These defines are already public, used by consumers of SetNotifyFd(),
but also needed in places where os.h cannot be included.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
usage:
__size_assert(typename, size);
if the type's size (calculated by sizeof) doesn't match the asserted size,
an illegal dummy type will be constructed, thus compilation fails.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The size of `int` is machine specific and may be 64 bits wide, which could
overflow the calloc'able size. Practically cannot happen here, since the
ListenTransCount can't go above MAX_CONNECTIONS, but compiler can't know
that and so spitting out a warning.
Using uint32_t really is sufficient here.
> ../os/connection.c: In function ‘CreateWellKnownSockets’:
> ../os/connection.c:274:22: warning: argument 1 range [18446744071562067968, 18446744073709551615] exceeds maximum object size 9223372036854775807 [-Walloc-size-larger-than=]
> 274 | ListenTransFds = calloc(ListenTransCount, sizeof(int));
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Since TRANS() now will always expand the same, it's better for
maintenance, having the function names written explicitly.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
These are always enablde (x11_t is defined when XSERV_t is defined),
so no need for the #ifdef's anymore.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This symbol is always defined, and the header is always present,
so no need to check for it.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Needed by the int10 module, so has to be in the symbol table.
But still not supposed to be used by out-of-tree drivers.
Reported-by: stefan11111 <stefan11111@shitposting.expert>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Needed by the int10 module, so has to be in the symbol table.
But still not supposed to be used by out-of-tree drivers.
Reported-by: stefan11111 <stefan11111@shitposting.expert>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
When reading requests from the clients, the input buffer might be shared
and used between different clients.
If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.
To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.
CVE-2025-49178
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
The BigRequest extension allows requests larger than the 16-bit length
limit.
It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.
In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.
To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.
The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.
To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.
CVE-2025-49176
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
This loads the configuration (simple text file) passed via command line.
For now just supporting static configuration, that's loaded on server
startup.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
