update to xserver 21.1.12

This commit is contained in:
purplerain 2024-04-09 08:46:18 +00:00
parent c5d87f442b
commit f0fd08c832
Signed by: purplerain
GPG key ID: F42C07F07E2E35B7
59 changed files with 449 additions and 209 deletions

View file

@ -1,3 +1,217 @@
commit 101caa1b03bc26b718f4618eb24104add5d14a4b
Author: Povilas Kanapickas <povilas@radix.lt>
Date: Wed Apr 3 23:43:42 2024 +0300
xserver 21.1.12
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
commit 1173156404be826f50f453ca11bda28ccb5a5268
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date: Tue Jan 30 13:13:35 2024 +1000
render: fix refcounting of glyphs during ProcRenderAddGlyphs
Previously, AllocateGlyph would return a new glyph with refcount=0 and a
re-used glyph would end up not changing the refcount at all. The
resulting glyph_new array would thus have multiple entries pointing to
the same non-refcounted glyphs.
AddGlyph may free a glyph, resulting in a UAF when the same glyph
pointer is then later used.
Fix this by returning a refcount of 1 for a new glyph and always
incrementing the refcount for a re-used glyph, followed by dropping that
refcount back down again when we're done with it.
CVE-2024-31083, ZDI-CAN-22880
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
(cherry picked from commit bdca6c3d1f5057eeb31609b1280fc93237b00c77)
commit 0e34d8ebc98a0ba6f9f0a2f8f5045761bccc45d3
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 22 19:07:34 2024 -0700
Xquartz: ProcAppleDRICreatePixmap needs to use unswapped length to send reply
CVE-2024-31082
Fixes: 14205ade0 ("XQuartz: appledri: Fix byte swapping in replies")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
(cherry picked from commit 6c684d035c06fd41c727f0ef0744517580864cef)
commit cea92ca78f900bfb4c9a5540dfd631e065b9151b
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 22 18:56:27 2024 -0700
Xi: ProcXIPassiveGrabDevice needs to use unswapped length to send reply
CVE-2024-31081
Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
(cherry picked from commit 3e77295f888c67fc7645db5d0c00926a29ffecee)
commit 8a7cd0e3ef194610300c1a38fb5a5423b23dd6a5
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Fri Mar 22 18:51:45 2024 -0700
Xi: ProcXIGetSelectedEvents needs to use unswapped length to send reply
CVE-2024-31080
Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
(cherry picked from commit 96798fc1967491c80a4d0c8d9e0a80586cb2152b)
commit 5ca3a95135d9c89753e2af19da5a2615ea2be1c3
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Thu Mar 21 18:08:35 2024 -0700
Xext: SProcSyncCreateFence needs to swap drawable id too
Otherwise it causes the server to return BadDrawable giving a
byte-swapped resource id instead of the real id the client sent.
Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
Fixes: 397dfd9f8 ("Create/Destroy/Trigger/Reset/Query Fence Sync objs")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
---
(cherry picked from commit e6573baa7d99a77f44229b9a96a41bbda57e2387)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1438>
commit 5d7272f05d9ef6bef93419febee3c9dfc63ec055
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date: Sat Mar 23 10:42:33 2024 -0700
Allow disabling byte-swapped clients
The X server swapping code is a huge attack surface, much of this code
is untested and prone to security issues. The use-case of byte-swapped
clients is very niche, so allow users to disable this if they don't
need it, using either a config option or commandline flag.
For Xorg, this adds the ServerFlag "AllowByteSwappedClients" "off".
For all DDX, this adds the commandline options +byteswappedclients and
-byteswappedclients to enable or disable, respectively.
Fixes #1201
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
(cherry picked from commit 412777664a20dd3561b936c02c96571a756fe9b2)
(cherry picked from commit af5cd5acc9012e527ee869f8e98bf6c2e9a02ca4)
Backport to server-21.1-branch modified to keep byte-swapping enabled
by default but easy to disable by users or admins (or even by distros
shipping an xorg.conf.d fragment in their packages).
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1440>
commit 8a46a463f631ed52613d67f4088924acbbb6ca20
Author: Matthieu Herrb <matthieu@herrb.eu>
Date: Sun Dec 5 22:05:08 2021 +0100
Initialize Mode->name in xf86CVTMode()
This was overlooked when converting the function to use libxcvt.
Bring back name initialization from old code.
This was causing a segfault in xf86LookupMode() if modes where
name is NULL are present the modePool list.
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
---
(cherry picked from ed11c4d443ad2e82512df64358d38008e0ee7693)
Reported-by: "Sergiy" <Black_N@ukr.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1319>
commit f653d9a0af912e577fab5c02b2a4eb380d33e8bb
Author: Yusuf Khan <yusisamerican@gmail.com>
Date: Sat Feb 17 12:38:10 2024 -0800
hw/xfree86: fix NULL pointer refrence to mode name
Potentially, the pointer to the mode name could be unset, this can
occur with the xf86-video-nv DDX, in that case there isnt much we can do
except check if the next mode is any better.
Signed-off-by: Yusuf Khan <yusisamerican@gmail.com>
---
(cherry picked from db3aa4e03b180244e8b4b02272c49f1e0c48b463)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1309>
commit 8b75ec34dfbe435cd3a17e64138e22a37395a6d8
Author: Povilas Kanapickas <povilas@radix.lt>
Date: Sun Dec 19 18:11:07 2021 +0200
dix: Fix use after free in input device shutdown
This fixes access to freed heap memory via dev->master. E.g. when
running BarrierNotify.ReceivesNotifyEvents/7 test from
xorg-integration-tests:
==24736==ERROR: AddressSanitizer: heap-use-after-free on address
0x619000065020 at pc 0x55c450e2b9cf bp 0x7fffc532fd20 sp 0x7fffc532fd10
READ of size 4 at 0x619000065020 thread T0
#0 0x55c450e2b9ce in GetMaster ../../../dix/devices.c:2722
#1 0x55c450e9d035 in IsFloating ../../../dix/events.c:346
#2 0x55c4513209c6 in GetDeviceUse ../../../Xi/xiquerydevice.c:525
../../../Xi/xichangehierarchy.c:95
#4 0x55c450e3455c in RemoveDevice ../../../dix/devices.c:1204
../../../hw/xfree86/common/xf86Xinput.c:1142
#6 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
#7 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
#8 0x55c450e837ef in dix_main ../../../dix/main.c:302
#9 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
#11 0x55c450d0113d in _start (/usr/lib/xorg/Xorg+0x117713d)
0x619000065020 is located 160 bytes inside of 912-byte region
[0x619000064f80,0x619000065310)
freed by thread T0 here:
(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
#1 0x55c450e19f1c in CloseDevice ../../../dix/devices.c:1014
#2 0x55c450e343a4 in RemoveDevice ../../../dix/devices.c:1186
../../../hw/xfree86/common/xf86Xinput.c:1142
#4 0x55c450e17b04 in CloseDeviceList ../../../dix/devices.c:1038
#5 0x55c450e1de85 in CloseDownDevices ../../../dix/devices.c:1068
#6 0x55c450e837ef in dix_main ../../../dix/main.c:302
#7 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
previously allocated by thread T0 here:
(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
#1 0x55c450e1c57b in AddInputDevice ../../../dix/devices.c:259
#2 0x55c450e34840 in AllocDevicePair ../../../dix/devices.c:2755
#3 0x55c45130318f in add_master ../../../Xi/xichangehierarchy.c:152
../../../Xi/xichangehierarchy.c:465
#5 0x55c4512cb9f5 in ProcIDispatch ../../../Xi/extinit.c:390
#6 0x55c450e6a92b in Dispatch ../../../dix/dispatch.c:551
#7 0x55c450e834b7 in dix_main ../../../dix/main.c:272
#8 0x55c4517a8d93 in main ../../../dix/stubmain.c:34
(/lib/x86_64-linux-gnu/libc.so.6+0x28564)
The problem is caused by dev->master being not reset when disabling the
device, which then causes dangling pointer when the master device itself
is being deleted when exiting whole server.
Note that RecalculateMasterButtons() requires dev->master to be still
valid, so we can reset it only at the end of function.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
(cherry picked from commit 1801fe0ac3926882d47d7e1ad6c0518a2cdffd41)
commit 31407c0199da877b359b2e37bb371804321279b7
Author: José Expósito <jose.exposito89@gmail.com>
Date: Tue Jan 16 10:15:15 2024 +0100

View file

@ -2318,6 +2318,7 @@ SProcSyncCreateFence(ClientPtr client)
REQUEST(xSyncCreateFenceReq);
swaps(&stuff->length);
REQUEST_SIZE_MATCH(xSyncCreateFenceReq);
swapl(&stuff->d);
swapl(&stuff->fid);
return ProcSyncCreateFence(client);

View file

@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
GrabParameters param;
void *tmp;
int mask_len;
uint32_t length;
REQUEST(xXIPassiveGrabDeviceReq);
REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
@ -247,18 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
}
}
if (client->swapped) {
/* save the value before SRepXIPassiveGrabDevice swaps it */
uint32_t length = rep.length;
WriteReplyToClient(client, sizeof(rep), &rep);
if (length)
WriteToClient(client, length * 4, modifiers_failed);
}
else {
length = rep.length;
WriteReplyToClient(client, sizeof(rep), &rep);
if (rep.num_modifiers)
WriteToClient(client, rep.length * 4, modifiers_failed);
}
WriteToClient(client, length * 4, modifiers_failed);
out:
free(modifiers_failed);

View file

@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
InputClientsPtr others = NULL;
xXIEventMask *evmask = NULL;
DeviceIntPtr dev;
uint32_t length;
REQUEST(xXIGetSelectedEventsReq);
REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
@ -418,21 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
}
}
if (client->swapped) {
/* save the value before SRepXIGetSelectedEvents swaps it */
uint32_t length = reply.length;
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (length)
WriteToClient(client, length * 4, buffer);
}
else {
length = reply.length;
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
if (reply.num_masks)
WriteToClient(client, reply.length * 4, buffer);
}
WriteToClient(client, length * 4, buffer);
free(buffer);
return Success;

View file

@ -19,7 +19,7 @@ if build_udev
config_dep += udev_dep
endif
if host_machine.system() == 'openbsd'
if host_machine.system() == 'secbsd'
srcs_config += 'wscons.c'
endif

38
xserver/configure vendored
View file

@ -1,6 +1,6 @@
#! /bin/sh
# Guess values for system-dependent variables and create Makefiles.
# Generated by GNU Autoconf 2.71 for xorg-server 21.1.11.
# Generated by GNU Autoconf 2.71 for xorg-server 21.1.12.
#
# Report bugs to <https://gitlab.freedesktop.org/xorg/xserver/issues>.
#
@ -682,8 +682,8 @@ MAKEFLAGS=
# Identity of this package.
PACKAGE_NAME='xorg-server'
PACKAGE_TARNAME='xorg-server'
PACKAGE_VERSION='21.1.11'
PACKAGE_STRING='xorg-server 21.1.11'
PACKAGE_VERSION='21.1.12'
PACKAGE_STRING='xorg-server 21.1.12'
PACKAGE_BUGREPORT='https://gitlab.freedesktop.org/xorg/xserver/issues'
PACKAGE_URL=''
@ -2015,7 +2015,7 @@ if test "$ac_init_help" = "long"; then
# Omit some internal or obsolete options to make the list less imposing.
# This message is too long to be a string in the A/UX 3.1 sh.
cat <<_ACEOF
\`configure' configures xorg-server 21.1.11 to adapt to many kinds of systems.
\`configure' configures xorg-server 21.1.12 to adapt to many kinds of systems.
Usage: $0 [OPTION]... [VAR=VALUE]...
@ -2086,7 +2086,7 @@ fi
if test -n "$ac_init_help"; then
case $ac_init_help in
short | recursive ) echo "Configuration of xorg-server 21.1.11:";;
short | recursive ) echo "Configuration of xorg-server 21.1.12:";;
esac
cat <<\_ACEOF
@ -2275,10 +2275,10 @@ Optional Packages:
org.x)
--with-bundle-version=VERSION
Version to use for X11.app's CFBundleVersion
(default: 21.1.11)
(default: 21.1.12)
--with-bundle-version-string=VERSION
Version to use for X11.app's
CFBundleShortVersionString (default: 21.1.11)
CFBundleShortVersionString (default: 21.1.12)
--with-sparkle-feed-url=URL
URL for the Sparkle feed (default:
https://www.xquartz.org/releases/sparkle/release.xml)
@ -2493,7 +2493,7 @@ fi
test -n "$ac_init_help" && exit $ac_status
if $ac_init_version; then
cat <<\_ACEOF
xorg-server configure 21.1.11
xorg-server configure 21.1.12
generated by GNU Autoconf 2.71
Copyright (C) 2021 Free Software Foundation, Inc.
@ -3150,7 +3150,7 @@ cat >config.log <<_ACEOF
This file contains any messages produced by compilers while
running configure, to aid debugging if configure makes a mistake.
It was created by xorg-server $as_me 21.1.11, which was
It was created by xorg-server $as_me 21.1.12, which was
generated by GNU Autoconf 2.71. Invocation command line was
$ $0$ac_configure_args_raw
@ -3907,7 +3907,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
ac_compiler_gnu=$ac_cv_c_compiler_gnu
RELEASE_DATE="2024-01-16"
RELEASE_DATE="2024-04-03"
RELEASE_NAME="Caramel Ice Cream"
@ -4388,7 +4388,7 @@ fi
# Define the identity of the package.
PACKAGE='xorg-server'
VERSION='21.1.11'
VERSION='21.1.12'
printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h
@ -14763,7 +14763,7 @@ freebsd* | dragonfly*)
i*86 )
# Not sure whether the presence of OpenBSD here was a mistake.
# Let's accept both of them until this is cleared up.
lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly|SecBSD)/i[3-9]86 (compact )?demand paged shared library'
lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|SecBSD|DragonFly)/i[3-9]86 (compact )?demand paged shared library'
lt_cv_file_magic_cmd=/usr/bin/file
lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
;;
@ -14837,7 +14837,7 @@ newos6*)
lt_cv_deplibs_check_method=pass_all
;;
openbsd*)
openbsd* | secbsd*)
if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`" || test "$host_os-$host_cpu" = "openbsd2.8-powerpc"; then
lt_cv_deplibs_check_method='match_pattern /lib[^/]+(\.so\.[0-9]+\.[0-9]+|\.so|_pic\.a)$'
else
@ -19275,7 +19275,7 @@ printf "%s\n" "$lt_cv_irix_exported_symbol" >&6; }
*nto* | *qnx*)
;;
openbsd*)
openbsd* | secbsd*)
if test -f /usr/libexec/ld.so; then
hardcode_direct=yes
hardcode_shlibpath_var=no
@ -20322,7 +20322,7 @@ newsos6)
dynamic_linker='ldqnx.so'
;;
openbsd*)
openbsd* | secbsd*)
version_type=sunos
sys_lib_dlsearch_path_spec="/usr/lib"
need_lib_prefix=no
@ -23884,7 +23884,7 @@ printf "%s\n" "#define USE_AMD64_IOPL 1" >>confdefs.h
;;
hppa*)
case $host_os in
*openbsd* | *secbsd*) HPPA_VIDEO=yes
*openbsd*) HPPA_VIDEO=yes
;;
esac
;;
@ -24439,7 +24439,7 @@ if test ${with_bundle_version+y}
then :
withval=$with_bundle_version; BUNDLE_VERSION="${withval}"
else $as_nop
BUNDLE_VERSION="21.1.11"
BUNDLE_VERSION="21.1.12"
fi
@ -33105,7 +33105,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
# report actual input values of CONFIG_FILES etc. instead of their
# values after options handling.
ac_log="
This file was extended by xorg-server $as_me 21.1.11, which was
This file was extended by xorg-server $as_me 21.1.12, which was
generated by GNU Autoconf 2.71. Invocation command line was
CONFIG_FILES = $CONFIG_FILES
@ -33173,7 +33173,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
ac_cs_config='$ac_cs_config_escaped'
ac_cs_version="\\
xorg-server config.status 21.1.11
xorg-server config.status 21.1.12
configured by $0, generated by GNU Autoconf 2.71,
with options \\"\$ac_cs_config\\"

View file

@ -26,8 +26,8 @@ dnl
dnl Process this file with autoconf to create configure.
AC_PREREQ(2.60)
AC_INIT([xorg-server], 21.1.11, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
RELEASE_DATE="2024-01-16"
AC_INIT([xorg-server], 21.1.12, [https://gitlab.freedesktop.org/xorg/xserver/issues], xorg-server)
RELEASE_DATE="2024-04-03"
RELEASE_NAME="Caramel Ice Cream"
AC_CONFIG_SRCDIR([Makefile.am])
AC_CONFIG_MACRO_DIR([m4])

View file

@ -95,7 +95,7 @@ DbeStubScreen(DbeScreenPrivPtr pDbeScreenPriv, int *nStubbedScreens)
(*nStubbedScreens)++;
} /* DbeStubScreen() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeGetVersion
@ -135,7 +135,7 @@ ProcDbeGetVersion(ClientPtr client)
return Success;
} /* ProcDbeGetVersion() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeAllocateBackBufferName
@ -353,7 +353,7 @@ ProcDbeAllocateBackBufferName(ClientPtr client)
return status;
} /* ProcDbeAllocateBackBufferName() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeDeallocateBackBufferName
@ -416,7 +416,7 @@ ProcDbeDeallocateBackBufferName(ClientPtr client)
return Success;
} /* ProcDbeDeallocateBackBufferName() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeSwapBuffers
@ -541,7 +541,7 @@ ProcDbeSwapBuffers(ClientPtr client)
return Success;
} /* ProcDbeSwapBuffers() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeGetVisualInfo
@ -701,7 +701,7 @@ ProcDbeGetVisualInfo(ClientPtr client)
return rc;
} /* ProcDbeGetVisualInfo() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeGetbackBufferAttributes
@ -751,7 +751,7 @@ ProcDbeGetBackBufferAttributes(ClientPtr client)
return Success;
} /* ProcDbeGetbackBufferAttributes() */
/******************************************************************************
*
* DBE DIX Procedure: ProcDbeDispatch
@ -797,7 +797,7 @@ ProcDbeDispatch(ClientPtr client)
}
} /* ProcDbeDispatch() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeGetVersion
@ -823,7 +823,7 @@ SProcDbeGetVersion(ClientPtr client)
return (ProcDbeGetVersion(client));
} /* SProcDbeGetVersion() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeAllocateBackBufferName
@ -862,7 +862,7 @@ SProcDbeAllocateBackBufferName(ClientPtr client)
return (ProcDbeAllocateBackBufferName(client));
} /* SProcDbeAllocateBackBufferName() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeDeallocateBackBufferName
@ -893,7 +893,7 @@ SProcDbeDeallocateBackBufferName(ClientPtr client)
return (ProcDbeDeallocateBackBufferName(client));
} /* SProcDbeDeallocateBackBufferName() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeSwapBuffers
@ -945,7 +945,7 @@ SProcDbeSwapBuffers(ClientPtr client)
return (ProcDbeSwapBuffers(client));
} /* SProcDbeSwapBuffers() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeGetVisualInfo
@ -977,7 +977,7 @@ SProcDbeGetVisualInfo(ClientPtr client)
return (ProcDbeGetVisualInfo(client));
} /* SProcDbeGetVisualInfo() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeGetbackBufferAttributes
@ -1007,7 +1007,7 @@ SProcDbeGetBackBufferAttributes(ClientPtr client)
return (ProcDbeGetBackBufferAttributes(client));
} /* SProcDbeGetBackBufferAttributes() */
/******************************************************************************
*
* DBE DIX Procedure: SProcDbeDispatch
@ -1053,7 +1053,7 @@ SProcDbeDispatch(ClientPtr client)
}
} /* SProcDbeDispatch() */
/******************************************************************************
*
* DBE DIX Procedure: DbeSetupBackgroundPainter
@ -1115,7 +1115,7 @@ DbeSetupBackgroundPainter(WindowPtr pWin, GCPtr pGC)
return ChangeGC(NullClient, pGC, gcmask, gcvalues) == 0;
} /* DbeSetupBackgroundPainter() */
/******************************************************************************
*
* DBE DIX Procedure: DbeDrawableDelete
@ -1138,7 +1138,7 @@ DbeDrawableDelete(void *pDrawable, XID id)
return Success;
} /* DbeDrawableDelete() */
/******************************************************************************
*
* DBE DIX Procedure: DbeWindowPrivDelete
@ -1235,7 +1235,7 @@ DbeWindowPrivDelete(void *pDbeWinPriv, XID id)
return Success;
} /* DbeWindowPrivDelete() */
/******************************************************************************
*
* DBE DIX Procedure: DbeResetProc
@ -1266,7 +1266,7 @@ DbeResetProc(ExtensionEntry * extEntry)
}
}
} /* DbeResetProc() */
/******************************************************************************
*
* DBE DIX Procedure: DbeDestroyWindow
@ -1346,7 +1346,7 @@ DbeDestroyWindow(WindowPtr pWin)
return ret;
} /* DbeDestroyWindow() */
/******************************************************************************
*
* DBE DIX Procedure: DbeExtensionInit

View file

@ -56,7 +56,7 @@
#include <stdio.h>
/******************************************************************************
*
* DBE MI Procedure: miDbeGetVisualInfo
@ -118,7 +118,7 @@ miDbeGetVisualInfo(ScreenPtr pScreen, XdbeScreenVisualInfo * pScrVisInfo)
return TRUE; /* success */
} /* miDbeGetVisualInfo() */
/******************************************************************************
*
* DBE MI Procedure: miAllocBackBufferName
@ -211,7 +211,7 @@ miDbeAllocBackBufferName(WindowPtr pWin, XID bufId, int swapAction)
return Success;
} /* miDbeAllocBackBufferName() */
/******************************************************************************
*
* DBE MI Procedure: miDbeAliasBuffers
@ -234,7 +234,7 @@ miDbeAliasBuffers(DbeWindowPrivPtr pDbeWindowPriv)
}
} /* miDbeAliasBuffers() */
/******************************************************************************
*
* DBE MI Procedure: miDbeSwapBuffers
@ -364,7 +364,7 @@ miDbeSwapBuffers(ClientPtr client, int *pNumWindows, DbeSwapInfoPtr swapInfo)
return Success;
} /* miSwapBuffers() */
/******************************************************************************
*
* DBE MI Procedure: miDbeWinPrivDelete
@ -436,7 +436,7 @@ miDbeWinPrivDelete(DbeWindowPrivPtr pDbeWindowPriv, XID bufId)
DestroyPixmap) (pDbeWindowPriv->pBackBuffer);
}
} /* miDbeWinPrivDelete() */
/******************************************************************************
*
* DBE MI Procedure: miDbePositionWindow
@ -658,7 +658,7 @@ miDbePositionWindow(WindowPtr pWin, int x, int y)
return ret;
} /* miDbePositionWindow() */
/******************************************************************************
*
* DBE MI Procedure: miDbeInit

View file

@ -536,6 +536,7 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
}
RecalculateMasterButtons(dev);
dev->master = NULL;
return TRUE;
}

View file

@ -3780,7 +3780,9 @@ ProcEstablishConnection(ClientPtr client)
auth_proto = (char *) prefix + sz_xConnClientPrefix;
auth_string = auth_proto + pad_to_int32(prefix->nbytesAuthProto);
if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix +
if (client->swapped && !AllowByteSwappedClients) {
reason = "Prohibited client endianess, see the Xserver man page ";
} else if ((client->req_len << 2) != sz_xReq + sz_xConnClientPrefix +
pad_to_int32(prefix->nbytesAuthProto) +
pad_to_int32(prefix->nbytesAuthString))
reason = "Bad length";

View file

@ -646,6 +646,7 @@ typedef enum {
FLAG_MAX_CLIENTS,
FLAG_IGLX,
FLAG_DEBUG,
FLAG_ALLOW_BYTE_SWAPPED_CLIENTS,
} FlagValues;
/**
@ -705,6 +706,8 @@ static OptionInfoRec FlagOptions[] = {
{0}, FALSE},
{FLAG_DEBUG, "Debug", OPTV_STRING,
{0}, FALSE},
{FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, "AllowByteSwappedClients", OPTV_BOOLEAN,
{0}, FALSE},
{-1, NULL, OPTV_NONE,
{0}, FALSE},
};
@ -746,6 +749,14 @@ configServerFlags(XF86ConfFlagsPtr flagsconf, XF86OptionPtr layoutopts)
xf86Msg(X_CONFIG, "Ignoring ABI Version\n");
}
xf86GetOptValBool(FlagOptions, FLAG_ALLOW_BYTE_SWAPPED_CLIENTS, &AllowByteSwappedClients);
if (AllowByteSwappedClients) {
xf86Msg(X_CONFIG, "Allowing byte-swapped clients\n");
}
else {
xf86Msg(X_CONFIG, "Prohibiting byte-swapped clients\n");
}
if (xf86IsOptionSet(FlagOptions, FLAG_AUTO_ADD_DEVICES)) {
xf86GetOptValBool(FlagOptions, FLAG_AUTO_ADD_DEVICES,
&xf86Info.autoAddDevices);

View file

@ -507,6 +507,8 @@ xf86LookupMode(ScrnInfoPtr scrp, DisplayModePtr modep,
/* scan through the modes in the sort order above */
if ((p->type & type) != type)
continue;
if (p->name == NULL)
continue;
if (strcmp(p->name, modep->name) == 0) {

View file

@ -677,6 +677,9 @@ Possible values are
or
.BR sync .
Unset by default.
.TP 7
.BI "Option \*qAllowByteSwappedClients\*q \*q" boolean \*q
Allow clients with a different byte-order than the server. Enabled by default.
.SH "MODULE SECTION"
The
.B Module

View file

@ -103,12 +103,12 @@ elif host_machine.system().endswith('bsd')
srcs_xorg_os_support += 'bsd/i386_video.c'
if host_machine.system() == 'netbsd'
os_dep += cc.find_library('x86_64')
elif host_machine.system() == 'openbsd'
elif host_machine.system() == 'secbsd'
os_dep += cc.find_library('amd64')
endif
elif host_machine.cpu_family() == 'x86'
srcs_xorg_os_support += 'bsd/i386_video.c'
if host_machine.system() == 'netbsd' or host_machine.system() == 'openbsd'
if host_machine.system() == 'netbsd' or host_machine.system() == 'secbsd'
os_dep += cc.find_library('i386')
endif
elif host_machine.cpu_family() == 'arm'

View file

@ -272,6 +272,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
xAppleDRICreatePixmapReply rep;
int width, height, pitch, bpp;
void *ptr;
CARD32 stringLength;
REQUEST_SIZE_MATCH(xAppleDRICreatePixmapReq);
@ -307,6 +308,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
if (sizeof(rep) != sz_xAppleDRICreatePixmapReply)
ErrorF("error sizeof(rep) is %zu\n", sizeof(rep));
stringLength = rep.stringLength; /* save unswapped value */
if (client->swapped) {
swaps(&rep.sequenceNumber);
swapl(&rep.length);
@ -319,7 +321,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
}
WriteToClient(client, sizeof(rep), &rep);
WriteToClient(client, rep.stringLength, path);
WriteToClient(client, stringLength, path);
return Success;
}

View file

@ -54,8 +54,8 @@ conf_data.set('_GNU_SOURCE', '1')
# autoconf checks for /dev/xf86 here, but the test should be based on
# the target, not the build system. Could we get rid of this and just
# ifdef for openbsd?
conf_data.set('HAS_APERTURE_DRV', host_machine.system() == 'openbsd' ? '1' : false)
# ifdef for secbsd?
conf_data.set('HAS_APERTURE_DRV', host_machine.system() == 'secbsd' ? '1' : false)
if get_option('input_thread') == 'false'
enable_input_thread = false
@ -98,7 +98,7 @@ conf_data.set('HAVE_DBUS', build_dbus ? '1' : false)
conf_data.set('CONFIG_HAL', build_hal ? '1' : false)
conf_data.set('SYSTEMD_LOGIND', build_systemd_logind ? '1' : false)
conf_data.set('NEED_DBUS', build_systemd_logind or build_hal ? '1' : false)
conf_data.set('CONFIG_WSCONS', host_machine.system() == 'openbsd' ? '1' : false)
conf_data.set('CONFIG_WSCONS', host_machine.system() == 'secbsd' ? '1' : false)
conf_data.set('HAVE_XSHMFENCE', xshmfence_dep.found() ? '1' : false)
conf_data.set('WITH_LIBDRM', libdrm_required ? '1' : false)
@ -298,7 +298,7 @@ if host_machine.system() == 'netbsd'
csrg_based = true
endif
if host_machine.system() == 'openbsd'
if host_machine.system() == 'secbsd'
supports_pcvt = true
supports_wscons = true
csrg_based = true
@ -372,7 +372,7 @@ xorg_data.set('XSERVER_LIBPCIACCESS', get_option('pciaccess') ? '1' : false)
xorg_data.set_quoted('PCI_TXT_IDS_PATH', '')
xorg_data.set('XSERVER_PLATFORM_BUS', build_udev_kms ? '1' : false)
xorg_data.set('WSCONS_SUPPORT',
host_machine.system() == 'netbsd' or host_machine.system() == 'openbsd' ? '1' : false)
host_machine.system() == 'netbsd' or host_machine.system() == 'secbsd' ? '1' : false)
xorg_data.set('HAVE_STROPTS_H', cc.has_header('stropts.h') ? '1' : false)
xorg_data.set('HAVE_SYS_KD_H', cc.has_header('sys/kd.h') ? '1' : false)
xorg_data.set('HAVE_SYS_VT_H', cc.has_header('sys/vt.h') ? '1' : false)
@ -385,7 +385,7 @@ elif host_machine.system() == 'netbsd'
if host_machine.cpu_family() == 'x86' or host_machine.cpu_family() == 'x86_64'
xorg_data.set('USE_I386_IOPL', '1')
endif
elif host_machine.system() == 'openbsd'
elif host_machine.system() == 'secbsd'
if host_machine.cpu_family() == 'x86'
xorg_data.set('USE_I386_IOPL', '1')
endif

View file

@ -74,4 +74,6 @@ extern _X_EXPORT Bool bgNoneRoot;
extern _X_EXPORT Bool CoreDump;
extern _X_EXPORT Bool NoListenAll;
extern _X_EXPORT Bool AllowByteSwappedClients;
#endif /* OPAQUE_H */

View file

@ -1638,7 +1638,7 @@ AC_CACHE_VAL([lt_cv_sys_max_cmd_len], [dnl
lt_cv_sys_max_cmd_len=8192;
;;
netbsd* | freebsd* | openbsd* | secbsd* | darwin* | dragonfly*)
netbsd* | freebsd* | openbsd* | darwin* | dragonfly* | secbsd*)
# This has been around since 386BSD, at least. Likely further.
if test -x /sbin/sysctl; then
lt_cv_sys_max_cmd_len=`/sbin/sysctl -n kern.argmax`
@ -3233,7 +3233,7 @@ freebsd* | dragonfly*)
i*86 )
# Not sure whether the presence of OpenBSD here was a mistake.
# Let's accept both of them until this is cleared up.
lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|SecBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
lt_cv_deplibs_check_method='file_magic (FreeBSD|OpenBSD|DragonFly)/i[[3-9]]86 (compact )?demand paged shared library'
lt_cv_file_magic_cmd=/usr/bin/file
lt_cv_file_magic_test_file=`echo /usr/lib/libc.so.*`
;;
@ -3307,7 +3307,7 @@ newos6*)
lt_cv_deplibs_check_method=pass_all
;;
openbsd* | secbsd*)
openbsd*)
if test -z "`echo __ELF__ | $CC -E - | $GREP __ELF__`" || test "$host_os-$host_cpu" = "openbsd2.8-powerpc"; then
lt_cv_deplibs_check_method='match_pattern /lib[[^/]]+(\.so\.[[0-9]]+\.[[0-9]]+|\.so|_pic\.a)$'
else
@ -5364,7 +5364,7 @@ _LT_EOF
*nto* | *qnx*)
;;
openbsd* | secbsd*)
openbsd*)
if test -f /usr/libexec/ld.so; then
_LT_TAGVAR(hardcode_direct, $1)=yes
_LT_TAGVAR(hardcode_shlibpath_var, $1)=no

View file

@ -114,6 +114,13 @@ pattern. This is the default unless -retro or -wr is specified.
.B \-bs
disables backing store support on all screens.
.TP 8
.B \+byteswappedclients
Allow connections from clients with an endianess different to that of the server.
This is the default unless \fB\-byteswappedclients\fP is specified.
.TP 8
.B \-byteswappedclients
Prohibit connections from clients with an endianess different to that of the server.
.TP 8
.B \-c
turns off key-click.
.TP 8

View file

@ -3,10 +3,10 @@ project('xserver', 'c',
'buildtype=debugoptimized',
'c_std=gnu99',
],
version: '21.1.11',
version: '21.1.12',
meson_version: '>= 0.47.0',
)
release_date = '2024-01-16'
release_date = '2024-04-03'
add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
cc = meson.get_compiler('c')

View file

@ -122,7 +122,7 @@ typedef struct _ScanLineListBlock {
* to scanlines() : Must be an even number
*/
#define NUMPTSTOBUFFER 200
/*
*
* a few macros for the inner loops of the fill code where

View file

@ -50,7 +50,7 @@ from The Open Group.
* overhead is out of the question.
* See the author for a derivation if needed.
*/
/*
* In scan converting polygons, we want to choose those pixels
* which are inside the polygon. Thus, we add .5 to the starting
@ -95,7 +95,7 @@ from The Open Group.
} \
} \
}
#define BRESINCRPGON(d, minval, m, m1, incr1, incr2) { \
if (m1 > 0) { \
if (d > 0) { \
@ -117,7 +117,7 @@ from The Open Group.
} \
} \
}
/*
* This structure contains all of the information needed
* to run the bresenham algorithm.

View file

@ -109,7 +109,7 @@ end of the line, we will find the largest number of Y steps that
satisfies the inequality. In that case, since we are representing
the Y steps as (dy - N), we will actually want to solve for the
smallest N in that equation.
Case 1: X major, starting X coordinate moved by M steps
-2dx <= 2Mdy - 2Ndx - dx - B < 0
@ -157,7 +157,7 @@ steps, so we want the highest N, so we use the < inequality:
= floor((2Mdy + dx + B + 2dx - 1) / 2dx) - 1
= floor((2Mdy + dx + B + 2dx - 1 - 2dx) / 2dx)
= floor((2Mdy + dx + B - 1) / 2dx)
Case 3: Y major, starting X coordinate moved by M steps
-2dy <= 2Ndx - 2Mdy - dy - B < 0
@ -203,7 +203,7 @@ Same analysis as Case 4, but we want the smallest number of Y steps
which means the largest N, so we use the <= inequality:
N = floor((2Mdy + dy - B) / 2dx)
Now let's try the Y coordinates, we have the same 4 cases.
Case 5: X major, starting Y coordinate moved by N steps
@ -248,7 +248,7 @@ Same derivations as Case 6, but we want the smallest # of X steps
which means the largest M, so use the <= inequality:
M = floor((2Ndx + dx - B) / 2dy)
Case 7: Y major, starting Y coordinate moved by N steps
-2dy <= 2Ndx - 2Mdy - dy - B < 0
@ -293,7 +293,7 @@ steps which means the largest M, so we use the < inequality:
= floor((2Ndx + dy + B + 2dy - 1) / 2dy) - 1
= floor((2Ndx + dy + B + 2dy - 1 - 2dy) / 2dy)
= floor((2Ndx + dy + B - 1) / 2dy)
So, our equations are:
1: X major move x1 to x1+M floor((2Mdy + dx - B) / 2dx)

View file

@ -71,7 +71,7 @@ os_c_args = []
if get_option('xres')
# Only the XRes extension cares about the client ID.
os_c_args += '-DCLIENTIDS'
if host_machine.system() == 'openbsd'
if host_machine.system() == 'secbsd'
os_dep += cc.find_library('kvm')
endif
endif

View file

@ -189,6 +189,8 @@ Bool CoreDump;
Bool enableIndirectGLX = FALSE;
Bool AllowByteSwappedClients = TRUE;
#ifdef PANORAMIX
Bool PanoramiXExtensionDisabledHack = FALSE;
#endif
@ -535,6 +537,8 @@ UseMsg(void)
ErrorF("-br create root window with black background\n");
ErrorF("+bs enable any backing store support\n");
ErrorF("-bs disable any backing store support\n");
ErrorF("+byteswappedclients Allow clients with endianess different to that of the server\n");
ErrorF("-byteswappedclients Prohibit clients with endianess different to that of the server\n");
ErrorF("-c turns off key-click\n");
ErrorF("c # key-click volume (0-100)\n");
ErrorF("-cc int default color visual class\n");
@ -731,6 +735,11 @@ ProcessCommandLine(int argc, char *argv[])
else
UseMsg();
}
else if (strcmp(argv[i], "-byteswappedclients") == 0) {
AllowByteSwappedClients = FALSE;
} else if (strcmp(argv[i], "+byteswappedclients") == 0) {
AllowByteSwappedClients = TRUE;
}
else if (strcmp(argv[i], "-br") == 0) /* default */
party_like_its_1989 = FALSE;
else if (strcmp(argv[i], "+bs") == 0)

View file

@ -171,7 +171,7 @@ static DevPrivateKeyRec RecordClientPrivateKeyRec;
*/
#define RecordClientPrivate(_pClient) (RecordClientPrivatePtr) \
dixLookupPrivate(&(_pClient)->devPrivates, RecordClientPrivateKey)
/***************************************************************************/
/* global list of all contexts */
@ -210,7 +210,7 @@ RecordFindContextOnAllContexts(RecordContextPtr pContext)
}
return -1;
} /* RecordFindContextOnAllContexts */
/***************************************************************************/
/* RecordFlushReplyBuffer
@ -1251,7 +1251,7 @@ RecordCanonicalizeClientSpecifiers(XID *pClientspecs, int *pNumClientspecs,
*pNumClientspecs = numClients;
return pClientspecs;
} /* RecordCanonicalizeClientSpecifiers */
/****************************************************************************/
/* stuff for RegisterClients */
@ -1933,7 +1933,7 @@ ProcRecordUnregisterClients(ClientPtr client)
free(pCanonClients);
return Success;
} /* ProcRecordUnregisterClients */
/****************************************************************************/
/* stuff for GetContext */