Module Name: xsrc
Committed By: martin
Date: Thu Feb 27 10:16:47 UTC 2025
Modified Files:
xsrc/external/mit/xorg-server/dist [netbsd-10]: ChangeLog configure
configure.ac meson.build
xsrc/external/mit/xorg-server/dist/Xext [netbsd-10]: sync.c
xsrc/external/mit/xorg-server/dist/Xi [netbsd-10]: xibarriers.c
xichangehierarchy.c
xsrc/external/mit/xorg-server/dist/composite [netbsd-10]: compalloc.c
xsrc/external/mit/xorg-server/dist/config [netbsd-10]: 10-quirks.conf
xsrc/external/mit/xorg-server/dist/dix [netbsd-10]: devices.c
dispatch.c enterleave.c eventconvert.c main.c
xsrc/external/mit/xorg-server/dist/glamor [netbsd-10]: glamor_program.c
xsrc/external/mit/xorg-server/dist/hw/xfree86/common [netbsd-10]:
xf86Configure.c xf86sbusBus.c
xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2 [netbsd-10]: dri2.c
xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting
[netbsd-10]:
driver.c drmmode_display.c drmmode_display.h present.c
xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw [netbsd-10]:
fbdevhw.c
xsrc/external/mit/xorg-server/dist/include [netbsd-10]: dix-config.h.in
do-not-use-config.h.in meson.build
xsrc/external/mit/xorg-server/dist/os [netbsd-10]: WaitFor.c access.c
connection.c
xsrc/external/mit/xorg-server/dist/render [netbsd-10]: picture.c
xsrc/external/mit/xorg-server/dist/test/sync [netbsd-10]: sync.c
xsrc/external/mit/xorg-server/dist/xkb [netbsd-10]: XKBMAlloc.c
XKBMisc.c xkb.c xkbUtils.c xkbtext.c
xsrc/external/mit/xorg-server/include [netbsd-10]: dix-config.h
version-config.h xorg-config.h xorg-server.h
Log Message:
Pull up the following revisions, requested by mrg in ticket #1067:
external/mit/xorg-server/dist/ChangeLog up to 1.1.1.28
external/mit/xorg-server/dist/configure up to 1.21
external/mit/xorg-server/dist/configure.ac up to 1.23
external/mit/xorg-server/dist/meson.build up to 1.1.1.18
external/mit/xorg-server/dist/Xext/sync.c up to 1.14
external/mit/xorg-server/dist/Xi/xibarriers.c up to 1.5
external/mit/xorg-server/dist/Xi/xichangehierarchy.c up to 1.8
external/mit/xorg-server/dist/composite/compalloc.c up to 1.1.1.9
external/mit/xorg-server/dist/config/10-quirks.conf up to 1.1.1.2
external/mit/xorg-server/dist/dix/devices.c up to 1.16
external/mit/xorg-server/dist/dix/dispatch.c up to 1.9
external/mit/xorg-server/dist/dix/enterleave.c up to 1.10
external/mit/xorg-server/dist/dix/eventconvert.c up to 1.1.1.8
external/mit/xorg-server/dist/dix/main.c up to 1.1.1.9
external/mit/xorg-server/dist/glamor/glamor_program.c up to 1.1.1.4
external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c up to
1.13
external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c up to 1.8
external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c up to 1.6
external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c
up to 1.8
external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c
up to 1.12
external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h
up to 1.1.1.5
external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c
up to 1.9
external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c up to 1.6
external/mit/xorg-server/dist/include/dix-config.h.in up to 1.10
external/mit/xorg-server/dist/include/do-not-use-config.h.in up to
1.1.1.17
external/mit/xorg-server/dist/include/meson.build up to 1.1.1.7
external/mit/xorg-server/dist/os/WaitFor.c up to 1.6
external/mit/xorg-server/dist/os/access.c up to 1.8
external/mit/xorg-server/dist/os/connection.c up to 1.9
external/mit/xorg-server/dist/render/picture.c up to 1.1.1.10
external/mit/xorg-server/dist/test/sync/sync.c up to 1.1.1.2
external/mit/xorg-server/dist/xkb/XKBMAlloc.c up to 1.1.1.7
external/mit/xorg-server/dist/xkb/XKBMisc.c up to 1.1.1.8
external/mit/xorg-server/dist/xkb/xkb.c up to 1.11
external/mit/xorg-server/dist/xkb/xkbUtils.c up to 1.1.1.9
external/mit/xorg-server/dist/xkb/xkbtext.c up to 1.1.1.7
external/mit/xorg-server/include/dix-config.h up to 1.54
external/mit/xorg-server/include/version-config.h up to 1.24
external/mit/xorg-server/include/xorg-config.h up to 1.34
external/mit/xorg-server/include/xorg-server.h up to 1.34
Update to xorg-server 21.1.16.
This fixes various CVEs, related to cursors and keyboards,
device handling, and use-after-free errors:
CVE-2025-26594, ZDI-CAN-25544
CVE-2025-26595, ZDI-CAN-25545
CVE-2025-26596, ZDI-CAN-25543
CVE-2025-26597, ZDI-CAN-25683
CVE-2025-26598, ZDI-CAN-25740
CVE-2025-26599, ZDI-CAN-25851
CVE-2025-26600, ZDI-CAN-25871
CVE-2025-26601, ZDI-CAN-25870
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.20.2.5 -r1.1.1.20.2.6 \
xsrc/external/mit/xorg-server/dist/ChangeLog
cvs rdiff -u -r1.13.2.5 -r1.13.2.6 \
xsrc/external/mit/xorg-server/dist/configure
cvs rdiff -u -r1.15.2.5 -r1.15.2.6 \
xsrc/external/mit/xorg-server/dist/configure.ac
cvs rdiff -u -r1.1.1.10.2.5 -r1.1.1.10.2.6 \
xsrc/external/mit/xorg-server/dist/meson.build
cvs rdiff -u -r1.12.2.1 -r1.12.2.2 \
xsrc/external/mit/xorg-server/dist/Xext/sync.c
cvs rdiff -u -r1.4 -r1.4.4.1 \
xsrc/external/mit/xorg-server/dist/Xi/xibarriers.c
cvs rdiff -u -r1.6.2.1 -r1.6.2.2 \
xsrc/external/mit/xorg-server/dist/Xi/xichangehierarchy.c
cvs rdiff -u -r1.1.1.8 -r1.1.1.8.2.1 \
xsrc/external/mit/xorg-server/dist/composite/compalloc.c
cvs rdiff -u -r1.1.1.1 -r1.1.1.1.6.1 \
xsrc/external/mit/xorg-server/dist/config/10-quirks.conf
cvs rdiff -u -r1.13.2.1 -r1.13.2.2 \
xsrc/external/mit/xorg-server/dist/dix/devices.c
cvs rdiff -u -r1.7.2.1 -r1.7.2.2 \
xsrc/external/mit/xorg-server/dist/dix/dispatch.c \
xsrc/external/mit/xorg-server/dist/dix/enterleave.c
cvs rdiff -u -r1.1.1.6.2.1 -r1.1.1.6.2.2 \
xsrc/external/mit/xorg-server/dist/dix/eventconvert.c
cvs rdiff -u -r1.1.1.8 -r1.1.1.8.2.1 \
xsrc/external/mit/xorg-server/dist/dix/main.c
cvs rdiff -u -r1.1.1.3 -r1.1.1.3.2.1 \
xsrc/external/mit/xorg-server/dist/glamor/glamor_program.c
cvs rdiff -u -r1.12 -r1.12.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c
cvs rdiff -u -r1.7 -r1.7.6.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c
cvs rdiff -u -r1.5 -r1.5.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c
cvs rdiff -u -r1.7 -r1.7.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c
cvs rdiff -u -r1.11 -r1.11.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c
cvs rdiff -u -r1.1.1.4 -r1.1.1.4.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h
cvs rdiff -u -r1.8 -r1.8.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c
cvs rdiff -u -r1.5 -r1.5.2.1 \
xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c
cvs rdiff -u -r1.8.2.1 -r1.8.2.2 \
xsrc/external/mit/xorg-server/dist/include/dix-config.h.in
cvs rdiff -u -r1.1.1.13.2.3 -r1.1.1.13.2.4 \
xsrc/external/mit/xorg-server/dist/include/do-not-use-config.h.in
cvs rdiff -u -r1.1.1.4.2.2 -r1.1.1.4.2.3 \
xsrc/external/mit/xorg-server/dist/include/meson.build
cvs rdiff -u -r1.5 -r1.5.2.1 xsrc/external/mit/xorg-server/dist/os/WaitFor.c
cvs rdiff -u -r1.6.2.1 -r1.6.2.2 \
xsrc/external/mit/xorg-server/dist/os/access.c
cvs rdiff -u -r1.7.2.1 -r1.7.2.2 \
xsrc/external/mit/xorg-server/dist/os/connection.c
cvs rdiff -u -r1.1.1.9 -r1.1.1.9.2.1 \
xsrc/external/mit/xorg-server/dist/render/picture.c
cvs rdiff -u -r1.1.1.1 -r1.1.1.1.4.1 \
xsrc/external/mit/xorg-server/dist/test/sync/sync.c
cvs rdiff -u -r1.1.1.6 -r1.1.1.6.4.1 \
xsrc/external/mit/xorg-server/dist/xkb/XKBMAlloc.c
cvs rdiff -u -r1.1.1.7 -r1.1.1.7.2.1 \
xsrc/external/mit/xorg-server/dist/xkb/XKBMisc.c
cvs rdiff -u -r1.8.2.2 -r1.8.2.3 xsrc/external/mit/xorg-server/dist/xkb/xkb.c
cvs rdiff -u -r1.1.1.6.4.2 -r1.1.1.6.4.3 \
xsrc/external/mit/xorg-server/dist/xkb/xkbUtils.c
cvs rdiff -u -r1.1.1.6 -r1.1.1.6.2.1 \
xsrc/external/mit/xorg-server/dist/xkb/xkbtext.c
cvs rdiff -u -r1.46.2.5 -r1.46.2.6 \
xsrc/external/mit/xorg-server/include/dix-config.h
cvs rdiff -u -r1.16.2.5 -r1.16.2.6 \
xsrc/external/mit/xorg-server/include/version-config.h
cvs rdiff -u -r1.26.2.5 -r1.26.2.6 \
xsrc/external/mit/xorg-server/include/xorg-config.h \
xsrc/external/mit/xorg-server/include/xorg-server.h
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: xsrc/external/mit/xorg-server/dist/ChangeLog
diff -u xsrc/external/mit/xorg-server/dist/ChangeLog:1.1.1.20.2.5 xsrc/external/mit/xorg-server/dist/ChangeLog:1.1.1.20.2.6
--- xsrc/external/mit/xorg-server/dist/ChangeLog:1.1.1.20.2.5 Sat Nov 2 10:35:43 2024
+++ xsrc/external/mit/xorg-server/dist/ChangeLog Thu Feb 27 10:16:37 2025
@@ -1,3 +1,963 @@
+commit b7f84e6d509c004a7abb514af75b94cb907d451b
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Tue Feb 25 15:38:07 2025 +0100
+
+ xserver 21.1.16
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit a2c0f84c1cd0c92918f08f83f562c2e324cd4cbb
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Jan 20 17:10:31 2025 +0100
+
+ sync: Apply changes last in SyncChangeAlarmAttributes()
+
+ SyncChangeAlarmAttributes() would apply the various changes while
+ checking for errors.
+
+ If one of the changes triggers an error, the changes for the trigger,
+ counter or delta value would remain, possibly leading to inconsistent
+ changes.
+
+ Postpone the actual changes until we're sure nothing else can go wrong.
+
+ Related to CVE-2025-26601, ZDI-CAN-25870
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit c285798984c6bb99e454a33772cde23d394d3dcd)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 043a4e959b8590ff37b72cd3440328ec3e39699f
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Jan 20 17:06:07 2025 +0100
+
+ sync: Do not fail SyncAddTriggerToSyncObject()
+
+ We do not want to return a failure at the very last step in
+ SyncInitTrigger() after having all changes applied.
+
+ SyncAddTriggerToSyncObject() must not fail on memory allocation, if the
+ allocation of the SyncTriggerList fails, trigger a FatalError() instead.
+
+ Related to CVE-2025-26601, ZDI-CAN-25870
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 8cbc90c8817306af75a60f494ec9dbb1061e50db)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 330b4068212c02548b53d19c0078ddc75c36a724
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Jan 20 16:54:30 2025 +0100
+
+ sync: Check values before applying changes
+
+ In SyncInitTrigger(), we would set the CheckTrigger function before
+ validating the counter value.
+
+ As a result, if the counter value overflowed, we would leave the
+ function SyncInitTrigger() with the CheckTrigger applied but without
+ updating the trigger object.
+
+ To avoid that issue, move the portion of code checking for the trigger
+ check value before updating the CheckTrigger function.
+
+ Related to CVE-2025-26601, ZDI-CAN-25870
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit f52cea2f93a0c891494eb3334894442a92368030)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit e708ad021753d603580d314c48b93d3adf459c5f
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Jan 20 16:52:01 2025 +0100
+
+ sync: Do not let sync objects uninitialized
+
+ When changing an alarm, the change mask values are evaluated one after
+ the other, changing the trigger values as requested and eventually,
+ SyncInitTrigger() is called.
+
+ SyncInitTrigger() will evaluate the XSyncCACounter first and may free
+ the existing sync object.
+
+ Other changes are then evaluated and may trigger an error and an early
+ return, not adding the new sync object.
+
+ This can be used to cause a use after free when the alarm eventually
+ triggers.
+
+ To avoid the issue, delete the existing sync object as late as possible
+ only once we are sure that no further error will cause an early exit.
+
+ CVE-2025-26601, ZDI-CAN-25870
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 16a1242d0ffc7f45ed3c595ee7564b5c04287e0b)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 826cef825fe49a275deb28e85b8c714b697f5efa
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Dec 16 16:18:04 2024 +0100
+
+ dix: Dequeue pending events on frozen device on removal
+
+ When a device is removed while still frozen, the events queued for that
+ device remain while the device itself is freed.
+
+ As a result, replaying the events will cause a use after free.
+
+ To avoid the issue, make sure to dequeue and free any pending events on
+ a frozen device when removed.
+
+ CVE-2025-26600, ZDI-CAN-25871
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 6e0f332ba4c8b8c9a9945dc9d7989bfe06f80e14)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit d09125fbb3b997ed77b7f008f8bd30328ba69fbb
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Jan 13 16:09:43 2025 +0100
+
+ composite: initialize border clip even when pixmap alloc fails
+
+ If it fails to allocate the pixmap, the function compAllocPixmap() would
+ return early and leave the borderClip region uninitialized, which may
+ lead to the use of uninitialized value as reported by valgrind:
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x4F9B33: compClipNotify (compwindow.c:317)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x48EEDBC: pixman_region_translate (pixman-region.c:2233)
+ by 0x4F9255: RegionTranslate (regionstr.h:312)
+ by 0x4F9B7E: compClipNotify (compwindow.c:319)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x48EEE33: UnknownInlinedFun (pixman-region.c:2241)
+ by 0x48EEE33: pixman_region_translate (pixman-region.c:2225)
+ by 0x4F9255: RegionTranslate (regionstr.h:312)
+ by 0x4F9B7E: compClipNotify (compwindow.c:319)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Fix compAllocPixmap() to initialize the border clip even if the creation
+ of the backing pixmap has failed, to avoid depending later on
+ uninitialized border clip values.
+
+ Related to CVE-2025-26599, ZDI-CAN-25851
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Acked-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit b07192a8bedb90b039dc0f70ae69daf047ff9598)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 7169628a1715f8203665f9805c714ed111907914
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Tue Dec 17 15:19:45 2024 +0100
+
+ composite: Handle failure to redirect in compRedirectWindow()
+
+ The function compCheckRedirect() may fail if it cannot allocate the
+ backing pixmap.
+
+ In that case, compRedirectWindow() will return a BadAlloc error.
+
+ However that failure code path will shortcut the validation of the
+ window tree marked just before, which leaves the validate data partly
+ initialized.
+
+ That causes a use of uninitialized pointer later.
+
+ The fix is to not shortcut the call to compHandleMarkedWindows() even in
+ the case of compCheckRedirect() returning an error.
+
+ CVE-2025-26599, ZDI-CAN-25851
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Acked-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit c1ff84bef2569b4ba4be59323cf575d1798ba9be)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 32decb1efb89341881de8266f3dd1c3356981bfd
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Dec 16 11:25:11 2024 +0100
+
+ Xi: Fix barrier device search
+
+ The function GetBarrierDevice() would search for the pointer device
+ based on its device id and return the matching value, or supposedly NULL
+ if no match was found.
+
+ Unfortunately, as written, it would return the last element of the list
+ if no matching device id was found which can lead to out of bounds
+ memory access.
+
+ Fix the search function to return NULL if not matching device is found,
+ and adjust the callers to handle the case where the device cannot be
+ found.
+
+ CVE-2025-26598, ZDI-CAN-25740
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit bba9df1a9d57234c76c0b93f88dacb143d01bca2)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 8cb23fac62e05d7340e320b2db0dd3e8538d1fba
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Thu Nov 28 14:09:04 2024 +0100
+
+ xkb: Fix buffer overflow in XkbChangeTypesOfKey()
+
+ If XkbChangeTypesOfKey() is called with nGroups == 0, it will resize the
+ key syms to 0 but leave the key actions unchanged.
+
+ If later, the same function is called with a non-zero value for nGroups,
+ this will cause a buffer overflow because the key actions are of the wrong
+ size.
+
+ To avoid the issue, make sure to resize both the key syms and key actions
+ when nGroups is 0.
+
+ CVE-2025-26597, ZDI-CAN-25683
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 0e4ed94952b255c04fe910f6a1d9c852878dcd64)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit b4293650b50efe7832cf9eac71217ad8d6341e02
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Thu Nov 28 11:49:34 2024 +0100
+
+ xkb: Fix computation of XkbSizeKeySyms
+
+ The computation of the length in XkbSizeKeySyms() differs from what is
+ actually written in XkbWriteKeySyms(), leading to a heap overflow.
+
+ Fix the calculation in XkbSizeKeySyms() to match what kbWriteKeySyms()
+ does.
+
+ CVE-2025-26596, ZDI-CAN-25543
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 80d69f01423fc065c950e1ff4e8ddf9f675df773)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit ea526ccb20d222196494b2adf9da52dab68a8997
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Wed Nov 27 14:41:45 2024 +0100
+
+ xkb: Fix buffer overflow in XkbVModMaskText()
+
+ The code in XkbVModMaskText() allocates a fixed sized buffer on the
+ stack and copies the virtual mod name.
+
+ There's actually two issues in the code that can lead to a buffer
+ overflow.
+
+ First, the bound check mixes pointers and integers using misplaced
+ parenthesis, defeating the bound check.
+
+ But even though, if the check fails, the data is still copied, so the
+ stack overflow will occur regardless.
+
+ Change the logic to skip the copy entirely if the bound check fails.
+
+ CVE-2025-26595, ZDI-CAN-25545
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 11fcda8753e994e15eb915d28cf487660ec8e722)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 5f0c4e0bf254c8b4552da276d01b1b80881b4e26
+Author: Peter Hutterer <peter.hutte...@who-t.net>
+Date: Wed Dec 4 15:49:43 2024 +1000
+
+ dix: keep a ref to the rootCursor
+
+ CreateCursor returns a cursor with refcount 1 - that refcount is used by
+ the resource system, any caller needs to call RefCursor to get their own
+ reference. That happens correctly for normal cursors but for our
+ rootCursor we keep a variable to the cursor despite not having a ref for
+ ourselves.
+
+ Fix this by reffing/unreffing the rootCursor to ensure our pointer is
+ valid.
+
+ Related to CVE-2025-26594, ZDI-CAN-25544
+
+ Reviewed-by: Olivier Fourdan <ofour...@redhat.com>
+ (cherry picked from commit b0a09ba6020147961acc62d9c73d807b4cccd9f7)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 9e5ac777d0dfa9d4d78dd68558869489117c3f2c
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Wed Nov 27 11:27:05 2024 +0100
+
+ Cursor: Refuse to free the root cursor
+
+ If a cursor reference count drops to 0, the cursor is freed.
+
+ The root cursor however is referenced with a specific global variable,
+ and when the root cursor is freed, the global variable may still point
+ to freed memory.
+
+ Make sure to prevent the rootCursor from being explicitly freed by a
+ client.
+
+ CVE-2025-26594, ZDI-CAN-25544
+
+ This vulnerability was discovered by:
+ Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+ v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer
+ <peter.hutte...@who-t.net>)
+ v3: Return BadCursor instead of BadValue (Michel Dänzer
+ <mic...@daenzer.net>)
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Suggested-by: Peter Hutterer <peter.hutte...@who-t.net>
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ (cherry picked from commit 01642f263f12becf803b19be4db95a4a83f94acc)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 32887f6ca479be268b7c867b924f80d3fd1611db
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Tue Feb 25 18:47:05 2025 +0100
+
+ test: Fix xsync test
+
+ The xsync test is relying on the values being changed even in the case
+ of a BadMatch value.
+
+ Typically, it updates the delta but does not update the test type
+ comparison, so when passing a negative value, it generates a BadMatch.
+
+ That's actually not correct, and that will fail with the new fixes that
+ check the validity of the values prior to apply the changes.
+
+ Fix the test by updating the test type as needed.
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ (cherry picked from commit 05e54fefafbcec11d847b9f8127bcd4820a20625)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
+
+commit 0c6a7750f2ac9158ace8161f94f7e3bd4c9f5263
+Author: Doug Brown <d...@schmorgal.com>
+Date: Mon Jul 15 19:44:23 2024 -0700
+
+ dri2: Protect against dri2ClientPrivate assertion failures
+
+ If DRI2ScreenInit hasn't been called yet, DRI2Authenticate and
+ DRI2CreateDrawable2 cause the X server to crash. This has been observed
+ to happen on multiple modern Linux distros in various conditions,
+ including QEMU and VMware VMs. Make these functions more robust in order
+ to prevent the crash.
+
+ This patch was originally provided by Bernhard Übelacker and expanded
+ upon by Mark Wagner.
+
+ Signed-off-by: Doug Brown <d...@schmorgal.com>
+ Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1053
+ Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1534
+ (cherry picked from commit a0834009cfb10b8982a1f2b47b8ed00de254c2c3)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1824>
+
+commit a651eefc9e525072d99413c1aeabd01858c50819
+Author: Daniel Kahn Gillmor <d...@fifthhorseman.net>
+Date: Fri Jan 3 14:41:59 2025 -0500
+
+ autotools: enable static use of Nettle for SHA1
+
+ Debian builds xserver 21 using autotools.
+
+ When debian builds xserver-xorg for constrained environments like the
+ installer, it wants to build against the static library of libnettle
+ for SHA1, see debian/patches/03_static-nettle.diff in the debian
+ repository at
+ https://salsa.debian.org/xorg-team/xserver/xorg-server.git
+
+ This modification of configure.ac makes it possible to build static
+ nettle when needed, while preserving the build to use nettle with a
+ dynamic library when passing a different configuration option.
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1756>
+
+commit e183b62e42f49fa297b5667a82199c7e76fc0a81
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Wed Jan 15 09:40:34 2025 +0100
+
+ os/connection: Make sure partial is initialized
+
+ Following the change in Xtrans 1.5 that allows for partial connections
+ to succeed, we need to make sure partial is properly initialized at
+ first, otherwise we rely on an uninitialized variable.
+
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ Suggested-by: Twaik Yont <twaiky...@gmail.com>
+ Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1783
+ (cherry picked from commit 080fb49eff4de7ec3a29214994d1403e4d877f6a)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit 6115eb1f65dc5198da01042e70d571d85286c31c
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Fri Jan 10 15:02:54 2025 +0100
+
+ xkb: Always use MAP_LENGTH keymap size
+
+ Generating the modifier modmap, the helper function generate_modkeymap()
+ would check the entire range up to the MAP_LENGTH.
+
+ However, the given keymap might have less keycodes than MAP_LENGTH, in
+ which case we would go beyond the size of the modmap, as reported by
+ ASAN:
+
+ ==ERROR: AddressSanitizer: heap-buffer-overflow
+ READ of size 1 at 0x5110001c225b thread T0
+ #0 0x5e7369393873 in generate_modkeymap ../dix/inpututils.c:309
+ #1 0x5e736930dcce in ProcGetModifierMapping ../dix/devices.c:1794
+ #2 0x5e7369336489 in Dispatch ../dix/dispatch.c:550
+ #3 0x5e736934407d in dix_main ../dix/main.c:275
+ #5 0x7e46d47b2ecb in __libc_start_main
+ #6 0x5e73691be324 in _start (xserver/build/hw/xwayland/Xwayland)
+
+ Address is located 0 bytes after 219-byte region
+ allocated by thread T0 here:
+ #0 0x7e46d4cfc542 in realloc
+ #1 0x5e73695aa90e in _XkbCopyClientMap ../xkb/xkbUtils.c:1142
+ #2 0x5e73695aa90e in XkbCopyKeymap ../xkb/xkbUtils.c:1966
+ #3 0x5e73695b1b2f in XkbDeviceApplyKeymap ../xkb/xkbUtils.c:2023
+ #4 0x5e73691c6c18 in keyboard_handle_keymap ../hw/xwayland/xwayland-input.c:1194
+
+ As MAP_LENGTH is used in various code paths where the max keycode might
+ not be easily available, best is to always use MAP_LENGTH to allocate the
+ keymaps so that the code never run past the buffer size.
+
+ If the max key code is smaller than the MAP_LENGTH limit, fill-in the gap
+ with zeros.
+
+ That also simplifies the code slightly as we do not constantly need to
+ reallocate the keymap to adjust to the max key code size.
+
+ Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1780
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ (cherry picked from commit 92bcebfd7e248f695503c0a6e7bee80be4c96834)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit 309ec5a4a71aa189bcf1eb4263d0d34375051856
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Thu Oct 24 15:51:53 2024 -0700
+
+ modesetting: avoid memory leak when ms_present_check_unflip() returns FALSE
+
+ Found by Oracle Parfait 13.3 static analyzer:
+ Memory leak [memory-leak]:
+ Memory leak of pointer event allocated with calloc(1, 16)
+ at line 470 of hw/xfree86/drivers/modesetting/present.c in
+ function 'ms_present_unflip'.
+ event allocated at line 431 with calloc(1, 16)
+ event leaks when ms_present_check_unflip(...) == 0 at line 438
+ and i >= config->num_crtc at line 445
+
+ Fixes: 13c7d53df ("modesetting: Implement page flipping support for Present.")
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit bf63d9b34ef3a24427f884f66a387119dd5cdb8c)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit fbb636bf6b9f8017cf4f905210d15b86a257dad9
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Sat Oct 12 17:33:24 2024 -0700
+
+ dix: limit checks to MAX_VALUATORS when generating Xi events
+
+ Previously, it was looping through sizeof(ev->valuators.mask) * 8
+ valuators, where valuators.mask is defined as an array of
+ (MAX_VALUATORS + 7) / 8 entries. Since MAX_VALUATORS is defined as 36,
+ this made it actually loop through 40 entries. The last 4 bits in this
+ array should never be set, so we should never access memory outside the
+ bounds of the arrays defined to be exactly MAX_VALUATORS in length, but
+ we can make the static analyzer happier and not waste time checking bits
+ that should never be set.
+
+ Found by Oracle Parfait 13.3 static analyzer:
+
+ Read outside array bounds [read-outside-array-bounds]:
+ In array dereference of ev->valuators.data[i] with index i
+ Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
+ at line 741 of dix/eventconvert.c in function 'eventToDeviceEvent'.
+
+ Read outside array bounds [read-outside-array-bounds]:
+ In array dereference of ev->valuators.data[i] with index i
+ Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
+ at line 808 of dix/eventconvert.c in function 'eventToRawEvent'.
+
+ Read outside array bounds [read-outside-array-bounds]:
+ In array dereference of ev->valuators.data_raw[i] with index i
+ Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
+ at line 809 of dix/eventconvert.c in function 'eventToRawEvent'.
+
+ Fixes: b2ba77bac ("dix: add EventToXI2 and GetXI2Type.")
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit b65eea43dd18cdf6d389b7f82ee55ae764c3bf31)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit abfd0215946c23c36a4b1c689ea6b8b7d277e991
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Sat Oct 12 17:01:03 2024 -0700
+
+ dix: fix button offset when generating DeviceButtonStateNotify events
+
+ Found by Oracle Parfait 13.3 static analyzer:
+ Buffer Overflow in STD C function [buffer-overflow-call-stdc]:
+ Buffer overflow in call to memcpy. Buffer &bev->buttons[4] of
+ size 24 is written at an offset of 28
+ Array size is 28 bytes, index is 32
+ at line 743 of dix/enterleave.c in function
+ 'DeliverStateNotifyEvent'.
+
+ Fixes: a85f0d6b9 ("Xi: fix use of button->down - bitflags instead of int arrays.")
+ Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit 4b073d65bb5e1f4accb7ed280c8926134582b7ab)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit 5406ddd003c95e2fcbb0411a7afff4daaa9b59f9
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Sat Oct 12 16:38:55 2024 -0700
+
+ render: avoid NULL pointer dereference if PictureFindVisual returns NULL
+
+ Found by Oracle Parfait 13.3:
+ Null pointer dereference [null-pointer-deref]:
+ Read from null pointer pVisual
+ at line 257 of dix/colormap.c in function 'CreateColormap'.
+ Null pointer introduced at line 412 of render/picture.c in
+ function 'PictureFindVisual'.
+ Constant 'NULL' passed into function CreateColormap, argument
+ pVisual, from call at line 431 in function
+ 'PictureInitIndexedFormat'.
+ Function PictureFindVisual may return constant 'NULL' at
+ line 412, called at line 429.
+
+ Fixes: d4a101d4e ("Integration of DAMAGE-XFIXES branch to trunk")
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit 7af077dd2f939b76e7d6ba84250368b6649fb777)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit cec3e55ec96a660a1884fc99784efb4536e557bb
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Sat Oct 12 16:12:13 2024 -0700
+
+ Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL
+
+ The comments in that function say "This only happens if master is a
+ slave device. don't do that" but static analysis doesn't respect that.
+
+ Found by Oracle Parfait 13.3:
+ Null pointer dereference [null-pointer-deref]:
+ Read from null pointer XTestptr
+ at line 274 of Xi/xichangehierarchy.c in function 'remove_master'.
+ Null pointer introduced at line 691 of Xext/xtest.c in function
+ 'GetXTestDevice'.
+ Function GetXTestDevice may return constant 'NULL' at line 691,
+ called at line 273 of Xi/xichangehierarchy.c in function
+ 'remove_master'.
+ Null pointer dereference [null-pointer-deref]:
+ Read from null pointer XTestkeybd
+ at line 279 of Xi/xichangehierarchy.c in function 'remove_master'.
+ Null pointer introduced at line 691 of Xext/xtest.c in function
+ 'GetXTestDevice'.
+ Function GetXTestDevice may return constant 'NULL' at line 691,
+ called at line 278 of Xi/xichangehierarchy.c in function
+ 'remove_master'.
+
+ Fixes: 0814f511d ("input: store the master device's ID in the devPrivate for XTest devices.")
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit d10589cc09c68ad09bebd3a4155c44d1b8f2614b)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit 23b3b7199c69d0052830c2b219ba06cb26950f51
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Sat Oct 12 15:55:06 2024 -0700
+
+ xfree86: avoid memory leak on realloc failure
+
+ Found by Oracle Parfait 13.3 static analyzer:
+ Memory leak [memory-leak]:
+ Memory leak of pointer optname allocated with asprintf(&optname,
+ "\"%s\"", p->name)
+ at line 326 of hw/xfree86/common/xf86Configure.c in function
+ 'configureDeviceSection'.
+ optname allocated at line 309 with asprintf(&optname, "\"%s\"",
+ p->name)
+
+ Fixes: code inherited from XFree86
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit fa711c486a2c2c958c71d7bd8ac0efe552558717)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit cbc2c654e4099e4d8a35e625e010fd73e7a75521
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Mon Sep 9 16:21:46 2024 -0700
+
+ os: NextDPMSTimeout: mark intentional fallthroughs in switch
+
+ The comment at the top of the function tells humans the fallthroughs
+ are intentional, but gcc doesn't parse that.
+
+ Clears 3 -Wimplicit-fallthrough warnings from gcc 14.1
+
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ (cherry picked from commit b306df5a6060beea82b5157c3603593527b220b0)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit e38c23e5b81693a1b23ed91e4ecdead08615ab25
+Author: Tj <tj.iam...@proton.me>
+Date: Fri Jul 19 19:50:56 2024 +0200
+
+ xfree86: fbdevhw: fix pci detection on recent Linux
+
+ Linux kernel v6.9 has changed the symlink to point to the parent device. This
+ breaks fbdev_open() detection logic. Change it to use the subsystem symlink
+ instead which will remain stable.
+
+ Kernel v6.8:
+
+ [ 14.067] (II) fbdev_open() sysfs_path=/sys/class/graphics/fb0
+ [ 14.067] (II) fbdev_open() buf=../../devices/platform/vesa-framebuffer.0/graphics/fb0
+
+ Kernel v6.9:
+
+ [ 15.609] (II) fbdev_open() sysfs_path=/sys/class/graphics/fb0
+ [ 15.609] (II) fbdev_open() buf=../../devices/pci0000:00/0000:00:01.0/vesa-framebuffer.0/graphics/fb0
+
+ Originally found in automated Debian ISO QA testing [0] and confirmed in Linux [1].
+
+ Tested on kernels v6.9.7 and v6.8.12
+
+ [0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1075713
+ [1] https://lore.kernel.org/lkml/lLyvPFC_APGHNfyGNHRpQy5izBikkaTPOpHooZIT3fFAoJPquSI31ZMueA99XTdr8ysir3X7O7IMdc6za-0m79vr_claeparHhoRouVgHOI=@proton.me/
+
+ Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1714
+ Signed-off-by: Tj <tj.iam...@proton.me>
+ Reviewed-by: Thomas Zimmermann <tzimmerm...@suse.de>
+ Reviewed-by: Enrico Weigelt, metux IT consult <i...@metux.net>
+ (cherry picked from commit 728b54528d37ffa27b07c9b181c5ed8d2d359379)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit ac48573a9bc943572621aa4d0254f32fca58f7d4
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Sep 23 09:27:21 2024 +0200
+
+ os: Fix NULL pointer dereference
+
+ RemoveHost() can be called from DisableLocalHost() with a NULL client,
+ but doesn't actually check whether the given client pointer is valid on
+ error and assigns the error value unconditionally, leading to a possible
+ NULL pointer dereference and a crash of the Xserver.
+
+ To avoid the issue, simply check whether the client pointer is not NULL
+ prior to assign the errorValue.
+
+ Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1752
+ See-also: https://bugzilla.redhat.com/2313799
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ (cherry picked from commit 57a446c0f98693bd2e0263e91213344d870f4e03)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit f241e4f884be062f947f5dab35465549b8bffdf8
+Author: Peter Hutterer <peter.hutte...@who-t.net>
+Date: Tue Jan 30 11:11:54 2024 +1000
+
+ Xi: when removing a master search for a disabled paired device
+
+ If either the master pointer or keyboard was disabled, the respective
+ GetMaster() call returns NULL, causing a segfault later accessing the
+ deviceid.
+
+ Fix this by looking in the off_devices list for any master
+ device of the type we're looking for. Master devices lose the pairing
+ when disabled (on enabling a keyboard we simply pair with the first
+ available unpaired pointer).
+
+ And for readability, split the device we get from the protocol request
+ into a new "dev" variable instead of re-using ptr.
+
+ Fixes #1611
+
+ (cherry picked from commit e7c876ab0b0daa546a23d4ef82537fdf8fd88e04)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit de2e2e8d45eaffd8b961d22ba91d45ed4ffb9ea0
+Author: Peter Hutterer <peter.hutte...@who-t.net>
+Date: Tue Jan 30 10:44:58 2024 +1000
+
+ dix: don't push the XKB state to a non-existing master keyboard
+
+ If our master keyboard is disabled, GetMaster() returns NULL and
+ we segfault in XkbPushLockedStateToSlaves().
+
+ Fixes 45fb3a934dc0db51584aba37c2f9d73deff9191d
+ Fixes #1611
+
+ (cherry picked from commit 9b983fecf999b9f50946973f2379a5ce00491cad)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit 743f66d6a29d439aac7b9ef2816009f311d58aec
+Author: Olivier Fourdan <ofour...@redhat.com>
+Date: Mon Jul 29 11:54:15 2024 +0200
+
+ glamor: Fix possible double-free
+
+ If glamor_link_glsl_prog() fails, we may jump to the failed code path
+ which frees the variable vs_prog_string and fs_prog_string.
+
+ But those variables were already freed just before, so in that case we
+ end up freeing the memory twice.
+
+ Simply move the free at the end of the success code path so we are sure
+ to free the values only once, either in the successful of failed code
+ paths.
+
+ Fixes: 2906ee5e4 - glamor: Fix leak in glamor_build_program()
+ Signed-off-by: Olivier Fourdan <ofour...@redhat.com>
+ (cherry picked from commit 34ea020344ef5f2ea8ffce78c7e1abd6436b21ec)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit 3bda7d119a289bc7706123b0544bb6ff792986ad
+Author: Patrik Jakobsson <patrik.r.jakobs...@gmail.com>
+Date: Wed Jun 9 20:58:59 2021 +0200
+
+ modesetting: Fix dirty updates for sw rotation
+
+ Rotation is broken for all drm drivers not providing hardware rotation
+ support. Drivers that give direct access to vram and not needing dirty
+ updates still work but only by accident. The problem is caused by
+ modesetting not sending the correct fb_id to drmModeDirtyFB() and
+ passing the damage rects in the rotated state and not as the crtc
+ expects them. This patch takes care of both problems.
+
+ Signed-off-by: Patrik Jakobsson <pjakobs...@suse.de>
+ (cherry picked from commit db9e9d45e8ba73510f11eb9e534c176102f6623e)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1767>
+
+commit b5f1b211b4bbbf4049b422b0e08e02efaaf7a26a
+Author: Matt Turner <matts...@gmail.com>
+Date: Tue Dec 17 12:39:36 2024 -0500
+
+ xserver 21.1.15
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1753>
+
+commit 203e0667d21953737537d1991ec76b768fe588ae
+Author: Matt Turner <matts...@gmail.com>
+Date: Mon Dec 16 22:38:24 2024 -0500
+
+ hw/xfree86: Fix -Wincompatible-pointer-types sbus compile failure
+
+ ```
+ ../hw/xfree86/common/xf86sbusBus.c: In function ‘xf86SbusConfigureNewDev’:
+ ../hw/xfree86/common/xf86sbusBus.c:751:21: error: passing argument 1 of ‘XNFasprintf’ from incompatible pointer type [-Wincompatible-pointer-types]
+ 751 | XNFasprintf(&GDev->busID, "SBUS:%s", promPath);
+ | ^~~~~~~~~~~~
+ | |
+ | const char **
+ ```
+
+ Apply the same fix as in commit e1e01d2e3 ("xfree86/common: Warning
+ fixes. Mostly const string handling.")
+
+ (cherry picked from commit bdacb100bf6a551bc9045f7f0048cbb99eb3db5a)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1752>
+
+commit 1958e0f25b6b46940625b407a5e15b39fa648b26
+Author: Matt Turner <matts...@gmail.com>
+Date: Mon Dec 16 22:38:03 2024 -0500
+
+ hw/xfree86: Fix -Wmissing-prototypes warnings
+
+ None of these functions are used elsewhere in the Xserver nor in any of
+ the xf86-video-sun* DDXs.
+
+ (cherry picked from commit 00a96cd82a7be08f421dcbe3aa628fdbc7c8d856)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1752>
+
+commit c3144adcbc01d4f9f4d1e42323fc51be689bee17
+Author: Eric Curtin <ecur...@redhat.com>
+Date: Fri Dec 16 11:10:12 2022 +0000
+
+ config: add a quirk for Apple Silicon appledrm
+
+ Xorg server does not correctly select the DCP for the display without a
+ quirk on Apple Silicon.
+
+ Signed-off-by: Eric Curtin <ecur...@redhat.com>
+ Suggested-by: Hector Martin <mar...@marcan.st>
+ (cherry picked from commit 39934a656a44722d16a80bf4db411c53e2d67b38)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1746>
+
+commit 1a836cd47be8177cb3ab3ac2bc90e926c24c0cac
+Author: Alan Coopersmith <alan.coopersm...@oracle.com>
+Date: Wed Oct 30 10:34:14 2024 -0700
+
+ dix-config.h: add HAVE_SOCKLEN_T definition
+
+ Needed to build with IPv6 disabled using gcc 14 on some platforms to avoid:
+
+ In file included from /usr/X11/include/X11/Xtrans/transport.c:67,
+ from xstrans.c:17:
+ /usr/X11/include/X11/Xtrans/Xtranssock.c: In function ‘_XSERVTransSocketOpen’:
+ /usr/X11/include/X11/Xtrans/Xtranssock.c:467:28: error: passing argument 5
+ of ‘getsockopt’ from incompatible pointer type [-Wincompatible-pointer-types]
+ 467 | (char *) &val, &len) == 0 && val < 64 * 1024)
+ | ^~~~
+ | |
+ | size_t * {aka long unsigned int *}
+
+ (Backport to xserver-21.1-branch of commit a1b5aa5a7f12adc43720a5ae11e6c.
+ Backport adds autoconf equivalent to meson change from master branch.)
+
+ Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1737>
+
+commit 18c9cd6ab799cf8bd7fb90b4965455bece0046c3
+Author: Joaquim Monteiro <joaquim.monte...@protonmail.com>
+Date: Sun Jun 23 21:23:47 2024 +0100
+
+ os: Fix siHostnameAddrMatch in the case where h_addr isn't defined
+
+ When IPv6 support isn't enabled, and h_addr isn't defined,
+ there is no for loop, so the break statement is invalid.
+
+ Signed-off-by: Joaquim Monteiro <joaquim.monte...@protonmail.com>
+ (cherry picked from commit a6a993f9508ff0bd6f19695b2dfaef170c652525)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1737>
+
+commit e8302b707d6fddf8e27daa0b3ef70fd3efec823c
+Author: Joaquim Monteiro <joaquim.monte...@protonmail.com>
+Date: Sun Jun 23 21:17:25 2024 +0100
+
+ os: Fix assignment with incompatible pointer type
+
+ struct hostent->h_addr_list is of type char**, not const char**.
+ GCC considers this an error when in C99 mode or later.
+
+ Signed-off-by: Joaquim Monteiro <joaquim.monte...@protonmail.com>
+ (cherry picked from commit 0ddcd8785199c08d9bded3c767a3b1227c670999)
+
+ Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1737>
+
commit b25ad9b8f0ebcc3ebe09ce9991410c60f3a8b2ce
Author: José Expósito <jexpo...@redhat.com>
Date: Tue Oct 29 14:40:34 2024 +0100
Index: xsrc/external/mit/xorg-server/dist/configure
diff -u xsrc/external/mit/xorg-server/dist/configure:1.13.2.5 xsrc/external/mit/xorg-server/dist/configure:1.13.2.6
--- xsrc/external/mit/xorg-server/dist/configure:1.13.2.5 Sat Nov 2 10:35:49 2024
+++ xsrc/external/mit/xorg-server/dist/configure Thu Feb 27 10:16:43 2025
@@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.72 for xorg-server 21.1.14.
+# Generated by GNU Autoconf 2.72 for xorg-server 21.1.16.
#
# Report bugs to <https://gitlab.freedesktop.org/xorg/xserver/issues>.
#
@@ -675,8 +675,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='xorg-server'
PACKAGE_TARNAME='xorg-server'
-PACKAGE_VERSION='21.1.14'
-PACKAGE_STRING='xorg-server 21.1.14'
+PACKAGE_VERSION='21.1.16'
+PACKAGE_STRING='xorg-server 21.1.16'
PACKAGE_BUGREPORT='https://gitlab.freedesktop.org/xorg/xserver/issues'
PACKAGE_URL=''
@@ -1999,7 +1999,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
-'configure' configures xorg-server 21.1.14 to adapt to many kinds of systems.
+'configure' configures xorg-server 21.1.16 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@@ -2070,7 +2070,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
- short | recursive ) echo "Configuration of xorg-server 21.1.14:";;
+ short | recursive ) echo "Configuration of xorg-server 21.1.16:";;
esac
cat <<\_ACEOF
@@ -2256,10 +2256,10 @@ Optional Packages:
org.x)
--with-bundle-version=VERSION
Version to use for X11.app's CFBundleVersion
- (default: 21.1.14)
+ (default: 21.1.16)
--with-bundle-version-string=VERSION
Version to use for X11.app's
- CFBundleShortVersionString (default: 21.1.14)
+ CFBundleShortVersionString (default: 21.1.16)
--with-sparkle-feed-url=URL
URL for the Sparkle feed (default:
https://www.xquartz.org/releases/sparkle/release.xml)
@@ -2269,7 +2269,7 @@ Optional Packages:
--with-systemd-daemon support systemd socket activation (default: auto)
--with-xkb-bin-directory=DIR
Directory containing xkbcomp program (default: auto)
- --with-sha1=libc|libmd|libnettle|libgcrypt|libcrypto|libsha1|CommonCrypto|CryptoAPI
+ --with-sha1=libc|libmd|libnettle|nettlestatic|libgcrypt|libcrypto|libsha1|CommonCrypto|CryptoAPI
choose SHA1 implementation
Some influential environment variables:
@@ -2476,7 +2476,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
-xorg-server configure 21.1.14
+xorg-server configure 21.1.16
generated by GNU Autoconf 2.72
Copyright (C) 2023 Free Software Foundation, Inc.
@@ -3154,7 +3154,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
-It was created by xorg-server $as_me 21.1.14, which was
+It was created by xorg-server $as_me 21.1.16, which was
generated by GNU Autoconf 2.72. Invocation command line was
$ $0$ac_configure_args_raw
@@ -3929,7 +3929,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLA
ac_compiler_gnu=$ac_cv_c_compiler_gnu
-RELEASE_DATE="2024-10-29"
+RELEASE_DATE="2025-02-25"
RELEASE_NAME="Caramel Ice Cream"
@@ -4452,7 +4452,7 @@ fi
# Define the identity of the package.
PACKAGE='xorg-server'
- VERSION='21.1.14'
+ VERSION='21.1.16'
printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@@ -26036,7 +26036,7 @@ if test ${with_bundle_version+y}
then :
withval=$with_bundle_version; BUNDLE_VERSION="${withval}"
else case e in #(
- e) BUNDLE_VERSION="21.1.14" ;;
+ e) BUNDLE_VERSION="21.1.16" ;;
esac
fi
@@ -30636,6 +30636,15 @@ printf "%s\n" "#define HAVE_SHA1_IN_LIBN
SHA1_LIBS=-lnettle
fi
+if test "x$with_sha1" = xnettlestatic && test "x$HAVE_LIBNETTLE" != xyes; then
+ as_fn_error $? "nettlestatic requested but libnettle not found" "$LINENO" 5
+fi
+if test "x$with_sha1" = xnettlestatic; then
+
+printf "%s\n" "#define HAVE_SHA1_IN_LIBNETTLE 1" >>confdefs.h
+
+ SHA1_LIBS=-l:libnettle.a
+fi
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for gcry_md_open in -lgcrypt" >&5
printf %s "checking for gcry_md_open in -lgcrypt... " >&6; }
if test ${ac_cv_lib_gcrypt_gcry_md_open+y}
@@ -34805,7 +34814,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
-This file was extended by xorg-server $as_me 21.1.14, which was
+This file was extended by xorg-server $as_me 21.1.16, which was
generated by GNU Autoconf 2.72. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@@ -34873,7 +34882,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config='$ac_cs_config_escaped'
ac_cs_version="\\
-xorg-server config.status 21.1.14
+xorg-server config.status 21.1.16
configured by $0, generated by GNU Autoconf 2.72,
with options \\"\$ac_cs_config\\"
Index: xsrc/external/mit/xorg-server/dist/configure.ac
diff -u xsrc/external/mit/xorg-server/dist/configure.ac:1.15.2.5 xsrc/external/mit/xorg-server/dist/configure.ac:1.15.2.6
--- xsrc/external/mit/xorg-server/dist/configure.ac:1.15.2.5 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/configure.ac Thu Feb 27 10:16:44 2025
@@ -26,8 +26,8 @@ dnl
dnl Process this file with autoconf to create configure.
AC_PREREQ(2.60)
-AC_INIT([xorg-server], 21.1.14, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
-RELEASE_DATE="2024-10-29"
+AC_INIT([xorg-server], 21.1.16, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
+RELEASE_DATE="2025-02-25"
RELEASE_NAME="Caramel Ice Cream"
AC_CONFIG_SRCDIR([Makefile.am])
AC_CONFIG_MACRO_DIR([m4])
@@ -1493,7 +1493,7 @@ CORE_INCS='-I$(top_srcdir)/include -I$(t
# SHA1 hashing
AC_ARG_WITH([sha1],
- [AS_HELP_STRING([--with-sha1=libc|libmd|libnettle|libgcrypt|libcrypto|libsha1|CommonCrypto|CryptoAPI],
+ [AS_HELP_STRING([--with-sha1=libc|libmd|libnettle|nettlestatic|libgcrypt|libcrypto|libsha1|CommonCrypto|CryptoAPI],
[choose SHA1 implementation])])
AC_CHECK_FUNC([SHA1Init], [HAVE_SHA1_IN_LIBC=yes])
if test "x$with_sha1" = x && test "x$HAVE_SHA1_IN_LIBC" = xyes; then
@@ -1568,6 +1568,14 @@ if test "x$with_sha1" = xlibnettle; then
[Use libnettle SHA1 functions])
SHA1_LIBS=-lnettle
fi
+if test "x$with_sha1" = xnettlestatic && test "x$HAVE_LIBNETTLE" != xyes; then
+ AC_MSG_ERROR([nettlestatic requested but libnettle not found])
+fi
+if test "x$with_sha1" = xnettlestatic; then
+ AC_DEFINE([HAVE_SHA1_IN_LIBNETTLE], [1],
+ [Use static libnettle SHA1 functions])
+ SHA1_LIBS=-l:libnettle.a
+fi
AC_CHECK_LIB([gcrypt], [gcry_md_open], [HAVE_LIBGCRYPT=yes])
if test "x$with_sha1" = x && test "x$HAVE_LIBGCRYPT" = xyes; then
with_sha1=libgcrypt
Index: xsrc/external/mit/xorg-server/dist/meson.build
diff -u xsrc/external/mit/xorg-server/dist/meson.build:1.1.1.10.2.5 xsrc/external/mit/xorg-server/dist/meson.build:1.1.1.10.2.6
--- xsrc/external/mit/xorg-server/dist/meson.build:1.1.1.10.2.5 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/meson.build Thu Feb 27 10:16:44 2025
@@ -3,10 +3,10 @@ project('xserver', 'c',
'buildtype=debugoptimized',
'c_std=gnu99',
],
- version: '21.1.14',
+ version: '21.1.16',
meson_version: '>= 0.47.0',
)
-release_date = '2024-10-29'
+release_date = '2025-02-25'
add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
cc = meson.get_compiler('c')
Index: xsrc/external/mit/xorg-server/dist/Xext/sync.c
diff -u xsrc/external/mit/xorg-server/dist/Xext/sync.c:1.12.2.1 xsrc/external/mit/xorg-server/dist/Xext/sync.c:1.12.2.2
--- xsrc/external/mit/xorg-server/dist/Xext/sync.c:1.12.2.1 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/Xext/sync.c Thu Feb 27 10:16:45 2025
@@ -199,8 +199,8 @@ SyncAddTriggerToSyncObject(SyncTrigger *
return Success;
}
- if (!(pCur = malloc(sizeof(SyncTriggerList))))
- return BadAlloc;
+ /* Failure is not an option, it's succeed or burst! */
+ pCur = XNFalloc(sizeof(SyncTriggerList));
pCur->pTrigger = pTrigger;
pCur->next = pTrigger->pSync->pTriglist;
@@ -329,11 +329,6 @@ SyncInitTrigger(ClientPtr client, SyncTr
client->errorValue = syncObject;
return rc;
}
- if (pSync != pTrigger->pSync) { /* new counter for trigger */
- SyncDeleteTriggerFromSyncObject(pTrigger);
- pTrigger->pSync = pSync;
- newSyncObject = TRUE;
- }
}
/* if system counter, ask it what the current value is */
@@ -355,6 +350,24 @@ SyncInitTrigger(ClientPtr client, SyncTr
}
}
+ if (changes & (XSyncCAValueType | XSyncCAValue)) {
+ if (pTrigger->value_type == XSyncAbsolute)
+ pTrigger->test_value = pTrigger->wait_value;
+ else { /* relative */
+ Bool overflow;
+
+ if (pCounter == NULL)
+ return BadMatch;
+
+ overflow = checked_int64_add(&pTrigger->test_value,
+ pCounter->value, pTrigger->wait_value);
+ if (overflow) {
+ client->errorValue = pTrigger->wait_value >> 32;
+ return BadValue;
+ }
+ }
+ }
+
if (changes & XSyncCATestType) {
if (pSync && SYNC_FENCE == pSync->type) {
@@ -383,21 +396,11 @@ SyncInitTrigger(ClientPtr client, SyncTr
}
}
- if (changes & (XSyncCAValueType | XSyncCAValue)) {
- if (pTrigger->value_type == XSyncAbsolute)
- pTrigger->test_value = pTrigger->wait_value;
- else { /* relative */
- Bool overflow;
-
- if (pCounter == NULL)
- return BadMatch;
-
- overflow = checked_int64_add(&pTrigger->test_value,
- pCounter->value, pTrigger->wait_value);
- if (overflow) {
- client->errorValue = pTrigger->wait_value >> 32;
- return BadValue;
- }
+ if (changes & XSyncCACounter) {
+ if (pSync != pTrigger->pSync) { /* new counter for trigger */
+ SyncDeleteTriggerFromSyncObject(pTrigger);
+ pTrigger->pSync = pSync;
+ newSyncObject = TRUE;
}
}
@@ -405,8 +408,7 @@ SyncInitTrigger(ClientPtr client, SyncTr
* a new counter on a trigger
*/
if (newSyncObject) {
- if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)
- return rc;
+ SyncAddTriggerToSyncObject(pTrigger);
}
else if (pCounter && IsSystemCounter(pCounter)) {
SyncComputeBracketValues(pCounter);
@@ -797,8 +799,14 @@ SyncChangeAlarmAttributes(ClientPtr clie
int status;
XSyncCounter counter;
Mask origmask = mask;
-
- counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None;
+ SyncTrigger trigger;
+ Bool select_events_changed = FALSE;
+ Bool select_events_value = FALSE;
+ int64_t delta;
+
+ trigger = pAlarm->trigger;
+ delta = pAlarm->delta;
+ counter = trigger.pSync ? trigger.pSync->id : None;
while (mask) {
int index2 = lowbit(mask);
@@ -814,24 +822,24 @@ SyncChangeAlarmAttributes(ClientPtr clie
case XSyncCAValueType:
mask &= ~XSyncCAValueType;
/* sanity check in SyncInitTrigger */
- pAlarm->trigger.value_type = *values++;
+ trigger.value_type = *values++;
break;
case XSyncCAValue:
mask &= ~XSyncCAValue;
- pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
+ trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
values += 2;
break;
case XSyncCATestType:
mask &= ~XSyncCATestType;
/* sanity check in SyncInitTrigger */
- pAlarm->trigger.test_type = *values++;
+ trigger.test_type = *values++;
break;
case XSyncCADelta:
mask &= ~XSyncCADelta;
- pAlarm->delta = ((int64_t)values[0] << 32) | values[1];
+ delta = ((int64_t)values[0] << 32) | values[1];
values += 2;
break;
@@ -841,10 +849,8 @@ SyncChangeAlarmAttributes(ClientPtr clie
client->errorValue = *values;
return BadValue;
}
- status = SyncEventSelectForAlarm(pAlarm, client,
- (Bool) (*values++));
- if (status != Success)
- return status;
+ select_events_value = (Bool) (*values++);
+ select_events_changed = TRUE;
break;
default:
@@ -853,25 +859,33 @@ SyncChangeAlarmAttributes(ClientPtr clie
}
}
+ if (select_events_changed) {
+ status = SyncEventSelectForAlarm(pAlarm, client, select_events_value);
+ if (status != Success)
+ return status;
+ }
+
/* "If the test-type is PositiveComparison or PositiveTransition
* and delta is less than zero, or if the test-type is
* NegativeComparison or NegativeTransition and delta is
* greater than zero, a Match error is generated."
*/
if (origmask & (XSyncCADelta | XSyncCATestType)) {
- if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) ||
- (pAlarm->trigger.test_type == XSyncPositiveTransition))
- && pAlarm->delta < 0)
+ if ((((trigger.test_type == XSyncPositiveComparison) ||
+ (trigger.test_type == XSyncPositiveTransition))
+ && delta < 0)
||
- (((pAlarm->trigger.test_type == XSyncNegativeComparison) ||
- (pAlarm->trigger.test_type == XSyncNegativeTransition))
- && pAlarm->delta > 0)
+ (((trigger.test_type == XSyncNegativeComparison) ||
+ (trigger.test_type == XSyncNegativeTransition))
+ && delta > 0)
) {
return BadMatch;
}
}
/* postpone this until now, when we're sure nothing else can go wrong */
+ pAlarm->delta = delta;
+ pAlarm->trigger = trigger;
if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter,
origmask & XSyncCAAllTrigger)) != Success)
return status;
Index: xsrc/external/mit/xorg-server/dist/Xi/xibarriers.c
diff -u xsrc/external/mit/xorg-server/dist/Xi/xibarriers.c:1.4 xsrc/external/mit/xorg-server/dist/Xi/xibarriers.c:1.4.4.1
--- xsrc/external/mit/xorg-server/dist/Xi/xibarriers.c:1.4 Sun Mar 3 22:01:08 2019
+++ xsrc/external/mit/xorg-server/dist/Xi/xibarriers.c Thu Feb 27 10:16:45 2025
@@ -129,14 +129,15 @@ static void FreePointerBarrierClient(str
static struct PointerBarrierDevice *GetBarrierDevice(struct PointerBarrierClient *c, int deviceid)
{
- struct PointerBarrierDevice *pbd = NULL;
+ struct PointerBarrierDevice *p, *pbd = NULL;
- xorg_list_for_each_entry(pbd, &c->per_device, entry) {
- if (pbd->deviceid == deviceid)
+ xorg_list_for_each_entry(p, &c->per_device, entry) {
+ if (p->deviceid == deviceid) {
+ pbd = p;
break;
+ }
}
- BUG_WARN(!pbd);
return pbd;
}
@@ -337,6 +338,9 @@ barrier_find_nearest(BarrierScreenPtr cs
double distance;
pbd = GetBarrierDevice(c, dev->id);
+ if (!pbd)
+ continue;
+
if (pbd->seen)
continue;
@@ -445,6 +449,9 @@ input_constrain_cursor(DeviceIntPtr dev,
nearest = &c->barrier;
pbd = GetBarrierDevice(c, master->id);
+ if (!pbd)
+ continue;
+
new_sequence = !pbd->hit;
pbd->seen = TRUE;
@@ -485,6 +492,9 @@ input_constrain_cursor(DeviceIntPtr dev,
int flags = 0;
pbd = GetBarrierDevice(c, master->id);
+ if (!pbd)
+ continue;
+
pbd->seen = FALSE;
if (!pbd->hit)
continue;
@@ -679,6 +689,9 @@ BarrierFreeBarrier(void *data, XID id)
continue;
pbd = GetBarrierDevice(c, dev->id);
+ if (!pbd)
+ continue;
+
if (!pbd->hit)
continue;
@@ -738,6 +751,8 @@ static void remove_master_func(void *res
barrier = container_of(b, struct PointerBarrierClient, barrier);
pbd = GetBarrierDevice(barrier, *deviceid);
+ if (!pbd)
+ return;
if (pbd->hit) {
BarrierEvent ev = {
@@ -903,6 +918,10 @@ ProcXIBarrierReleasePointer(ClientPtr cl
barrier = container_of(b, struct PointerBarrierClient, barrier);
pbd = GetBarrierDevice(barrier, dev->id);
+ if (!pbd) {
+ client->errorValue = dev->id;
+ return BadDevice;
+ }
if (pbd->barrier_event_id == event_id)
pbd->release_event_id = event_id;
Index: xsrc/external/mit/xorg-server/dist/Xi/xichangehierarchy.c
diff -u xsrc/external/mit/xorg-server/dist/Xi/xichangehierarchy.c:1.6.2.1 xsrc/external/mit/xorg-server/dist/Xi/xichangehierarchy.c:1.6.2.2
--- xsrc/external/mit/xorg-server/dist/Xi/xichangehierarchy.c:1.6.2.1 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/Xi/xichangehierarchy.c Thu Feb 27 10:16:45 2025
@@ -46,6 +46,7 @@
#include "exevents.h"
#include "exglobals.h"
#include "geext.h"
+#include "misc.h"
#include "xace.h"
#include "xiquerydevice.h" /* for GetDeviceUse */
@@ -215,46 +216,68 @@ disable_clientpointer(DeviceIntPtr dev)
}
}
+static DeviceIntPtr
+find_disabled_master(int type)
+{
+ DeviceIntPtr dev;
+
+ /* Once a master device is disabled it loses the pairing, so returning the first
+ * match is good enough */
+ for (dev = inputInfo.off_devices; dev; dev = dev->next) {
+ if (dev->type == type)
+ return dev;
+ }
+
+ return NULL;
+}
+
static int
remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES])
{
- DeviceIntPtr ptr, keybd, XTestptr, XTestkeybd;
+ DeviceIntPtr dev, ptr, keybd, XTestptr, XTestkeybd;
int rc = Success;
if (r->return_mode != XIAttachToMaster && r->return_mode != XIFloating)
return BadValue;
- rc = dixLookupDevice(&ptr, r->deviceid, client, DixDestroyAccess);
+ rc = dixLookupDevice(&dev, r->deviceid, client, DixDestroyAccess);
if (rc != Success)
goto unwind;
- if (!IsMaster(ptr)) {
+ if (!IsMaster(dev)) {
client->errorValue = r->deviceid;
rc = BadDevice;
goto unwind;
}
/* XXX: For now, don't allow removal of VCP, VCK */
- if (ptr == inputInfo.pointer ||ptr == inputInfo.keyboard) {
+ if (dev == inputInfo.pointer || dev == inputInfo.keyboard) {
rc = BadDevice;
goto unwind;
}
- ptr = GetMaster(ptr, MASTER_POINTER);
+ if ((ptr = GetMaster(dev, MASTER_POINTER)) == NULL)
+ ptr = find_disabled_master(MASTER_POINTER);
+ BUG_RETURN_VAL(ptr == NULL, BadDevice);
rc = dixLookupDevice(&ptr, ptr->id, client, DixDestroyAccess);
if (rc != Success)
goto unwind;
- keybd = GetMaster(ptr, MASTER_KEYBOARD);
+
+ if ((keybd = GetMaster(dev, MASTER_KEYBOARD)) == NULL)
+ keybd = find_disabled_master(MASTER_KEYBOARD);
+ BUG_RETURN_VAL(keybd == NULL, BadDevice);
rc = dixLookupDevice(&keybd, keybd->id, client, DixDestroyAccess);
if (rc != Success)
goto unwind;
XTestptr = GetXTestDevice(ptr);
+ BUG_RETURN_VAL(XTestptr == NULL, BadDevice);
rc = dixLookupDevice(&XTestptr, XTestptr->id, client, DixDestroyAccess);
if (rc != Success)
goto unwind;
XTestkeybd = GetXTestDevice(keybd);
+ BUG_RETURN_VAL(XTestkeybd == NULL, BadDevice);
rc = dixLookupDevice(&XTestkeybd, XTestkeybd->id, client, DixDestroyAccess);
if (rc != Success)
goto unwind;
Index: xsrc/external/mit/xorg-server/dist/composite/compalloc.c
diff -u xsrc/external/mit/xorg-server/dist/composite/compalloc.c:1.1.1.8 xsrc/external/mit/xorg-server/dist/composite/compalloc.c:1.1.1.8.2.1
--- xsrc/external/mit/xorg-server/dist/composite/compalloc.c:1.1.1.8 Fri Jul 15 02:12:48 2022
+++ xsrc/external/mit/xorg-server/dist/composite/compalloc.c Thu Feb 27 10:16:45 2025
@@ -140,6 +140,7 @@ compRedirectWindow(ClientPtr pClient, Wi
CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen);
WindowPtr pLayerWin;
Bool anyMarked = FALSE;
+ int status = Success;
if (pWin == cs->pOverlayWin) {
return Success;
@@ -218,13 +219,13 @@ compRedirectWindow(ClientPtr pClient, Wi
if (!compCheckRedirect(pWin)) {
FreeResource(ccw->id, RT_NONE);
- return BadAlloc;
+ status = BadAlloc;
}
if (anyMarked)
compHandleMarkedWindows(pWin, pLayerWin);
- return Success;
+ return status;
}
void
@@ -605,9 +606,12 @@ compAllocPixmap(WindowPtr pWin)
int h = pWin->drawable.height + (bw << 1);
PixmapPtr pPixmap = compNewPixmap(pWin, x, y, w, h);
CompWindowPtr cw = GetCompWindow(pWin);
+ Bool status;
- if (!pPixmap)
- return FALSE;
+ if (!pPixmap) {
+ status = FALSE;
+ goto out;
+ }
if (cw->update == CompositeRedirectAutomatic)
pWin->redirectDraw = RedirectDrawAutomatic;
else
@@ -621,14 +625,16 @@ compAllocPixmap(WindowPtr pWin)
DamageRegister(&pWin->drawable, cw->damage);
cw->damageRegistered = TRUE;
}
+ status = TRUE;
+out:
/* Make sure our borderClip is up to date */
RegionUninit(&cw->borderClip);
RegionCopy(&cw->borderClip, &pWin->borderClip);
cw->borderClipX = pWin->drawable.x;
cw->borderClipY = pWin->drawable.y;
- return TRUE;
+ return status;
}
void
Index: xsrc/external/mit/xorg-server/dist/config/10-quirks.conf
diff -u xsrc/external/mit/xorg-server/dist/config/10-quirks.conf:1.1.1.1 xsrc/external/mit/xorg-server/dist/config/10-quirks.conf:1.1.1.1.6.1
--- xsrc/external/mit/xorg-server/dist/config/10-quirks.conf:1.1.1.1 Wed Aug 10 07:44:32 2016
+++ xsrc/external/mit/xorg-server/dist/config/10-quirks.conf Thu Feb 27 10:16:45 2025
@@ -36,3 +36,13 @@ Section "InputClass"
MatchDriver "evdev"
Option "TypeName" "MOUSE"
EndSection
+
+# https://bugzilla.redhat.com/show_bug.cgi?id=2152414
+# Xorg server does not correctly select the DCP for the display without
+# a quirk on Apple Silicon
+Section "OutputClass"
+ Identifier "appledrm"
+ MatchDriver "apple"
+ Driver "modesetting"
+ Option "PrimaryGPU" "true"
+EndSection
Index: xsrc/external/mit/xorg-server/dist/dix/devices.c
diff -u xsrc/external/mit/xorg-server/dist/dix/devices.c:1.13.2.1 xsrc/external/mit/xorg-server/dist/dix/devices.c:1.13.2.2
--- xsrc/external/mit/xorg-server/dist/dix/devices.c:1.13.2.1 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/dix/devices.c Thu Feb 27 10:16:45 2025
@@ -963,6 +963,23 @@ FreeAllDeviceClasses(ClassesPtr classes)
}
+static void
+FreePendingFrozenDeviceEvents(DeviceIntPtr dev)
+{
+ QdEventPtr qe, tmp;
+
+ if (!dev->deviceGrab.sync.frozen)
+ return;
+
+ /* Dequeue any frozen pending events */
+ xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) {
+ if (qe->device == dev) {
+ xorg_list_del(&qe->next);
+ free(qe);
+ }
+ }
+}
+
/**
* Close down a device and free all resources.
* Once closed down, the driver will probably not expect you that you'll ever
@@ -1027,6 +1044,7 @@ CloseDevice(DeviceIntPtr dev)
free(dev->last.touches[j].valuators);
free(dev->last.touches);
dev->config_info = NULL;
+ FreePendingFrozenDeviceEvents(dev);
dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE);
free(dev);
}
@@ -2686,11 +2704,14 @@ AttachDevice(ClientPtr client, DeviceInt
dev->spriteInfo->paired = dev;
}
else {
+ DeviceIntPtr keyboard = GetMaster(dev, MASTER_KEYBOARD);
+
dev->spriteInfo->sprite = master->spriteInfo->sprite;
dev->spriteInfo->paired = master;
dev->spriteInfo->spriteOwner = FALSE;
- XkbPushLockedStateToSlaves(GetMaster(dev, MASTER_KEYBOARD), 0, 0);
+ if (keyboard)
+ XkbPushLockedStateToSlaves(keyboard, 0, 0);
RecalculateMasterButtons(master);
}
Index: xsrc/external/mit/xorg-server/dist/dix/dispatch.c
diff -u xsrc/external/mit/xorg-server/dist/dix/dispatch.c:1.7.2.1 xsrc/external/mit/xorg-server/dist/dix/dispatch.c:1.7.2.2
--- xsrc/external/mit/xorg-server/dist/dix/dispatch.c:1.7.2.1 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/dix/dispatch.c Thu Feb 27 10:16:45 2025
@@ -3107,6 +3107,10 @@ ProcFreeCursor(ClientPtr client)
rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR,
client, DixDestroyAccess);
if (rc == Success) {
+ if (pCursor == rootCursor) {
+ client->errorValue = stuff->id;
+ return BadCursor;
+ }
FreeResource(stuff->id, RT_NONE);
return Success;
}
Index: xsrc/external/mit/xorg-server/dist/dix/enterleave.c
diff -u xsrc/external/mit/xorg-server/dist/dix/enterleave.c:1.7.2.1 xsrc/external/mit/xorg-server/dist/dix/enterleave.c:1.7.2.2
--- xsrc/external/mit/xorg-server/dist/dix/enterleave.c:1.7.2.1 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/dix/enterleave.c Thu Feb 27 10:16:45 2025
@@ -738,7 +738,7 @@ DeliverStateNotifyEvent(DeviceIntPtr dev
(ev - 1)->deviceid |= MORE_EVENTS;
bev->type = DeviceButtonStateNotify;
bev->deviceid = dev->id;
- memcpy((char *) &bev->buttons[4], (char *) &b->down[4],
+ memcpy((char *) &bev->buttons[0], (char *) &b->down[4],
DOWN_LENGTH - 4);
}
Index: xsrc/external/mit/xorg-server/dist/dix/eventconvert.c
diff -u xsrc/external/mit/xorg-server/dist/dix/eventconvert.c:1.1.1.6.2.1 xsrc/external/mit/xorg-server/dist/dix/eventconvert.c:1.1.1.6.2.2
--- xsrc/external/mit/xorg-server/dist/dix/eventconvert.c:1.1.1.6.2.1 Sat Nov 2 10:35:51 2024
+++ xsrc/external/mit/xorg-server/dist/dix/eventconvert.c Thu Feb 27 10:16:45 2025
@@ -735,7 +735,7 @@ eventToDeviceEvent(DeviceEvent *ev, xEve
ptr += xde->buttons_len * 4;
axisval = (FP3232 *) (ptr + xde->valuators_len * 4);
- for (i = 0; i < sizeof(ev->valuators.mask) * 8; i++) {
+ for (i = 0; i < MAX_VALUATORS; i++) {
if (BitIsOn(ev->valuators.mask, i)) {
SetBit(ptr, i);
*axisval = double_to_fp3232(ev->valuators.data[i]);
@@ -802,7 +802,7 @@ eventToRawEvent(RawDeviceEvent *ev, xEve
ptr = (char *) &raw[1];
axisval = (FP3232 *) (ptr + raw->valuators_len * 4);
axisval_raw = axisval + nvals;
- for (i = 0; i < sizeof(ev->valuators.mask) * 8; i++) {
+ for (i = 0; i < MAX_VALUATORS; i++) {
if (BitIsOn(ev->valuators.mask, i)) {
SetBit(ptr, i);
*axisval = double_to_fp3232(ev->valuators.data[i]);
Index: xsrc/external/mit/xorg-server/dist/dix/main.c
diff -u xsrc/external/mit/xorg-server/dist/dix/main.c:1.1.1.8 xsrc/external/mit/xorg-server/dist/dix/main.c:1.1.1.8.2.1
--- xsrc/external/mit/xorg-server/dist/dix/main.c:1.1.1.8 Fri Jul 15 02:12:48 2022
+++ xsrc/external/mit/xorg-server/dist/dix/main.c Thu Feb 27 10:16:45 2025
@@ -231,6 +231,8 @@ dix_main(int argc, char *argv[], char *e
FatalError("could not open default cursor font");
}
+ rootCursor = RefCursor(rootCursor);
+
#ifdef PANORAMIX
/*
* Consolidate window and colourmap information for each screen
@@ -271,6 +273,8 @@ dix_main(int argc, char *argv[], char *e
Dispatch();
+ UnrefCursor(rootCursor);
+
UndisplayDevices();
DisableAllDevices();
Index: xsrc/external/mit/xorg-server/dist/glamor/glamor_program.c
diff -u xsrc/external/mit/xorg-server/dist/glamor/glamor_program.c:1.1.1.3 xsrc/external/mit/xorg-server/dist/glamor/glamor_program.c:1.1.1.3.2.1
--- xsrc/external/mit/xorg-server/dist/glamor/glamor_program.c:1.1.1.3 Fri Jul 15 02:12:47 2022
+++ xsrc/external/mit/xorg-server/dist/glamor/glamor_program.c Thu Feb 27 10:16:45 2025
@@ -340,8 +340,6 @@ glamor_build_program(ScreenPtr
vs_prog = glamor_compile_glsl_prog(GL_VERTEX_SHADER, vs_prog_string);
fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, fs_prog_string);
- free(vs_prog_string);
- free(fs_prog_string);
glAttachShader(prog->prog, vs_prog);
glDeleteShader(vs_prog);
glAttachShader(prog->prog, fs_prog);
@@ -374,6 +372,8 @@ glamor_build_program(ScreenPtr
prog->atlas_uniform = glamor_get_uniform(prog, glamor_program_location_atlas, "atlas");
free(version_string);
+ free(vs_prog_string);
+ free(fs_prog_string);
free(fs_vars);
free(vs_vars);
return TRUE;
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c:1.12 xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c:1.12.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c:1.12 Fri Jul 15 02:18:59 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86Configure.c Thu Feb 27 10:16:46 2025
@@ -324,8 +324,10 @@ configureDeviceSection(int screennum)
len += strlen(opttype);
ptr->dev_comment = realloc(ptr->dev_comment, len);
- if (!ptr->dev_comment)
+ if (!ptr->dev_comment) {
+ free(optname);
break;
+ }
p_e = ptr->dev_comment + strlen(ptr->dev_comment);
sprintf(p_e, "%s%-20s%s%s%s", prefix, optname, middle,
opttype, suffix);
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c:1.7 xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c:1.7.6.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c:1.7 Sat Aug 20 21:15:06 2016
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/common/xf86sbusBus.c Thu Feb 27 10:16:46 2025
@@ -244,7 +244,7 @@ xf86SbusProbe(void)
* in the correct format for a SBUS bus id.
*/
-Bool
+static Bool
xf86ParseSbusBusString(const char *busID, int *fbNum)
{
/*
@@ -316,7 +316,7 @@ xf86ParseSbusBusString(const char *busID
* Compare a BUS ID string with a SBUS bus id. Return TRUE if they match.
*/
-Bool
+static Bool
xf86CompareSbusBusString(const char *busID, int fbNum)
{
int iFbNum;
@@ -333,7 +333,7 @@ xf86CompareSbusBusString(const char *bus
* Check if the slot requested is free. If it is already in use, return FALSE.
*/
-Bool
+static Bool
xf86CheckSbusSlot(int fbNum)
{
int i;
@@ -354,7 +354,7 @@ xf86CheckSbusSlot(int fbNum)
* Otherwise, claim the slot for the screen requesting it.
*/
-int
+static int
xf86ClaimSbusSlot(sbusDevicePtr psdp, DriverPtr drvp, GDevPtr dev, Bool active)
{
EntityPtr p = NULL;
@@ -752,6 +752,7 @@ void
xf86SbusConfigureNewDev(void *busData, sbusDevicePtr sBus, GDevRec * GDev)
{
char *promPath = NULL;
+ char *tmp;
sBus = (sbusDevicePtr) busData;
GDev->identifier = sBus->descr;
@@ -760,10 +761,11 @@ xf86SbusConfigureNewDev(void *busData, s
sparcPromClose();
}
if (promPath) {
- XNFasprintf(&GDev->busID, "SBUS:%s", promPath);
+ XNFasprintf(&tmp, "SBUS:%s", promPath);
free(promPath);
}
else {
- XNFasprintf(&GDev->busID, "SBUS:fb%d", sBus->fbNum);
+ XNFasprintf(&tmp, "SBUS:fb%d", sBus->fbNum);
}
+ GDev->busID = tmp;
}
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c:1.5 xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c:1.5.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c:1.5 Fri Jul 15 02:18:59 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/dri2/dri2.c Thu Feb 27 10:16:46 2025
@@ -356,10 +356,15 @@ DRI2CreateDrawable2(ClientPtr client, Dr
XID *dri2_id_out)
{
DRI2DrawablePtr pPriv;
- DRI2ClientPtr dri2_client = dri2ClientPrivate(client);
+ DRI2ClientPtr dri2_client;
XID dri2_id;
int rc;
+ if (!dixPrivateKeyRegistered(dri2ScreenPrivateKey))
+ return BadValue;
+
+ dri2_client = dri2ClientPrivate(client);
+
pPriv = DRI2GetDrawable(pDraw);
if (pPriv == NULL)
pPriv = DRI2AllocateDrawable(pDraw);
@@ -1362,9 +1367,14 @@ Bool
DRI2Authenticate(ClientPtr client, ScreenPtr pScreen, uint32_t magic)
{
DRI2ScreenPtr ds;
- DRI2ClientPtr dri2_client = dri2ClientPrivate(client);
+ DRI2ClientPtr dri2_client;
ScreenPtr primescreen;
+ if (!dixPrivateKeyRegistered(dri2ScreenPrivateKey))
+ return FALSE;
+
+ dri2_client = dri2ClientPrivate(client);
+
ds = DRI2GetScreenPrime(pScreen, dri2_client->prime_id);
if (ds == NULL)
return FALSE;
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c:1.7 xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c:1.7.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c:1.7 Fri Jul 15 02:18:59 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/driver.c Thu Feb 27 10:16:46 2025
@@ -515,9 +515,41 @@ GetRec(ScrnInfoPtr pScrn)
return TRUE;
}
+static void
+rotate_clip(PixmapPtr pixmap, BoxPtr rect, drmModeClip *clip, Rotation rotation)
+{
+ int w = pixmap->drawable.width;
+ int h = pixmap->drawable.height;
+
+ if (rotation == RR_Rotate_90) {
+ /* Rotate 90 degrees counter clockwise */
+ clip->x1 = rect->y1;
+ clip->x2 = rect->y2;
+ clip->y1 = w - rect->x2;
+ clip->y2 = w - rect->x1;
+ } else if (rotation == RR_Rotate_180) {
+ /* Rotate 180 degrees */
+ clip->x1 = w - rect->x2;
+ clip->x2 = w - rect->x1;
+ clip->y1 = h - rect->y2;
+ clip->y2 = h - rect->y1;
+ } else if (rotation == RR_Rotate_270) {
+ /* Rotate 90 degrees clockwise */
+ clip->x1 = h - rect->y2;
+ clip->x2 = h - rect->y1;
+ clip->y1 = rect->x1;
+ clip->y2 = rect->x2;
+ } else {
+ clip->x1 = rect->x1;
+ clip->x2 = rect->x2;
+ clip->y1 = rect->y1;
+ clip->y2 = rect->y2;
+ }
+}
+
static int
-dispatch_dirty_region(ScrnInfoPtr scrn,
- PixmapPtr pixmap, DamagePtr damage, int fb_id)
+dispatch_dirty_region(ScrnInfoPtr scrn, xf86CrtcPtr crtc,
+ PixmapPtr pixmap, DamagePtr damage, int fb_id)
{
modesettingPtr ms = modesettingPTR(scrn);
RegionPtr dirty = DamageRegion(damage);
@@ -532,13 +564,9 @@ dispatch_dirty_region(ScrnInfoPtr scrn,
if (!clip)
return -ENOMEM;
- /* XXX no need for copy? */
- for (i = 0; i < num_cliprects; i++, rect++) {
- clip[i].x1 = rect->x1;
- clip[i].y1 = rect->y1;
- clip[i].x2 = rect->x2;
- clip[i].y2 = rect->y2;
- }
+ /* Rotate and copy rects into clips */
+ for (i = 0; i < num_cliprects; i++, rect++)
+ rotate_clip(pixmap, rect, &clip[i], crtc->rotation);
/* TODO query connector property to see if this is needed */
ret = drmModeDirtyFB(ms->fd, fb_id, clip, num_cliprects);
@@ -561,20 +589,31 @@ static void
dispatch_dirty(ScreenPtr pScreen)
{
ScrnInfoPtr scrn = xf86ScreenToScrn(pScreen);
+ xf86CrtcConfigPtr xf86_config = XF86_CRTC_CONFIG_PTR(scrn);
modesettingPtr ms = modesettingPTR(scrn);
PixmapPtr pixmap = pScreen->GetScreenPixmap(pScreen);
- int fb_id = ms->drmmode.fb_id;
- int ret;
+ uint32_t fb_id;
+ int ret, c, x, y ;
- ret = dispatch_dirty_region(scrn, pixmap, ms->damage, fb_id);
- if (ret == -EINVAL || ret == -ENOSYS) {
- ms->dirty_enabled = FALSE;
- DamageUnregister(ms->damage);
- DamageDestroy(ms->damage);
- ms->damage = NULL;
- xf86DrvMsg(scrn->scrnIndex, X_INFO,
- "Disabling kernel dirty updates, not required.\n");
- return;
+ for (c = 0; c < xf86_config->num_crtc; c++) {
+ xf86CrtcPtr crtc = xf86_config->crtc[c];
+ drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
+
+ if (!drmmode_crtc)
+ continue;
+
+ drmmode_crtc_get_fb_id(crtc, &fb_id, &x, &y);
+
+ ret = dispatch_dirty_region(scrn, crtc, pixmap, ms->damage, fb_id);
+ if (ret == -EINVAL || ret == -ENOSYS) {
+ ms->dirty_enabled = FALSE;
+ DamageUnregister(ms->damage);
+ DamageDestroy(ms->damage);
+ ms->damage = NULL;
+ xf86DrvMsg(scrn->scrnIndex, X_INFO,
+ "Disabling kernel dirty updates, not required.\n");
+ return;
+ }
}
}
@@ -586,7 +625,7 @@ dispatch_dirty_pixmap(ScrnInfoPtr scrn,
DamagePtr damage = ppriv->secondary_damage;
int fb_id = ppriv->fb_id;
- dispatch_dirty_region(scrn, ppix, damage, fb_id);
+ dispatch_dirty_region(scrn, crtc, ppix, damage, fb_id);
}
static void
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c:1.11 xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c:1.11.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c:1.11 Fri Aug 12 08:18:29 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.c Thu Feb 27 10:16:46 2025
@@ -627,7 +627,7 @@ drmmode_crtc_can_test_mode(xf86CrtcPtr c
return ms->atomic_modeset;
}
-static Bool
+Bool
drmmode_crtc_get_fb_id(xf86CrtcPtr crtc, uint32_t *fb_id, int *x, int *y)
{
drmmode_crtc_private_ptr drmmode_crtc = crtc->driver_private;
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h:1.1.1.4 xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h:1.1.1.4.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h:1.1.1.4 Fri Jul 15 02:12:52 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/drmmode_display.h Thu Feb 27 10:16:46 2025
@@ -311,6 +311,8 @@ void drmmode_copy_fb(ScrnInfoPtr pScrn,
int drmmode_crtc_flip(xf86CrtcPtr crtc, uint32_t fb_id, uint32_t flags, void *data);
+Bool drmmode_crtc_get_fb_id(xf86CrtcPtr crtc, uint32_t *fb_id, int *x, int *y);
+
void drmmode_set_dpms(ScrnInfoPtr scrn, int PowerManagementMode, int flags);
void drmmode_crtc_set_vrr(xf86CrtcPtr crtc, Bool enabled);
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c:1.8 xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c:1.8.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c:1.8 Fri Jul 15 02:18:59 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/drivers/modesetting/present.c Thu Feb 27 10:16:46 2025
@@ -391,22 +391,24 @@ ms_present_unflip(ScreenPtr screen, uint
PixmapPtr pixmap = screen->GetScreenPixmap(screen);
xf86CrtcConfigPtr config = XF86_CRTC_CONFIG_PTR(scrn);
int i;
- struct ms_present_vblank_event *event;
ms_present_set_screen_vrr(scrn, FALSE);
- event = calloc(1, sizeof(struct ms_present_vblank_event));
- if (!event)
- return;
-
- event->event_id = event_id;
- event->unflip = TRUE;
-
- if (ms_present_check_unflip(NULL, screen->root, pixmap, TRUE, NULL) &&
- ms_do_pageflip(screen, pixmap, event, -1, FALSE,
- ms_present_flip_handler, ms_present_flip_abort,
- "Present-unflip")) {
- return;
+ if (ms_present_check_unflip(NULL, screen->root, pixmap, TRUE, NULL)) {
+ struct ms_present_vblank_event *event;
+
+ event = calloc(1, sizeof(struct ms_present_vblank_event));
+ if (!event)
+ return;
+
+ event->event_id = event_id;
+ event->unflip = TRUE;
+
+ if (ms_do_pageflip(screen, pixmap, event, -1, FALSE,
+ ms_present_flip_handler, ms_present_flip_abort,
+ "Present-unflip")) {
+ return;
+ }
}
for (i = 0; i < config->num_crtc; i++) {
Index: xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c
diff -u xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c:1.5 xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c:1.5.2.1
--- xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c:1.5 Fri Jul 15 02:18:59 2022
+++ xsrc/external/mit/xorg-server/dist/hw/xfree86/fbdevhw/fbdevhw.c Thu Feb 27 10:16:46 2025
@@ -335,9 +335,9 @@ fbdev_open(int scrnIndex, const char *de
char *sysfs_path = NULL;
char *node = strrchr(dev, '/') + 1;
- if (asprintf(&sysfs_path, "/sys/class/graphics/%s", node) < 0 ||
+ if (asprintf(&sysfs_path, "/sys/class/graphics/%s/device/subsystem", node) < 0 ||
readlink(sysfs_path, buf, sizeof(buf) - 1) < 0 ||
- strstr(buf, "devices/pci")) {
+ strstr(buf, "bus/pci")) {
free(sysfs_path);
close(fd);
return -1;
Index: xsrc/external/mit/xorg-server/dist/include/dix-config.h.in
diff -u xsrc/external/mit/xorg-server/dist/include/dix-config.h.in:1.8.2.1 xsrc/external/mit/xorg-server/dist/include/dix-config.h.in:1.8.2.2
--- xsrc/external/mit/xorg-server/dist/include/dix-config.h.in:1.8.2.1 Tue Dec 20 09:44:27 2022
+++ xsrc/external/mit/xorg-server/dist/include/dix-config.h.in Thu Feb 27 10:16:46 2025
@@ -173,6 +173,9 @@
/* Define to 1 if you have the `shmctl64' function. */
#undef HAVE_SHMCTL64
+/* Define to 1 if the system has the type 'socklen_t'. */
+#undef HAVE_SOCKLEN_T
+
/* Define to 1 if you have the <stdlib.h> header file. */
#undef HAVE_STDLIB_H
Index: xsrc/external/mit/xorg-server/dist/include/do-not-use-config.h.in
diff -u xsrc/external/mit/xorg-server/dist/include/do-not-use-config.h.in:1.1.1.13.2.3 xsrc/external/mit/xorg-server/dist/include/do-not-use-config.h.in:1.1.1.13.2.4
--- xsrc/external/mit/xorg-server/dist/include/do-not-use-config.h.in:1.1.1.13.2.3 Sat Nov 2 10:35:54 2024
+++ xsrc/external/mit/xorg-server/dist/include/do-not-use-config.h.in Thu Feb 27 10:16:46 2025
@@ -302,7 +302,7 @@
/* Use libmd SHA1 functions */
#undef HAVE_SHA1_IN_LIBMD
-/* Use libnettle SHA1 functions */
+/* Use static libnettle SHA1 functions */
#undef HAVE_SHA1_IN_LIBNETTLE
/* Use libsha1 for SHA1 */
Index: xsrc/external/mit/xorg-server/dist/include/meson.build
diff -u xsrc/external/mit/xorg-server/dist/include/meson.build:1.1.1.4.2.2 xsrc/external/mit/xorg-server/dist/include/meson.build:1.1.1.4.2.3
--- xsrc/external/mit/xorg-server/dist/include/meson.build:1.1.1.4.2.2 Wed Feb 8 17:09:44 2023
+++ xsrc/external/mit/xorg-server/dist/include/meson.build Thu Feb 27 10:16:46 2025
@@ -166,6 +166,8 @@ conf_data.set('HAVE_SETITIMER', cc.has_f
conf_data.set('HAVE_SHMCTL64', cc.has_function('shmctl64') ? '1' : false)
conf_data.set('HAVE_SIGACTION', cc.has_function('sigaction') ? '1' : false)
conf_data.set('HAVE_SIGPROCMASK', cc.has_function('sigprocmask') ? '1' : false)
+# HAVE_SOCKLEN_T is used by xtrans when IPv6 is disabled
+conf_data.set('HAVE_SOCKLEN_T', cc.has_type('socklen_t', prefix: '#include <sys/socket.h>') ? '1' : false)
conf_data.set('HAVE_STRCASECMP', cc.has_function('strcasecmp') ? '1' : false)
conf_data.set('HAVE_STRCASESTR', cc.has_function('strcasestr') ? '1' : false)
conf_data.set('HAVE_STRLCAT', cc.has_function('strlcat', dependencies: libbsd_dep) ? '1' : false)
Index: xsrc/external/mit/xorg-server/dist/os/WaitFor.c
diff -u xsrc/external/mit/xorg-server/dist/os/WaitFor.c:1.5 xsrc/external/mit/xorg-server/dist/os/WaitFor.c:1.5.2.1
--- xsrc/external/mit/xorg-server/dist/os/WaitFor.c:1.5 Fri Jul 15 02:19:01 2022
+++ xsrc/external/mit/xorg-server/dist/os/WaitFor.c Thu Feb 27 10:16:46 2025
@@ -420,13 +420,13 @@ NextDPMSTimeout(INT32 timeout)
switch (DPMSPowerLevel) {
case DPMSModeOn:
DPMS_CHECK_TIMEOUT(DPMSStandbyTime)
-
+ /* fallthrough */
case DPMSModeStandby:
DPMS_CHECK_TIMEOUT(DPMSSuspendTime)
-
+ /* fallthrough */
case DPMSModeSuspend:
DPMS_CHECK_TIMEOUT(DPMSOffTime)
-
+ /* fallthrough */
default: /* DPMSModeOff */
return 0;
}
Index: xsrc/external/mit/xorg-server/dist/os/access.c
diff -u xsrc/external/mit/xorg-server/dist/os/access.c:1.6.2.1 xsrc/external/mit/xorg-server/dist/os/access.c:1.6.2.2
--- xsrc/external/mit/xorg-server/dist/os/access.c:1.6.2.1 Wed Feb 8 17:09:46 2023
+++ xsrc/external/mit/xorg-server/dist/os/access.c Thu Feb 27 10:16:46 2025
@@ -1425,13 +1425,15 @@ RemoveHost(ClientPtr client, int family,
case FamilyChaos:
case FamilyServerInterpreted:
if ((len = CheckAddr(family, pAddr, length)) < 0) {
- client->errorValue = length;
+ if (client)
+ client->errorValue = length;
return BadValue;
}
break;
case FamilyLocal:
default:
- client->errorValue = family;
+ if (client)
+ client->errorValue = family;
return BadValue;
}
for (prev = &validhosts;
@@ -1860,7 +1862,7 @@ siHostnameAddrMatch(int family, void *ad
char hostname[SI_HOSTNAME_MAXLEN];
int f, hostaddrlen;
void *hostaddr;
- const char **addrlist;
+ char **addrlist;
if (siAddrLen >= sizeof(hostname))
return FALSE;
@@ -1885,7 +1887,9 @@ siHostnameAddrMatch(int family, void *ad
if ((f == family) && (len == hostaddrlen) &&
(memcmp(addr, hostaddr, len) == 0)) {
res = TRUE;
+#ifdef h_addr
break;
+#endif
}
}
}
Index: xsrc/external/mit/xorg-server/dist/os/connection.c
diff -u xsrc/external/mit/xorg-server/dist/os/connection.c:1.7.2.1 xsrc/external/mit/xorg-server/dist/os/connection.c:1.7.2.2
--- xsrc/external/mit/xorg-server/dist/os/connection.c:1.7.2.1 Wed Feb 8 17:09:46 2023
+++ xsrc/external/mit/xorg-server/dist/os/connection.c Thu Feb 27 10:16:46 2025
@@ -244,7 +244,7 @@ void
CreateWellKnownSockets(void)
{
int i;
- int partial;
+ int partial = 0;
/* display is initialized to "0" by main(). It is then set to the display
* number if specified on the command line. */
Index: xsrc/external/mit/xorg-server/dist/render/picture.c
diff -u xsrc/external/mit/xorg-server/dist/render/picture.c:1.1.1.9 xsrc/external/mit/xorg-server/dist/render/picture.c:1.1.1.9.2.1
--- xsrc/external/mit/xorg-server/dist/render/picture.c:1.1.1.9 Fri Jul 15 09:08:58 2022
+++ xsrc/external/mit/xorg-server/dist/render/picture.c Thu Feb 27 10:16:47 2025
@@ -427,6 +427,9 @@ PictureInitIndexedFormat(ScreenPtr pScre
else {
VisualPtr pVisual = PictureFindVisual(pScreen, format->index.vid);
+ if (pVisual == NULL)
+ return FALSE;
+
if (CreateColormap(FakeClientID(0), pScreen, pVisual,
&format->index.pColormap, AllocNone, 0)
!= Success)
Index: xsrc/external/mit/xorg-server/dist/test/sync/sync.c
diff -u xsrc/external/mit/xorg-server/dist/test/sync/sync.c:1.1.1.1 xsrc/external/mit/xorg-server/dist/test/sync/sync.c:1.1.1.1.4.1
--- xsrc/external/mit/xorg-server/dist/test/sync/sync.c:1.1.1.1 Mon Dec 31 09:36:08 2018
+++ xsrc/external/mit/xorg-server/dist/test/sync/sync.c Thu Feb 27 10:16:47 2025
@@ -260,9 +260,13 @@ test_change_alarm_delta(xcb_connection_t
xcb_sync_create_alarm(c, alarm, 0, NULL);
for (int i = 0; i < ARRAY_SIZE(some_values); i++) {
- uint32_t values[] = { some_values[i] >> 32, some_values[i] };
+ uint32_t mask = XCB_SYNC_CA_TEST_TYPE | XCB_SYNC_CA_DELTA;
+ uint32_t test_type = (some_values[i] >= 0 ?
+ XCB_SYNC_TESTTYPE_POSITIVE_COMPARISON :
+ XCB_SYNC_TESTTYPE_NEGATIVE_COMPARISON);
+ uint32_t values[] = { test_type, some_values[i] >> 32, some_values[i] };
- xcb_sync_change_alarm(c, alarm, XCB_SYNC_CA_DELTA, values);
+ xcb_sync_change_alarm(c, alarm, mask, values);
queries[i] = xcb_sync_query_alarm_unchecked(c, alarm);
}
Index: xsrc/external/mit/xorg-server/dist/xkb/XKBMAlloc.c
diff -u xsrc/external/mit/xorg-server/dist/xkb/XKBMAlloc.c:1.1.1.6 xsrc/external/mit/xorg-server/dist/xkb/XKBMAlloc.c:1.1.1.6.4.1
--- xsrc/external/mit/xorg-server/dist/xkb/XKBMAlloc.c:1.1.1.6 Mon Dec 31 09:36:08 2018
+++ xsrc/external/mit/xorg-server/dist/xkb/XKBMAlloc.c Thu Feb 27 10:16:47 2025
@@ -42,7 +42,6 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
Status
XkbAllocClientMap(XkbDescPtr xkb, unsigned which, unsigned nTotalTypes)
{
- register int i;
XkbClientMapPtr map;
if ((xkb == NULL) ||
@@ -104,8 +103,7 @@ XkbAllocClientMap(XkbDescPtr xkb, unsign
map->syms[0] = NoSymbol;
}
if (map->key_sym_map == NULL) {
- i = xkb->max_key_code + 1;
- map->key_sym_map = calloc(i, sizeof(XkbSymMapRec));
+ map->key_sym_map = calloc(MAP_LENGTH, sizeof(XkbSymMapRec));
if (map->key_sym_map == NULL)
return BadAlloc;
}
@@ -116,8 +114,7 @@ XkbAllocClientMap(XkbDescPtr xkb, unsign
(xkb->max_key_code < xkb->min_key_code))
return BadMatch;
if (map->modmap == NULL) {
- i = xkb->max_key_code + 1;
- map->modmap = calloc(i, sizeof(unsigned char));
+ map->modmap = calloc(MAP_LENGTH, sizeof(unsigned char));
if (map->modmap == NULL)
return BadAlloc;
}
@@ -150,8 +147,7 @@ XkbAllocServerMap(XkbDescPtr xkb, unsign
(xkb->max_key_code < xkb->min_key_code))
return BadMatch;
if (map->explicit == NULL) {
- i = xkb->max_key_code + 1;
- map->explicit = calloc(i, sizeof(unsigned char));
+ map->explicit = calloc(MAP_LENGTH, sizeof(unsigned char));
if (map->explicit == NULL)
return BadAlloc;
}
@@ -186,8 +182,7 @@ XkbAllocServerMap(XkbDescPtr xkb, unsign
((map->size_acts - map->num_acts) * sizeof(XkbAction)));
}
if (map->key_acts == NULL) {
- i = xkb->max_key_code + 1;
- map->key_acts = calloc(i, sizeof(unsigned short));
+ map->key_acts = calloc(MAP_LENGTH, sizeof(unsigned short));
if (map->key_acts == NULL)
return BadAlloc;
}
@@ -198,8 +193,7 @@ XkbAllocServerMap(XkbDescPtr xkb, unsign
(xkb->max_key_code < xkb->min_key_code))
return BadMatch;
if (map->behaviors == NULL) {
- i = xkb->max_key_code + 1;
- map->behaviors = calloc(i, sizeof(XkbBehavior));
+ map->behaviors = calloc(MAP_LENGTH, sizeof(XkbBehavior));
if (map->behaviors == NULL)
return BadAlloc;
}
@@ -210,8 +204,7 @@ XkbAllocServerMap(XkbDescPtr xkb, unsign
(xkb->max_key_code < xkb->min_key_code))
return BadMatch;
if (map->vmodmap == NULL) {
- i = xkb->max_key_code + 1;
- map->vmodmap = calloc(i, sizeof(unsigned short));
+ map->vmodmap = calloc(MAP_LENGTH, sizeof(unsigned short));
if (map->vmodmap == NULL)
return BadAlloc;
}
@@ -652,18 +645,9 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
if (maxKC > xkb->max_key_code) {
if (changes)
changes->map.max_key_code = maxKC;
- tmp = maxKC - xkb->max_key_code;
+ tmp = MAP_LENGTH - xkb->max_key_code;
if (xkb->map) {
if (xkb->map->key_sym_map) {
- XkbSymMapRec *prev_key_sym_map = xkb->map->key_sym_map;
-
- xkb->map->key_sym_map = reallocarray(xkb->map->key_sym_map,
- maxKC + 1,
- sizeof(XkbSymMapRec));
- if (!xkb->map->key_sym_map) {
- free(prev_key_sym_map);
- return BadAlloc;
- }
memset((char *) &xkb->map->key_sym_map[xkb->max_key_code], 0,
tmp * sizeof(XkbSymMapRec));
if (changes) {
@@ -676,15 +660,6 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
}
}
if (xkb->map->modmap) {
- unsigned char *prev_modmap = xkb->map->modmap;
-
- xkb->map->modmap = reallocarray(xkb->map->modmap,
- maxKC + 1,
- sizeof(unsigned char));
- if (!xkb->map->modmap) {
- free(prev_modmap);
- return BadAlloc;
- }
memset((char *) &xkb->map->modmap[xkb->max_key_code], 0, tmp);
if (changes) {
changes->map.changed = _ExtendRange(changes->map.changed,
@@ -699,15 +674,6 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
}
if (xkb->server) {
if (xkb->server->behaviors) {
- XkbBehavior *prev_behaviors = xkb->server->behaviors;
-
- xkb->server->behaviors = reallocarray(xkb->server->behaviors,
- maxKC + 1,
- sizeof(XkbBehavior));
- if (!xkb->server->behaviors) {
- free(prev_behaviors);
- return BadAlloc;
- }
memset((char *) &xkb->server->behaviors[xkb->max_key_code], 0,
tmp * sizeof(XkbBehavior));
if (changes) {
@@ -721,15 +687,6 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
}
}
if (xkb->server->key_acts) {
- unsigned short *prev_key_acts = xkb->server->key_acts;
-
- xkb->server->key_acts = reallocarray(xkb->server->key_acts,
- maxKC + 1,
- sizeof(unsigned short));
- if (!xkb->server->key_acts) {
- free(prev_key_acts);
- return BadAlloc;
- }
memset((char *) &xkb->server->key_acts[xkb->max_key_code], 0,
tmp * sizeof(unsigned short));
if (changes) {
@@ -743,15 +700,6 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
}
}
if (xkb->server->vmodmap) {
- unsigned short *prev_vmodmap = xkb->server->vmodmap;
-
- xkb->server->vmodmap = reallocarray(xkb->server->vmodmap,
- maxKC + 1,
- sizeof(unsigned short));
- if (!xkb->server->vmodmap) {
- free(prev_vmodmap);
- return BadAlloc;
- }
memset((char *) &xkb->server->vmodmap[xkb->max_key_code], 0,
tmp * sizeof(unsigned short));
if (changes) {
@@ -766,14 +714,6 @@ XkbChangeKeycodeRange(XkbDescPtr xkb,
}
}
if ((xkb->names) && (xkb->names->keys)) {
- XkbKeyNameRec *prev_keys = xkb->names->keys;
-
- xkb->names->keys = reallocarray(xkb->names->keys,
- maxKC + 1, sizeof(XkbKeyNameRec));
- if (!xkb->names->keys) {
- free(prev_keys);
- return BadAlloc;
- }
memset((char *) &xkb->names->keys[xkb->max_key_code], 0,
tmp * sizeof(XkbKeyNameRec));
if (changes) {
Index: xsrc/external/mit/xorg-server/dist/xkb/XKBMisc.c
diff -u xsrc/external/mit/xorg-server/dist/xkb/XKBMisc.c:1.1.1.7 xsrc/external/mit/xorg-server/dist/xkb/XKBMisc.c:1.1.1.7.2.1
--- xsrc/external/mit/xorg-server/dist/xkb/XKBMisc.c:1.1.1.7 Fri Jul 15 02:12:45 2022
+++ xsrc/external/mit/xorg-server/dist/xkb/XKBMisc.c Thu Feb 27 10:16:47 2025
@@ -553,6 +553,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb,
i = XkbSetNumGroups(i, 0);
xkb->map->key_sym_map[key].group_info = i;
XkbResizeKeySyms(xkb, key, 0);
+ XkbResizeKeyActions(xkb, key, 0);
return Success;
}
Index: xsrc/external/mit/xorg-server/dist/xkb/xkb.c
diff -u xsrc/external/mit/xorg-server/dist/xkb/xkb.c:1.8.2.2 xsrc/external/mit/xorg-server/dist/xkb/xkb.c:1.8.2.3
--- xsrc/external/mit/xorg-server/dist/xkb/xkb.c:1.8.2.2 Sat Nov 2 10:35:55 2024
+++ xsrc/external/mit/xorg-server/dist/xkb/xkb.c Thu Feb 27 10:16:47 2025
@@ -1093,10 +1093,10 @@ XkbSizeKeySyms(XkbDescPtr xkb, xkbGetMap
len = rep->nKeySyms * SIZEOF(xkbSymMapWireDesc);
symMap = &xkb->map->key_sym_map[rep->firstKeySym];
for (i = nSyms = 0; i < rep->nKeySyms; i++, symMap++) {
- if (symMap->offset != 0) {
- nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
- nSyms += nSymsThisKey;
- }
+ nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
+ if (nSymsThisKey == 0)
+ continue;
+ nSyms += nSymsThisKey;
}
len += nSyms * 4;
rep->totalSyms = nSyms;
Index: xsrc/external/mit/xorg-server/dist/xkb/xkbUtils.c
diff -u xsrc/external/mit/xorg-server/dist/xkb/xkbUtils.c:1.1.1.6.4.2 xsrc/external/mit/xorg-server/dist/xkb/xkbUtils.c:1.1.1.6.4.3
--- xsrc/external/mit/xorg-server/dist/xkb/xkbUtils.c:1.1.1.6.4.2 Sat Apr 1 15:21:51 2023
+++ xsrc/external/mit/xorg-server/dist/xkb/xkbUtils.c Thu Feb 27 10:16:47 2025
@@ -933,6 +933,7 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDes
{
void *tmp = NULL;
int i;
+ int gap;
XkbKeyTypePtr stype = NULL, dtype = NULL;
/* client map */
@@ -962,15 +963,20 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDes
}
dst->map->num_syms = src->map->num_syms;
dst->map->size_syms = src->map->size_syms;
+ gap = MAP_LENGTH - (src->max_key_code + 1);
if (src->map->key_sym_map) {
- if (src->max_key_code != dst->max_key_code) {
+ if (!dst->map->key_sym_map) {
tmp = reallocarray(dst->map->key_sym_map,
- src->max_key_code + 1, sizeof(XkbSymMapRec));
+ MAP_LENGTH, sizeof(XkbSymMapRec));
if (!tmp)
return FALSE;
dst->map->key_sym_map = tmp;
}
+ if (gap > 0) {
+ memset((char *) &dst->map->key_sym_map[gap], 0,
+ gap * sizeof(XkbSymMapRec));
+ }
memcpy(dst->map->key_sym_map, src->map->key_sym_map,
(src->max_key_code + 1) * sizeof(XkbSymMapRec));
}
@@ -1141,12 +1147,15 @@ _XkbCopyClientMap(XkbDescPtr src, XkbDes
}
if (src->map->modmap) {
- if (src->max_key_code != dst->max_key_code) {
- tmp = realloc(dst->map->modmap, src->max_key_code + 1);
+ if (!dst->map->modmap) {
+ tmp = realloc(dst->map->modmap, MAP_LENGTH);
if (!tmp)
return FALSE;
dst->map->modmap = tmp;
}
+ if (gap > 0) {
+ memset(dst->map->modmap + gap, 0, gap);
+ }
memcpy(dst->map->modmap, src->map->modmap, src->max_key_code + 1);
}
else {
@@ -1166,6 +1175,7 @@ static Bool
_XkbCopyServerMap(XkbDescPtr src, XkbDescPtr dst)
{
void *tmp = NULL;
+ int gap;
/* server map */
if (src->server) {
@@ -1176,13 +1186,16 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDes
dst->server = tmp;
}
+ gap = MAP_LENGTH - (src->max_key_code + 1);
if (src->server->explicit) {
- if (src->max_key_code != dst->max_key_code) {
- tmp = realloc(dst->server->explicit, src->max_key_code + 1);
+ if (!dst->server->explicit) {
+ tmp = realloc(dst->server->explicit, MAP_LENGTH);
if (!tmp)
return FALSE;
dst->server->explicit = tmp;
}
+ if (gap > 0)
+ memset(dst->server->explicit + gap, 0, gap);
memcpy(dst->server->explicit, src->server->explicit,
src->max_key_code + 1);
}
@@ -1210,13 +1223,15 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDes
dst->server->num_acts = src->server->num_acts;
if (src->server->key_acts) {
- if (src->max_key_code != dst->max_key_code) {
+ if (!dst->server->key_acts) {
tmp = reallocarray(dst->server->key_acts,
- src->max_key_code + 1, sizeof(unsigned short));
+ MAP_LENGTH, sizeof(unsigned short));
if (!tmp)
return FALSE;
dst->server->key_acts = tmp;
}
+ if (gap > 0)
+ memset((char *) &dst->server->key_acts[gap], 0, gap * sizeof(unsigned short));
memcpy(dst->server->key_acts, src->server->key_acts,
(src->max_key_code + 1) * sizeof(unsigned short));
}
@@ -1226,13 +1241,15 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDes
}
if (src->server->behaviors) {
- if (src->max_key_code != dst->max_key_code) {
+ if (!dst->server->behaviors) {
tmp = reallocarray(dst->server->behaviors,
- src->max_key_code + 1, sizeof(XkbBehavior));
+ MAP_LENGTH, sizeof(XkbBehavior));
if (!tmp)
return FALSE;
dst->server->behaviors = tmp;
}
+ if (gap > 0)
+ memset((char *) &dst->server->behaviors[gap], 0, gap * sizeof(XkbBehavior));
memcpy(dst->server->behaviors, src->server->behaviors,
(src->max_key_code + 1) * sizeof(XkbBehavior));
}
@@ -1244,13 +1261,15 @@ _XkbCopyServerMap(XkbDescPtr src, XkbDes
memcpy(dst->server->vmods, src->server->vmods, XkbNumVirtualMods);
if (src->server->vmodmap) {
- if (src->max_key_code != dst->max_key_code) {
+ if (!dst->server->vmodmap) {
tmp = reallocarray(dst->server->vmodmap,
- src->max_key_code + 1, sizeof(unsigned short));
+ MAP_LENGTH, sizeof(unsigned short));
if (!tmp)
return FALSE;
dst->server->vmodmap = tmp;
}
+ if (gap > 0)
+ memset((char *) &dst->server->vmodmap[gap], 0, gap * sizeof(unsigned short));
memcpy(dst->server->vmodmap, src->server->vmodmap,
(src->max_key_code + 1) * sizeof(unsigned short));
}
@@ -1271,6 +1290,7 @@ static Bool
_XkbCopyNames(XkbDescPtr src, XkbDescPtr dst)
{
void *tmp = NULL;
+ int gap;
/* names */
if (src->names) {
@@ -1280,14 +1300,17 @@ _XkbCopyNames(XkbDescPtr src, XkbDescPtr
return FALSE;
}
+ gap = MAP_LENGTH - (src->max_key_code + 1);
if (src->names->keys) {
- if (src->max_key_code != dst->max_key_code) {
- tmp = reallocarray(dst->names->keys, src->max_key_code + 1,
+ if (!dst->names->keys) {
+ tmp = reallocarray(dst->names->keys, MAP_LENGTH,
sizeof(XkbKeyNameRec));
if (!tmp)
return FALSE;
dst->names->keys = tmp;
}
+ if (gap > 0)
+ memset((char *) &dst->names->keys[gap], 0, gap * sizeof(XkbKeyNameRec));
memcpy(dst->names->keys, src->names->keys,
(src->max_key_code + 1) * sizeof(XkbKeyNameRec));
}
Index: xsrc/external/mit/xorg-server/dist/xkb/xkbtext.c
diff -u xsrc/external/mit/xorg-server/dist/xkb/xkbtext.c:1.1.1.6 xsrc/external/mit/xorg-server/dist/xkb/xkbtext.c:1.1.1.6.2.1
--- xsrc/external/mit/xorg-server/dist/xkb/xkbtext.c:1.1.1.6 Fri Jul 15 02:12:45 2022
+++ xsrc/external/mit/xorg-server/dist/xkb/xkbtext.c Thu Feb 27 10:16:47 2025
@@ -175,14 +175,14 @@ XkbVModMaskText(XkbDescPtr xkb,
len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
if (format == XkbCFile)
len += 4;
- if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
- if (str != buf) {
- if (format == XkbCFile)
- *str++ = '|';
- else
- *str++ = '+';
- len--;
- }
+ if ((str - buf) + len > VMOD_BUFFER_SIZE)
+ continue; /* Skip */
+ if (str != buf) {
+ if (format == XkbCFile)
+ *str++ = '|';
+ else
+ *str++ = '+';
+ len--;
}
if (format == XkbCFile)
sprintf(str, "%sMask", tmp);
Index: xsrc/external/mit/xorg-server/include/dix-config.h
diff -u xsrc/external/mit/xorg-server/include/dix-config.h:1.46.2.5 xsrc/external/mit/xorg-server/include/dix-config.h:1.46.2.6
--- xsrc/external/mit/xorg-server/include/dix-config.h:1.46.2.5 Sat Nov 2 10:35:55 2024
+++ xsrc/external/mit/xorg-server/include/dix-config.h Thu Feb 27 10:16:47 2025
@@ -171,6 +171,9 @@
/* Define to 1 if you have the <stdlib.h> header file. */
#define HAVE_STDLIB_H 1
+/* Define to 1 if the system has the type 'socklen_t'. */
+#define HAVE_SOCKLEN_T 1
+
/* Define to 1 if you have the `strcasecmp' function. */
#define HAVE_STRCASECMP 1
@@ -343,7 +346,7 @@
#define XINERAMA 1
/* Current Xorg version */
-#define XORG_VERSION_CURRENT ((10000000) + ((21) * 100000) + ((1) * 1000) + 14)
+#define XORG_VERSION_CURRENT ((10000000) + ((21) * 100000) + ((1) * 1000) + 16)
/* Build Xv Extension */
#define XvExtension 1
Index: xsrc/external/mit/xorg-server/include/version-config.h
diff -u xsrc/external/mit/xorg-server/include/version-config.h:1.16.2.5 xsrc/external/mit/xorg-server/include/version-config.h:1.16.2.6
--- xsrc/external/mit/xorg-server/include/version-config.h:1.16.2.5 Sat Nov 2 10:35:55 2024
+++ xsrc/external/mit/xorg-server/include/version-config.h Thu Feb 27 10:16:47 2025
@@ -5,13 +5,13 @@
#define VERSION_CONFIG_H
/* Vendor man version */
-#define VENDOR_MAN_VERSION "Version 21.1.14"
+#define VENDOR_MAN_VERSION "Version 21.1.16"
/* Vendor name */
#define VENDOR_NAME "The X.Org Foundation"
/* Vendor release */
-#define VENDOR_RELEASE ((10000000) + ((21) * 100000) + ((1) * 1000) + 14)
+#define VENDOR_RELEASE ((10000000) + ((21) * 100000) + ((1) * 1000) + 16)
#endif /* VERSION_CONFIG_H */
Index: xsrc/external/mit/xorg-server/include/xorg-config.h
diff -u xsrc/external/mit/xorg-server/include/xorg-config.h:1.26.2.5 xsrc/external/mit/xorg-server/include/xorg-config.h:1.26.2.6
--- xsrc/external/mit/xorg-server/include/xorg-config.h:1.26.2.5 Sat Nov 2 10:35:56 2024
+++ xsrc/external/mit/xorg-server/include/xorg-config.h Thu Feb 27 10:16:47 2025
@@ -17,7 +17,7 @@
#define XORGSERVER 1
/* Current X.Org version. */
-#define XORG_VERSION_CURRENT ((10000000) + ((21) * 100000) + ((1) * 1000) + 14)
+#define XORG_VERSION_CURRENT ((10000000) + ((21) * 100000) + ((1) * 1000) + 16)
/* Name of X server. */
#define __XSERVERNAME__ "Xorg"
Index: xsrc/external/mit/xorg-server/include/xorg-server.h
diff -u xsrc/external/mit/xorg-server/include/xorg-server.h:1.26.2.5 xsrc/external/mit/xorg-server/include/xorg-server.h:1.26.2.6
--- xsrc/external/mit/xorg-server/include/xorg-server.h:1.26.2.5 Sat Nov 2 10:35:56 2024
+++ xsrc/external/mit/xorg-server/include/xorg-server.h Thu Feb 27 10:16:47 2025
@@ -140,7 +140,7 @@
#define XORGSERVER 1
/* Current Xorg version */
-#define XORG_VERSION_CURRENT ((10000000) + ((21) * 100000) + ((1) * 1000) + 14)
+#define XORG_VERSION_CURRENT ((10000000) + ((21) * 100000) + ((1) * 1000) + 16)
/* Build Xv Extension */
#define XvExtension 1
