SecBSD/xenocara
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix refcounting of glyphs during ProcRenderAddGlyphs() (CVE-2024-31083)

Browse source
This commit is contained in:
purplerain 2024-04-04 10:27:23 +00:00
parent f29b6fb075
commit 128113431e
Signed by: purplerain
GPG key ID: F42C07F07E2E35B7
3 changed files with 16 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
xserver/render/glyph.c
View file

@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph)
}
}
static void
void
FreeGlyph(GlyphPtr glyph, int format)
{
CheckDuplicates(&globalGlyphs[format], "FreeGlyph");
BUG_RETURN(glyph->refcnt == 0);
if (--glyph->refcnt == 0) {
GlyphRefPtr gr;
int i;
@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdepth)
glyph = (GlyphPtr) malloc(size);
if (!glyph)
return 0;
glyph->refcnt = 0;
glyph->refcnt = 1;
glyph->size = size + sizeof(xGlyphInfo);
glyph->info = *gi;
dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH);