XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-04-14 17:18:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs()

Browse Source 
dixLookupResourceByType always overwrites the pointer passed in as the
first arg, so we shouldn't use the union it's in after that to get the
requested XID value to put in the errorValue.

Closes: #1857
Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.")
Reported-by: Mouse <mouse@Rodents-Montreal.ORG>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2111>
(cherry picked from commit ac42c39145)
This commit is contained in:
Alan Coopersmith
2025-12-07 15:57:53 -08:00
parent ddadb162f2
commit 7f1050de78
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dix/gc.c
View File

@@ -444,6 +444,7 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32)
vals[i].val = pC32[i];
for (i = 0; i < ARRAY_SIZE(xidfields); ++i) {
int offset, rc;
XID id;
if (!(mask & xidfields[i].mask))
continue;
@@ -452,11 +453,13 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32)
vals[offset].ptr = NullPixmap;
continue;
}
rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val,
/* save the id, since dixLookupResourceByType overwrites &vals[offset] */
id = vals[offset].val;
rc = dixLookupResourceByType(&vals[offset].ptr, id,
xidfields[i].type, client,
xidfields[i].access_mode);
if (rc != Success) {
client->errorValue = vals[offset].val;
client->errorValue = id;
return rc;
}
}