XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-24 03:44:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "xfixes: use dixGetAtomID()"

Browse Source 
This reverts commit c32b5b4d5b.

The commit writes out of bounds with tchar[stuff->nbytes] write
since the string isn't null terminated.
This messed other data which makes requests fail and window managers/
desktop environments fail to start.

ProcXFixesSetCursorName also incorrectly uses dixGetAtomID
which doesn't create the atom if it doesn't exist, which it previously
did with MakeAtom(..., TRUE).

The new dixGet/AddAtom methods dont work without null-terminated strings
so the change has to be reverted instead.

Signed-off-by: dec05eba <dec05eba@protonmail.com>
This commit is contained in:
dec05eba
2025-07-23 15:30:30 +02:00
committed by Enrico Weigelt
parent 75a6b756f1
commit 0797119176
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
xfixes/cursor.c
View File

@@ -413,12 +413,12 @@ ProcXFixesSetCursorName(ClientPtr client)
char *tchar; char *tchar;
REQUEST(xXFixesSetCursorNameReq); REQUEST(xXFixesSetCursorNameReq);
Atom atom;
REQUEST_FIXED_SIZE(xXFixesSetCursorNameReq, stuff->nbytes); REQUEST_FIXED_SIZE(xXFixesSetCursorNameReq, stuff->nbytes);
VERIFY_CURSOR(pCursor, stuff->cursor, client, DixSetAttrAccess); VERIFY_CURSOR(pCursor, stuff->cursor, client, DixSetAttrAccess);
tchar = (char *) &stuff[1]; tchar = (char *) &stuff[1];
tchar[stuff->nbytes] = 0; atom = MakeAtom(tchar, stuff->nbytes, TRUE);
Atom atom = dixGetAtomID(tchar);
if (atom == BAD_RESOURCE) if (atom == BAD_RESOURCE)
return BadAlloc; return BadAlloc;
@@ -692,6 +692,7 @@ int
ProcXFixesChangeCursorByName(ClientPtr client) ProcXFixesChangeCursorByName(ClientPtr client)
{ {
CursorPtr pSource; CursorPtr pSource;
Atom name;
char *tchar; char *tchar;
REQUEST(xXFixesChangeCursorByNameReq); REQUEST(xXFixesChangeCursorByNameReq);
@@ -700,8 +701,7 @@ ProcXFixesChangeCursorByName(ClientPtr client)
VERIFY_CURSOR(pSource, stuff->source, client, VERIFY_CURSOR(pSource, stuff->source, client,
DixReadAccess | DixGetAttrAccess); DixReadAccess | DixGetAttrAccess);
tchar = (char *) &stuff[1]; tchar = (char *) &stuff[1];
tchar[stuff->nbytes] = 0; name = MakeAtom(tchar, stuff->nbytes, FALSE);
Atom name = dixGetAtomID(tchar);
if (name) if (name)
ReplaceCursor(pSource, TestForCursorName, &name); ReplaceCursor(pSource, TestForCursorName, &name);
return Success; return Success;