fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-02-15 08:00:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

sync: Do not fail SyncAddTriggerToSyncObject()

Browse source 
We do not want to return a failure at the very last step in
SyncInitTrigger() after having all changes applied.

SyncAddTriggerToSyncObject() must not fail on memory allocation, if the
allocation of the SyncTriggerList fails, trigger a FatalError() instead.

Related to CVE-2025-26601, ZDI-CAN-25870

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
(cherry picked from commit 8cbc90c881)
This commit is contained in:
Olivier Fourdan 2025-01-20 17:06:07 +01:00 • committed by Alan Coopersmith
parent 0930107038
commit 754d2ad3ea
1 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
Xext/sync.c
View file

@ -202,8 +202,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger)
return Success;
}
if (!(pCur = malloc(sizeof(SyncTriggerList))))
return BadAlloc;
/* Failure is not an option, it's succeed or burst! */
pCur = XNFalloc(sizeof(SyncTriggerList));
pCur->pTrigger = pTrigger;
pCur->next = pTrigger->pSync->pTriglist;
@ -411,8 +411,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
* a new counter on a trigger
*/
if (newSyncObject) {
if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)
return rc;
SyncAddTriggerToSyncObject(pTrigger);
}
else if (pCounter && IsSystemCounter(pCounter)) {
SyncComputeBracketValues(pCounter);