XLibre/xserver
1
1
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-03-24 12:25:07 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
42a1f25faff612641dffb95a77f9ec3661111875
xserver/Xi
History
Olivier Fourdan bba9df1a9d Xi: Fix barrier device search 
The function GetBarrierDevice() would search for the pointer device
based on its device id and return the matching value, or supposedly NULL
if no match was found.

Unfortunately, as written, it would return the last element of the list
if no matching device id was found which can lead to out of bounds
memory access.

Fix the search function to return NULL if not matching device is found,
and adjust the callers to handle the case where the device cannot be
found.

CVE-2025-26598, ZDI-CAN-25740

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
2025-02-25 11:43:01 +01:00
..
allowev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
allowev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
chgdctl.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
chgdctl.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
chgfctl.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
chgfctl.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
chgkbd.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
chgkbd.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
chgkmap.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
chgkmap.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
chgprop.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
chgprop.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
chgptr.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
chgptr.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
closedev.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
closedev.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
devbell.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
devbell.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
exevents.c
os: move BUG_*() macros to own private header
2025-02-17 19:32:48 +00:00
exglobals.h
xinput: Remove PropagateMask
2020-03-30 21:48:11 +00:00
extinit.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getbmap.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getbmap.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getdctl.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
getdctl.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
getfctl.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getfctl.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getfocus.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getfocus.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getkmap.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getkmap.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getmmap.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getmmap.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
getprop.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
getprop.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
getselev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
getselev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
getvers.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
getvers.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
grabdev.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
grabdev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
grabdevb.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
grabdevb.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
grabdevk.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
grabdevk.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
gtmotion.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
gtmotion.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
listdev.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
listdev.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
meson.build
Add a Meson build system alongside autotools.
2017-04-26 15:25:27 -07:00
opendev.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
opendev.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
queryst.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
queryst.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
selectev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
selectev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
sendexev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
sendexev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
setbmap.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setbmap.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setdval.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setdval.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setfocus.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
setfocus.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
setmmap.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setmmap.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setmode.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
setmode.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
stubs.c
drop obsolete HAVE_DIX_CONFIG_H
2024-10-10 13:38:31 +00:00
ungrdev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
ungrdev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
ungrdevb.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
ungrdevb.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
ungrdevk.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
ungrdevk.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xiallowev.c
misc.h: unexport compare_version()
2025-02-18 11:17:40 +00:00
xiallowev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xibarriers.c
Xi: Fix barrier device search
2025-02-25 11:43:01 +01:00
xibarriers.h
Xi: free barrier code at reset time
2013-05-07 09:41:19 +10:00
xichangecursor.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xichangecursor.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xichangehierarchy.c
drop not needed includes of geext.h
2025-02-24 20:19:55 +00:00
xichangehierarchy.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
xigetclientpointer.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xigetclientpointer.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xigrabdev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xigrabdev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xipassivegrab.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xipassivegrab.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xiproperty.c
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
xiproperty.h
Xi: drop now obsolete swap procs
2025-02-06 22:28:52 +00:00
xiquerydevice.c
misc.h: unexport compare_version()
2025-02-18 11:17:40 +00:00
xiquerydevice.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xiquerypointer.c
misc.h: unexport compare_version()
2025-02-18 11:17:40 +00:00
xiquerypointer.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xiqueryversion.c
misc.h: unexport compare_version()
2025-02-18 11:17:40 +00:00
xiqueryversion.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xiselectev.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xiselectev.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xisetclientpointer.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xisetclientpointer.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
xisetdevfocus.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xisetdevfocus.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00
XIstubs.h
include: unexport XIstubs.h
2024-09-01 22:21:12 +00:00
xiwarppointer.c
Xi: drop swapping request length fields
2025-02-06 22:28:51 +00:00
xiwarppointer.h
Introduce a consistent coding style
2012-03-21 13:54:42 -07:00