From ac42c39145849588544ad10812e5a8ae76bf1114 Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sun, 7 Dec 2025 15:57:53 -0800 Subject: [PATCH] dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs() dixLookupResourceByType always overwrites the pointer passed in as the first arg, so we shouldn't use the union it's in after that to get the requested XID value to put in the errorValue. Closes: #1857 Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.") Reported-by: Mouse Signed-off-by: Alan Coopersmith Part-of: --- dix/gc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dix/gc.c b/dix/gc.c index 5f7535803..a332e57c4 100644 --- a/dix/gc.c +++ b/dix/gc.c @@ -442,6 +442,7 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32) vals[i].val = pC32[i]; for (i = 0; i < ARRAY_SIZE(xidfields); ++i) { int offset, rc; + XID id; if (!(mask & xidfields[i].mask)) continue; @@ -450,11 +451,13 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32) vals[offset].ptr = NullPixmap; continue; } - rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val, + /* save the id, since dixLookupResourceByType overwrites &vals[offset] */ + id = vals[offset].val; + rc = dixLookupResourceByType(&vals[offset].ptr, id, xidfields[i].type, client, xidfields[i].access_mode); if (rc != Success) { - client->errorValue = vals[offset].val; + client->errorValue = id; return rc; } }