From 7f1050de78239daa643483f719ba9cecdf427265 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sun, 7 Dec 2025 15:57:53 -0800 Subject: [PATCH] dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs() dixLookupResourceByType always overwrites the pointer passed in as the first arg, so we shouldn't use the union it's in after that to get the requested XID value to put in the errorValue. Closes: #1857 Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.") Reported-by: Mouse Signed-off-by: Alan Coopersmith Part-of: (cherry picked from commit ac42c39145849588544ad10812e5a8ae76bf1114) --- dix/gc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dix/gc.c b/dix/gc.c index 28fee5191..8b808ac47 100644 --- a/dix/gc.c +++ b/dix/gc.c @@ -444,6 +444,7 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32) vals[i].val = pC32[i]; for (i = 0; i < ARRAY_SIZE(xidfields); ++i) { int offset, rc; + XID id; if (!(mask & xidfields[i].mask)) continue; @@ -452,11 +453,13 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32) vals[offset].ptr = NullPixmap; continue; } - rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val, + /* save the id, since dixLookupResourceByType overwrites &vals[offset] */ + id = vals[offset].val; + rc = dixLookupResourceByType(&vals[offset].ptr, id, xidfields[i].type, client, xidfields[i].access_mode); if (rc != Success) { - client->errorValue = vals[offset].val; + client->errorValue = id; return rc; } }