
atom.c dix: unexport MakePredeclaredAtoms() 2025-02-17 18:13:33 +00:00
callback_priv.h dix: fix duplicate typedef of CallbackListPtr 2024-09-01 22:32:49 +00:00
closestr.h dix: move closestr.h into dix directory 2024-04-16 01:42:39 +00:00
color.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
colormap.c rename old symbol PANORAMIX to XINERAMA 2025-02-06 15:51:27 +00:00
colormap_priv.h dix: move colormap flags into colormap_priv.h and rename them 2024-09-01 22:06:50 +00:00
cursor.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
cursor_priv.h dix: unexport GetSpritePosition() 2024-09-02 16:43:29 +00:00
devices.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
dispatch.c Cursor: Refuse to free the root cursor 2025-02-25 11:43:01 +01:00
dispatch.h dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
display.c dix: add getter for display name 2025-02-11 19:13:01 +01:00
dix_priv.h drop not needed includes of geext.h 2025-02-24 20:19:55 +00:00
dixfonts.c os: log: replace VErrorF() by LogVMessageVerb() 2025-02-06 23:35:27 +00:00
dixgrabs_priv.h dix: unexport non-public functions from dixgrabs.h and document prototypes 2024-10-10 13:50:57 +00:00
dixstruct_priv.h include: move private defs to dixstruct_priv.h 2024-04-30 00:47:38 +00:00
dixutils.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
enterleave.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
enterleave.h dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
eventconvert.c dix: limit checks to MAX_VALUATORS when generating Xi events 2024-10-28 05:38:25 +00:00
eventconvert.h dix: unexport eventconvert.h functions 2024-03-11 12:26:44 +01:00
events.c drop not needed includes of geext.h 2025-02-24 20:19:55 +00:00
exevents_priv.h include: move private definitions out of exevents.h 2024-04-30 00:47:38 +00:00
extension.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
gc.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
gc_priv.h dix: unexport SetClipRects() 2024-04-15 23:10:31 +00:00
generate-atoms dix: unexport MakePredeclaredAtoms() 2025-02-17 18:13:33 +00:00
gestures.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
getevents.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
globals.c dix: add getter for display name 2025-02-11 19:13:01 +01:00
glyphcurs.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
grabs.c dix: unexport non-public functions from dixgrabs.h and document prototypes 2024-10-10 13:50:57 +00:00
input_priv.h include: move private definitions out of input.h 2024-09-01 17:59:23 +00:00
inpututils.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
main.c dix: keep a ref to the rootCursor 2025-02-25 11:43:01 +01:00
meson.build dix: add getter for display name 2025-02-11 19:13:01 +01:00
pixmap.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
privates.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
property.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
property_priv.h dix: unexport DeleteAllWindowProperties() 2024-09-02 17:50:47 +00:00
protocol.txt drop remains of DMX 2024-03-05 16:57:52 +01:00
ptrveloc.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
ptrveloc_priv.h dix: fix duplicate typedef of MotionTracker and *MotionTrackerPtr 2024-09-01 22:32:49 +00:00
region.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
registry.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
registry_priv.h dix: unexport XREGISTRY_UNKNOWN define 2024-03-03 23:20:06 +00:00
resource.c rename old symbol PANORAMIX to XINERAMA 2025-02-06 15:51:27 +00:00
screenint_priv.h dix: fix duplicate typedef of *ScreenPtr 2024-09-01 22:32:49 +00:00
selection.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
stubmain.c Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
swaprep.c dix: drop unnecessary check on HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
swapreq.c misc.h: drop LengthRestB() macro 2025-02-17 19:25:14 +00:00
tables.c dix: drop swapping request length fields 2025-02-06 22:28:51 +00:00
touch.c os: move BUG_*() macros to own private header 2025-02-17 19:32:48 +00:00
window.c dix: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00