The client index (in the client table) can never be negative, thus
make it an unsigned short.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Reduce complexity for things that really don't matter much:
The ddxBeforeReset() function is called when the Xserver going to reset
(new server generation). Right now, the only DDX really needing that is
Xwin, on all the others it's just no-op.
We've got an extra complicated build logic, which ifdef's out this all when
Xwin isn't built at all. The saving is extremely minimal - just skipping
few stub functions, which in most sessions aren't even called.
Therefore, get rid of this extra complexity that isn't giving us any
notable gain.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
mingw's printf() doesn't understand it yet, and it's not really
important here, so just use `%hx` instead.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The X protocol types from xorgproto all have corresponding sz_<typename>
defines with their actual network payload size (this can be checked via
SIZEOF() macro).
In theory, this should always be the same as sizeof(), but just to be sure,
adding a macro for a static assert on that.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The swapping is so trivial, we don't need several extra functions
for that - just do it right where the header fields are swapped.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Instead of always zero'ing out the whole buffer at allocation time, only
do it where really necessary. Also adding x_rpcbuf_reserve0() for reserving
buffer space that's explicitly cleared.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Both are the same types, the `struct x_rpcbuf` still remains, but it
seems more clear to use the `x_rpcbuf_t` as the canonical name.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This header needs to be included in all sources at the very top anyways,
so no need to do it in other headers, too.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Convenient helper function for creating atom and get it's ID.
If atom already exist, the existing ID is retrieved.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Helper function for retrieving _existing_ atom ID for given name.
If atom doesn't exist yet, it won't be created, but returning None instead.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
add x_rpcbuf_wsize_units() to retrieve the amount of data written into
the buffer - in 4-byte units.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Adding convenience function for writing out rpc buffer contents to
client and clear the buffer (free it's memory) afterwards.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The existing x_rpcbuf_write_string() function is just writing the string w/o
trailing zero. It's for cases where the string length is known by other means
(eg. some header field). In cases where we also need the trailing zero written
(eg. when sending lists of strings) this isn't sufficient.
Thus introducing another variant of this function, which is always writing
a leading zero. Using this one, the string's characters will be followed
by 1, 2 or 3 zeros (and also be 32bit aligned)
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
when the err_clear flag is set, the buffer memory will automatically
be free()ed when allocation failed. This allows simplificatoin of
caller's error pathes: the caller doesn't need to to call x_rpcbuf_clear()
anymore and eg. can directly return out.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Remember allocation failure in new `error` field, for easing error
handling in complex callers: those now don't need to check each single
return value, but can (try to) continue their normal operation and
check for error condition later.
For example we can turn this:
for (....) {
if (!x_rpcbuf_write_CARD16(&rpcbuf,...)) {
[ various cleanups ]
return BadAlloc;
}
if (!rpcbuf_write_CARD8s(&rpcbuf,...)) {
[ various cleanups ]
return BadAlloc;
}
[ more of this ]
}
...
Into:
for (....) {
x_rpcbuf_write_CARD16(&rpcbuf,...));
x_rpcbuf_write_CARD8s(&rpcbuf,...));
[ more of this ]
}
...
if (&rpcbuf->error) {
[ various cleanups ]
return BadAlloc;
}
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Since so many request handlers have to assemble complex reply payloads,
we've got a lot complexity on counting the needed space and filling in
the data into the right places.
Thus adding a little dynamic buffer structure, where one just can append
data arbitrarily. The buffer will automatically allocate memory as-needed
and finally leave everything in a big memory block for later write-out.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
function prototypes are by default always extern, so no need for
that extra qualifier.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
If ApplyPointerMapping() returns `MappingBusy`, this value needs to be
returned in the `success` reply field. On `Success` the returned value
needs to be `MappingSuccess`.
Closes: https://github.com/X11Libre/xserver/issues/353
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
In contrast to the already existing ScreenClose hook, this one is
called *after* the driver's CloseScreen() proc. That's required for
some extensions (eg. damage) where drivers still need to call in
inside of their CloseScreen procs.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
The BigRequest extension allows requests larger than the 16-bit length
limit.
It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.
In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.
To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.
The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.
To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.
CVE-2025-49176
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
This callback only had been added for Xwayland, which is gone now,
so we don't need it anymore. For property filtering (eg. security
extensions), we have PropertyFilterCallback.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
It always had it's own lifecycle (not been part of Xorg releases),
doesn't make sense to maintain a competing implementation that we
won't use anyways.
Once that's gone, we can also drop few things in core/dix that had
been added just for xwayland only.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
in struct _Screen (include/scrnintstr.h) there is a PRIVATE_LAST-sized array,
having another private increases PRIVATE_LAST, the array increases in size,
moving everything below it down. this breaks ABI for nvidia driver
Signed-off-by: dasha_uwu <dasha@linuxping.win>
