From c0146196405099058d40aa7dad555db60868200c Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sun, 7 Dec 2025 15:57:53 -0800 Subject: [PATCH] dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs() dixLookupResourceByType always overwrites the pointer passed in as the first arg, so we shouldn't use the union it's in after that to get the requested XID value to put in the errorValue. Closes: #1857 Fixes: 2d7eb4a19 ("Pre-validate ChangeGC XIDs.") Reported-by: Mouse Signed-off-by: Alan Coopersmith (cherry picked from commit ac42c39145849588544ad10812e5a8ae76bf1114) Part-of: --- dix/gc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/dix/gc.c b/dix/gc.c index 0e5de5bd4..148772872 100644 --- a/dix/gc.c +++ b/dix/gc.c @@ -441,6 +441,7 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32) vals[i].val = pC32[i]; for (i = 0; i < ARRAY_SIZE(xidfields); ++i) { int offset, rc; + XID id; if (!(mask & xidfields[i].mask)) continue; @@ -449,11 +450,13 @@ ChangeGCXIDs(ClientPtr client, GC * pGC, BITS32 mask, CARD32 *pC32) vals[offset].ptr = NullPixmap; continue; } - rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val, + /* save the id, since dixLookupResourceByType overwrites &vals[offset] */ + id = vals[offset].val; + rc = dixLookupResourceByType(&vals[offset].ptr, id, xidfields[i].type, client, xidfields[i].access_mode); if (rc != Success) { - client->errorValue = vals[offset].val; + client->errorValue = id; return rc; } }