When compiling with gcc 15.2.0 using -O3 -m64 on Solaris SPARC & x64,
we'd get a test failure of:
Assertion failed: strcmp(logmsg, expected) == 0,
file ../test/signal-logging.c, line 339, function logging_format
because 'num *= 1' produced a value that was out of the range of the
int64_t it was being stored in. (Compiling with -O2 worked fine with
the same compiler/configuration/platform though.)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2117>
(cherry picked from commit 7f68b58865)
In `Fopen` function variable `iop` may store NULL as a result of `fopen`
call. In this case, if later privileges couldn't be restored (`seteuid`
call fails), further `fclose(iop)` call will cause runtime error.
This commit adds check `iop` for NULL before calling `fclose` to prevent
potential NULL pointer dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2115>
(cherry picked from commit f83807647e)
The LogVHdrMessageVerb function may access an array out of bounds in a
specific edge case. Specifically, the line:
newline = (buf[len - 1] == '\n');
can result in accessing buf[-1] if len == 0, which is undefined behavior.
Commit adds check to avoid access out of bounds at pointed line.
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1841
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2061>
(cherry picked from commit 8d25a89143)
In most typical Linux X servers (like Xvfb, Xephyr, or Xwayland),
no child process outlives the server, so this issue rarely arises.
However, in embedded X servers (based on Xvfb or Kdrive) or in
custom Xorg modules, the server might launch a long-running command
with regular fork+exec calls. If the X server crashes or exits while
that command is still running (for example, it spawns a tombstone
generator or any process that hangs or turns to zombie), the file
descriptor associated with the abstract socket can remain open in the
child process. This leads to the kernel refusing to allow another X
server to bind the same socket until the child process terminates
(because there is no explicit way to unlink abstract socket, unlike
Unix socket). By marking the file descriptor as close-on-exec, we
ensure it is automatically closed in child processes, preserving the
ability of a new X server process to bind the socket immediately.
Signed-off-by: Twaik Yont <9674930+twaik@users.noreply.github.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1906>
(cherry picked from commit 5568b0f83f)
Check for another possible integer overflow once we get a complete xReq
with BigRequest.
Related to CVE-2025-49176
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
(cherry picked from commit 4fc4d76b2c)
When reading requests from the clients, the input buffer might be shared
and used between different clients.
If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.
To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.
CVE-2025-49178
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit d55c54cecb)
The BigRequest extension allows requests larger than the 16-bit length
limit.
It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.
In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.
To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.
The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.
To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.
CVE-2025-49176
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 03731b326a)
We stopped including this in error messages back in 2008
Clears warning from clang 19.1.7:
os/utils.c:1338:9: warning: macro is not used [-Wunused-macros]
1338 | #define BUGADDRESS BUILDERADDR
| ^
Fixes: ef77e4c44 ("Remove useless commentary from environment and argument processing.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit f988558348)
Several pieces of the code, as well as drivers are using %X, which
we don't support, so leading to error messages like this:
[2025-02-27 14:28:44] BUG: 'if (f[f_idx])'
[2025-02-27 14:28:44] BUG: ../xserver/os/log.c:538 in vpnprintf()
[2025-02-27 14:28:44] Unsupported printf directive 'X'
[2025-02-27 14:28:44]
[2025-02-27 14:28:44] Backtrace:
[2025-02-27 14:28:44] unw_get_proc_name failed: no unwind info found [-10]
[2025-02-27 14:28:44] 0: /usr/lib/Xorg (?+0x0) [0x5f4d1261bc47]
[2025-02-27 14:28:44] 1: /usr/lib/Xorg (LogVHdrMessageVerb+0x10f) [0x5f4d1261ca3f]
[2025-02-27 14:28:44] 2: /usr/lib/Xorg (LogHdrMessageVerb+0x85) [0x5f4d1261cae5]
[2025-02-27 14:28:44] 3: /usr/lib/Xorg (xf86VDrvMsgVerb+0x54) [0x5f4d12636604]
[2025-02-27 14:28:44] 4: /usr/lib/Xorg (xf86DrvMsg+0x97) [0x5f4d126367d7]
[2025-02-27 14:28:44] 5: /usr/lib/Xorg (xf86PrintEDID+0x545) [0x5f4d12654315]
[2025-02-27 14:28:44] 6: /usr/lib/Xorg (xf86OutputSetEDID+0x1bd) [0x5f4d12657e0d]
In the longer run, we'll have to decide whether we actually want to
implement the upper-case directive or change all callers to lower-case.
But for now it's better to just accept %X and interpret it as lower-case,
in order to fix those error messages. Whether it's printed as upper or
lower case is more or less an aesthetic matter.
Reported-By: guido iodice <guido.iodice@gmail.com>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1846>
(cherry picked from commit 628e94b164)
Upstart is long dead, discontinued a decade ago, so there's no
need to keep around a special signaling logic just for it.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1791>
(cherry picked from commit 6c24e53a89)
HAVE_BACKTRACE gets set on systems with libunwind however
execinfo.h may be missing (on *BSD or musl for example).
HAVE_EXECINFO_H has been defined by the build system for a long
time but previously not used.
Signed-off-by: Randy Palamar <randy@rnpnr.xyz>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1207>
(cherry picked from commit 5677de586f)
```
../os/backtrace.c: In function ‘print_registers’:
../os/backtrace.c:94:52: error: passing argument 3 of ‘_ULarm_get_reg’ from incompatible pointer type [-Wincompatible-pointer-types]
94 | ret = unw_get_reg(&cursor, regs[i].regnum, &val);
| ^~~~
| |
| uint64_t * {aka long long unsigned int *}
```
Switched to libunwind's un_word_t type and PRIxPTR fprintf fmt specification
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1763>
(cherry picked from commit e0588d2110)
Support for using inet_ntop() was originally added to support IPv6,
and only used for IPv6 addresses in AuthAudit(). Two decades later,
support for inet_ntop() is ubiquitous and OS'es have marked inet_ntoa()
as deprecated, so use the modern interface for IPv4 as well now.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1760>
(cherry picked from commit 6cc358dfb4)
Support for using getaddrinfo() was originally added to support IPv6,
and only used if IPv6 support was enabled. Two decades later, support
for getaddrinfo() is ubiquitous and OS'es have marked gethostbyname()
as deprecated, so use the modern interface whenever we can now.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1760>
(cherry picked from commit 2ffe0f8a35)
If the compiler knows of a better algorithm for counting the number of
bits set in a word for the target CPU, let it use that, instead of the
classic algorithm optimized for PDP-6.
Based on xorg/lib/libxext@490a25e6f8a4d2482af4364c700b68ad11a4d10b
v2: make old version static inline, stop exporting after !1695
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1674>
(cherry picked from commit 45c485bfdf)
The comment at the top of the function tells humans the fallthroughs
are intentional, but gcc doesn't parse that.
Clears 3 -Wimplicit-fallthrough warnings from gcc 14.1
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1716>
(cherry picked from commit b306df5a60)
MingW also provides localtime_r(), but needs _POSIX_THREAD_SAFE_FUNCTIONS
symbol before including anything, in order for the prototype being defined.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1685>
(cherry picked from commit d43d346541)
On NetBSD gives warning:
In file included from /usr/include/ctype.h:100,
from ../include/misc.h:174,
from ../os/utils.c:75:
../os/utils.c: In function ‘VerifyDisplayName’:
../os/utils.c:624:23: warning: array subscript has type ‘char’ [-Wchar-subscripts]
624 | if (!isdigit(d[i])) {
| ^
../os/utils.c: In function ‘ProcessCommandLine’:
../os/utils.c:942:44: warning: array subscript has type ‘char’ [-Wchar-subscripts]
942 | if ((i + 1 < argc) && (isdigit(*argv[i + 1])))
| ^
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1455>
(cherry picked from commit bb9953db3f)
On NetBSD gives warning:
In file included from /usr/include/ctype.h:100,
from ../include/misc.h:174,
from ../os/access.c:96:
../os/access.c: In function ‘ResetHosts’:
../os/access.c:981:49: warning: array subscript has type ‘char’ [-Wchar-subscripts]
981 | lhostname[i] = tolower(ohostname[i]);
| ^
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1455>
(cherry picked from commit 9446ae487c)
This always had been set since it's incarnation back two decades
ago, on XFree86 4.3.0.1. Probably no need to keep that around anymore.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1518>
(cherry picked from commit aef17edd92)
This always had been enabled since it's incarnation back two decades ago,
so it doesn't seem to be necessary keeping that conditional any longer.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1518>
(cherry picked from commit b5d897d126)
Most of the support for such OS'es was removed in 2010 for
xorg-server-1.10.0, but a few bits lingered on, and a few
comments were left out-of-date.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1667>
(cherry picked from commit f35951d83e)
The backtrace buffer size (BT_SIZE) is determined by compile time,
so we can change BT_SIZE into a #define to turn vla into fixed array.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1664>
(cherry picked from commit 6531720c7c)
The xnfreallocarray was added along (and just as an alias to) XNFreallocarray
back a decade ago. It's just used in a few places and it's only saves us from
passing the first parameter (NULL), so the actual benefit isn't really huge.
No (known) driver is using it, so the macro can be dropped entirely.
Fixes: ae75d50395
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1529>
(cherry picked from commit 61233adbca)
Several places using _X_ATTRIBUTE_PRINTF macro from X11/Xfuncproto.h
but missing to include it, so it depends on other headers whether it's
included by mere accident, which quickly causes trouble if include order
changes. Cleaning that up by adding explicit include statements.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1580>
(cherry picked from commit b30edf326b)
struct hostent->h_addr_list is of type char**, not const char**.
GCC considers this an error when in C99 mode or later.
Signed-off-by: Joaquim Monteiro <joaquim.monteiro@protonmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1572>
(cherry picked from commit 0ddcd87851)
he generic XaceHook() call isn't typesafe (und unnecessarily slow).
Better add an explicit function, just like we already have for others.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1556>
(cherry picked from commit 591d95c79e)
he generic XaceHook() call isn't typesafe (und unnecessarily slow).
Better add an explicit function, just like we already have for others.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1556>
(cherry picked from commit 47d6c3ad75)
This header isn't public and holds defines for code in os/ directory,
so no need to keep it in the global header dir - it's probably better
off in os/ directory - just like we already have with many others.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1389>
(cherry picked from commit 487eb46826)
Conditional on ipv6 around including <arpa/inet.h> isn't necessary.
The only reason target not having it is win32, but it doesn't enable
SIOCGLIFCONF anyways.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1539>
(cherry picked from commit 9d6a1d1118)
DES isn't considered secure anymore for long time now, more and more platforms
dropping DES from their RPC implementations, and even the one where it came
from (Solaris) disabled it for a decade now. We have much better alternatives
(eg. passing creds via Unix socket for local connections, ssh tunneling,
MIT-MAGIC-COOKIE-1, ...), so it's unlikely anybody still really relying on it.
Therefore, sweep it out.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1453>
(cherry picked from commit 71b207a2eb)
