Peter Hutterer b0a09ba602 dix: keep a ref to the rootCursor ...

CreateCursor returns a cursor with refcount 1 - that refcount is used by
the resource system, any caller needs to call RefCursor to get their own
reference. That happens correctly for normal cursors but for our
rootCursor we keep a variable to the cursor despite not having a ref for
ourselves.

Fix this by reffing/unreffing the rootCursor to ensure our pointer is
valid.

Related to CVE-2025-26594, ZDI-CAN-25544

Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>

2025-02-25 11:43:01 +01:00

..

.gitignore

…

atom.c

dix: unexport MakePredeclaredAtoms()

2025-02-17 18:13:33 +00:00

BuiltInAtoms

…

callback_priv.h

dix: fix duplicate typedef of CallbackListPtr

2024-09-01 22:32:49 +00:00

closestr.h

dix: move closestr.h into dix directory

2024-04-16 01:42:39 +00:00

color.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

colormap_priv.h

dix: move colormap flags into colormap_priv.h and rename them

2024-09-01 22:06:50 +00:00

colormap.c

rename old symbol PANORAMIX to XINERAMA

2025-02-06 15:51:27 +00:00

cursor_priv.h

dix: unexport GetSpritePosition()

2024-09-02 16:43:29 +00:00

cursor.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

devices.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

dispatch.c

Cursor: Refuse to free the root cursor

2025-02-25 11:43:01 +01:00

dispatch.h

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

display.c

dix: add getter for display name

2025-02-11 19:13:01 +01:00

dix_priv.h

drop not needed includes of geext.h

2025-02-24 20:19:55 +00:00

dixfonts.c

os: log: replace VErrorF() by LogVMessageVerb()

2025-02-06 23:35:27 +00:00

dixgrabs_priv.h

dix: unexport non-public functions from dixgrabs.h and document prototypes

2024-10-10 13:50:57 +00:00

dixstruct_priv.h

include: move private defs to dixstruct_priv.h

2024-04-30 00:47:38 +00:00

dixutils.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

enterleave.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

enterleave.h

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

eventconvert.c

dix: limit checks to MAX_VALUATORS when generating Xi events

2024-10-28 05:38:25 +00:00

eventconvert.h

dix: unexport eventconvert.h functions

2024-03-11 12:26:44 +01:00

events.c

drop not needed includes of geext.h

2025-02-24 20:19:55 +00:00

exevents_priv.h

include: move private definitions out of exevents.h

2024-04-30 00:47:38 +00:00

extension.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

gc_priv.h

dix: unexport SetClipRects()

2024-04-15 23:10:31 +00:00

gc.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00

generate-atoms

dix: unexport MakePredeclaredAtoms()

2025-02-17 18:13:33 +00:00

gestures.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

getevents.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

globals.c

dix: add getter for display name

2025-02-11 19:13:01 +01:00

glyphcurs.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00

grabs.c

dix: unexport non-public functions from dixgrabs.h and document prototypes

2024-10-10 13:50:57 +00:00

input_priv.h

include: move private definitions out of input.h

2024-09-01 17:59:23 +00:00

inpututils.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

main.c

dix: keep a ref to the rootCursor

2025-02-25 11:43:01 +01:00

meson.build

dix: add getter for display name

2025-02-11 19:13:01 +01:00

pixmap.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00

privates.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

property_priv.h

dix: unexport DeleteAllWindowProperties()

2024-09-02 17:50:47 +00:00

property.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

protocol.txt

drop remains of DMX

2024-03-05 16:57:52 +01:00

ptrveloc_priv.h

dix: fix duplicate typedef of MotionTracker and *MotionTrackerPtr

2024-09-01 22:32:49 +00:00

ptrveloc.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

region.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

registry_priv.h

dix: unexport XREGISTRY_UNKNOWN define

2024-03-03 23:20:06 +00:00

registry.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

resource.c

rename old symbol PANORAMIX to XINERAMA

2025-02-06 15:51:27 +00:00

screenint_priv.h

dix: fix duplicate typedef of *ScreenPtr

2024-09-01 22:32:49 +00:00

selection.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

stubmain.c

…

swaprep.c

dix: drop unnecessary check on HAVE_DIX_CONFIG_H

2024-10-10 13:38:31 +00:00

swapreq.c

misc.h: drop LengthRestB() macro

2025-02-17 19:25:14 +00:00

tables.c

dix: drop swapping request length fields

2025-02-06 22:28:51 +00:00

touch.c

os: move BUG_*() macros to own private header

2025-02-17 19:32:48 +00:00

window.c

dix: use dixDestroyPixmap() instead of direct driver call

2025-02-12 17:48:30 +01:00