Commit graph

19061 commits

Author SHA1 Message Date
Ian Forbes
56a07cf698 xwayland: Try harder to find a top-level for root grabs
The commit referenced below partially resolved an issue with grabs being made
on the root window. Unfortunately it assumes that the application uses
the same client for all windows. VMware Workstation uses nested windows
for each VM, each of which runs its own process with this own client.
Theses windows are managed by the GUI which is the top level for the
application and maps the windows based on which tab is selected.

Because the VM windows issue a grab on the root window and don't share
the same client as the GUI, grabs don't work properly with global shortcut
inhibition being completely broken.

Getting the parent top-level of the nested windows fixes this issue.

Fixes: c7730cfe55 ("xwayland: Translate keyboard grabs on the root window")
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2016>
(cherry picked from commit afc8b781d8)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
6bc4c33c6d meson.build: include Xephyr in output of which ddx we're building
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2059>
(cherry picked from commit 777de747b9)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
fdac96973b modesetting: fix modesetting symbol test when glx is disabled
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit cc7b0b7681)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
3298b0a3e0 xwayland: fix builds with xace disabled
CI meson-disable-options builds were failing with:
../hw/xwayland/xwayland-screen.c: In function ‘xwl_close_screen’:
../hw/xwayland/xwayland-screen.c:246:5: error: implicit declaration of
 function ‘XaceDeleteCallback’; did you mean ‘DeleteCallback’?
 [-Werror=implicit-function-declaration]
  246 |     XaceDeleteCallback(XACE_PROPERTY_ACCESS, xwl_access_property_callback, screen);
      |     ^~~~~~~~~~~~~~~~~~
      |     DeleteCallback

../hw/xwayland/xwayland-screen.c:246:24: error: ‘XACE_PROPERTY_ACCESS’
 undeclared (first use in this function)
  246 |     XaceDeleteCallback(XACE_PROPERTY_ACCESS, xwl_access_property_callback, screen);
      |                        ^~~~~~~~~~~~~~~~~~~~

../hw/xwayland/xwayland-screen.c: In function ‘xwl_screen_init’:
../hw/xwayland/xwayland-screen.c:1174:5: error: implicit declaration of
 function ‘XaceRegisterCallback’ [-Werror=implicit-function-declaration]
 1174 |     XaceRegisterCallback(XACE_PROPERTY_ACCESS, xwl_access_property_callback, pScreen);
      |     ^~~~~~~~~~~~~~~~~~~~

../hw/xwayland/xwayland-screen.c:1174:26: error: ‘XACE_PROPERTY_ACCESS’
 undeclared (first use in this function)
 1174 |     XaceRegisterCallback(XACE_PROPERTY_ACCESS, xwl_access_property_callback, pScreen);
      |                          ^~~~~~~~~~~~~~~~~~~~

Fixes: a07c2cda9 ("xwayland: Add an XACE property access handler")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit 48acd1ae78)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
48034f858a modesetting: Fix builds with pciaccess or udev_kms disabled
CI meson-disable-options builds were failing with:
../hw/xfree86/drivers/modesetting/driver.c:127:5: error: ‘ms_device_match’
 undeclared here (not in a function)
  127 |     ms_device_match,
      |     ^~~~~~~~~~~~~~~
../hw/xfree86/drivers/modesetting/driver.c: In function ‘ms_get_drm_master_fd’:
../hw/xfree86/drivers/modesetting/driver.c:1179:19: error: variable ‘pEnt’
 set but not used [-Werror=unused-but-set-variable]
 1179 |     EntityInfoPtr pEnt;
      |                   ^~~~
../hw/xfree86/drivers/modesetting/driver.c: At top level:
../hw/xfree86/drivers/modesetting/driver.c:84:13: error: ‘ms_pci_probe’
 used but never defined [-Werror]
   84 | static Bool ms_pci_probe(DriverPtr driver,
      |             ^~~~~~~~~~~~
../hw/xfree86/drivers/modesetting/driver.c:313:1: error: ‘probe_hw_pci’
 defined but not used [-Werror=unused-function]
  313 | probe_hw_pci(const char *dev, struct pci_device *pdev)
      | ^~~~~~~~~~~~

Fixes: a72bdf170 ("modesetting: rewrite probing based on fbdev.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit ec14ecf751)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
f468122d8d meson: don't build xselinux if xace is disabled
xselinux requires xace to build

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit 7b15321b3b)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
878d73e312 dix: Fix builds with meson -Dxace=false -Dwerror=true
CI meson-disable-options builds were failing with:
../dix/events.c: In function ‘CoreEnterLeaveEvent’:
../dix/events.c:4723:19: error: unused variable ‘client’
 [-Werror=unused-variable]
 4723 |         ClientPtr client = grab ? rClient(grab) : wClient(pWin);
      |                   ^~~~~~
../dix/events.c: In function ‘CoreFocusEvent’:
../dix/events.c:4834:19: error: unused variable ‘client’
 [-Werror=unused-variable]
 4834 |         ClientPtr client = wClient(pWin);
      |                   ^~~~~~

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit 6611caf828)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
6a6dac11ac Xace: provide definitions of new hook functions when xace is disabled
Building with -Dxace=false was generating many failures of the form:

../dix/cursor.c: In function ‘AllocARGBCursor’:
../dix/cursor.c:281:10: error: implicit declaration of function
 ‘XaceHookResourceAccess’; did you mean ‘XaceHookPropertyAccess’?
 [-Werror=implicit-function-declaration]
  281 |     rc = XaceHookResourceAccess(client, cid, X11_RESTYPE_CURSOR,
      |          ^~~~~~~~~~~~~~~~~~~~~~
      |          XaceHookPropertyAccess

Fixes: ae3c57333 ("xace: typesafe hook function for XACE_RESOURCE_ACCESS")
Fixes: 9524ffee8 ("xace: typesafe hook function for XACE_DEVICE_ACCESS")
Fixes: 67e468c8b ("xace: typesafe hook function for XACE_SEND_ACCESS")
Fixes: 3dfe00d5e ("xace: typesafe hook function for XACE_RECEIVE_ACCESS")
Fixes: 922b7685d ("xace: typesafe hook function for XACE_CLIENT_ACCESS")
Fixes: 0f6bb23bc ("xace: typesafe hook function for XACE_EXT_ACCESS")
Fixes: 47d6c3ad7 ("xace: typesafe hook function for XACE_SERVER_ACCESS")
Fixes: 51d8bcfc0 ("xace: typesafe hook function for XACE_SCREEN_ACCESS")
Fixes: 305f2d59d ("xace: typesafe hook function for XACE_SCREENSAVER_ACCESS")
Fixes: 591d95c79 ("xace: typesafe hook function for XACE_AUTH_AVAIL")
Fixes: facdaae4e ("xace: typesafe hook function for XACE_KEY_AVAIL")

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit 8bbf497e22)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
d19f10ae74 ci: run builds with most options enabled and most options disabled
We have too many options to run an exhaustive matrix of the combinations,
but this should at least help us catch code that won't compile in many
of the ifdef paths we don't go down in the default configs.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2056>
(cherry picked from commit 6f6a635363)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
3e0f37c95c xfree86: Fix builds with gcc -Wpedantic
../hw/xfree86/loader/loadmod.c:85:33: warning: ISO C forbids empty
 initializer braces before C23 [-Wpedantic]
   85 | static int ModuleDuplicated[] = { };
      |                                 ^
../hw/xfree86/loader/loadmod.c:85:12: error: zero or negative size array
 ‘ModuleDuplicated’
   85 | static int ModuleDuplicated[] = { };
      |            ^~~~~~~~~~~~~~~~

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2054>
(cherry picked from commit d03c84b57f)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
80be420286 xf86bigfont: fix -Werror=unused-variable build failure
../Xext/xf86bigfont.c: In function ‘SProcXF86BigfontQueryVersion’:
../include/dix.h:65:12: error: unused variable ‘stuff’
 [-Werror=unused-variable]
   65 |     type * stuff = (type *)client->requestBuffer;
      |            ^~~~~
../Xext/xf86bigfont.c:654:5: note: in expansion of macro ‘REQUEST’
  654 |     REQUEST(xXF86BigfontQueryVersionReq);
      |     ^~~~~~~

Fixes: 776efd3cf ("Xext: xf86bigfont: drop swapping request length fields")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2053>
(cherry picked from commit e6ec0bfde8)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
218147dd63 ci: enable xf86bigfont in one set of builds
Hopefully this will avoid us accepting more changesets that break it

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2053>
(cherry picked from commit 4ca8b9a474)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
5a1fe4e4f1 xf86bigfont: fix -Wimplicit-function-declaration error
Build breaks with gcc 14 & later when xf86bigfont is enabled:

../Xext/xf86bigfont.c: In function ‘XFree86BigfontExtensionInit’:
../Xext/xf86bigfont.c:709:28: error: implicit declaration of function
 ‘xfont2_allocate_font_private_index’;
 did you mean ‘AllocateFontPrivateIndex’? [-Wimplicit-function-declaration]
  709 |         FontShmdescIndex = xfont2_allocate_font_private_index();
      |                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                            AllocateFontPrivateIndex

Fixes: 05a793f5b ("dix: Switch to the libXfont2 API (v2)")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2053>
(cherry picked from commit 0617f6075b)
2026-01-25 10:40:02 -08:00
Alan Coopersmith
f5e806f2d4 Re-export Ones()
It's used by the nvidia driver

Fixes: 1642adec3 ("dix: unexport Ones()")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2051>
(cherry picked from commit 061690c2e6)
2026-01-25 10:40:02 -08:00
Twaik Yont
59673c0503 os: use close-on-exec for X server socket to prevent fd leaks
In most typical Linux X servers (like Xvfb, Xephyr, or Xwayland),
no child process outlives the server, so this issue rarely arises.
However, in embedded X servers (based on Xvfb or Kdrive) or in
custom Xorg modules, the server might launch a long-running command
with regular fork+exec calls. If the X server crashes or exits while
that command is still running (for example, it spawns a tombstone
generator or any process that hangs or turns to zombie), the file
descriptor associated with the abstract socket can remain open in the
child process. This leads to the kernel refusing to allow another X
server to bind the same socket until the child process terminates
(because there is no explicit way to unlink abstract socket, unlike
Unix socket). By marking the file descriptor as close-on-exec, we
ensure it is automatically closed in child processes, preserving the
ability of a new X server process to bind the socket immediately.

Signed-off-by: Twaik Yont <9674930+twaik@users.noreply.github.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1906>
(cherry picked from commit 5568b0f83f)
2026-01-25 10:40:02 -08:00
liuheng
9e376b9f6a config: Preserve section data when parsing duplicate files
Previously, when parsing multiple configuration files containing the same
section names, only the last occurrence of each section would be retained.
Earlier definitions were silently discarded due to unconditional memory
allocation and overwriting of pointers during parsing.

This resulted in incomplete or incorrect configuration state when users
intended to merge or extend configuration through multiple files.

The section parsing functions in Files.c, Flags.c, and Module.c now
accept existing section pointers. These functions allocate new memory only
if the input pointer is NULL, preserving earlier data when re-parsing.

read.c has been updated to detect and pass existing section pointers when
encountering duplicate sections across files, preventing loss of prior content.

With these changes, the parser properly accumulates and merges configuration
data across multiple files, ensuring that all relevant settings are preserved.

Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/467
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2045>
(cherry picked from commit 9b6f72395a)
2026-01-25 10:40:02 -08:00
Martin von Gagern
fd9ec41679 modesetting: Check for NULL mode_output before printing warning message
Fixes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1816
Signed-off-by: Martin von Gagern <gagern@google.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1938>
(cherry picked from commit 0d39d7a8f3)
2026-01-25 10:40:02 -08:00
Michel Dänzer
1293945d56 xwayland/present: Only flip if the window pixmap dimensions match
If they don't, attaching the new buffer changes the dimensions of the
wl_surface representing the window, which can break stuff as described
in https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2044 .

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2047>
(cherry picked from commit 010c00828a)
2026-01-25 10:40:02 -08:00
Faith Ekstrand
8b9660cd71 glamor: Enable dma-buf on Zink
Zink badly needs dma-buf and modifiers as it can't handle BO import of
tiled buffers without modifiers.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1857>
(cherry picked from commit 376cef6710)
2026-01-25 10:40:02 -08:00
Nathan Kidd
1af7e6c89d glx: Don't blindly write 8 bytes in GLX single replies
Previously we leaked stack when invalid enum parameters were
specified and caused __glGet*_size functions to return a 0 size.

Further, we read out-of-bounds (and leaked) when the input data was less
than 8 bytes (__glXDispSwap_GetFramebufferAttachmentParameteriv and
__glXDisp_GetRenderbufferParameteriv).

Now we only write a single element in the reply padding, and only when there
is a single element. This is what the Mesa client-side libGL expects, and
restores original GLX server behaviour, matching both pre-public (1996) SGI GLX
and XFree86 4.

The main risk of this change is if we have any error in element count or size;
previously it may not have mattered but now it does.

There are no piglit result changes from this modification using either mesa
libGLX or NVIDIA libGLX.

For performance considerations, an extra conditional and variable-length
memcpy has no meaningful impact on the indirect rendering pipeline cost.

There is still the possiblity to leak if our size checks allow an enum that
the GL implemention does not. Guarding against that requires zero-initializing
all temp storage, which wants re-evaluation of the blind 200-byte buffers
used for many calls and thus is a much bigger change.

Signed-off-by: Nathan Kidd <nkidd@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1647>
(cherry picked from commit a4df686888)
2026-01-25 10:40:02 -08:00
Nathan Kidd
2081e72904 glx: Fix out-of-bounds reads from negative return
The callers of these functions were casting -1 to unsigned and then
using 4GB indexes. By returning 0 we match all the other size functions.

GLX size functions return -1 to indicate error, but GL size functions return 0.

Signed-off-by: Nathan Kidd <nkidd@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1647>
(cherry picked from commit 29cfcf5259)
2026-01-25 10:40:02 -08:00
Icenowy Zheng
fa7396a611 glamor: Fix dual blend on GLES3
The EXT_blend_func_extended extension on ESSL always requires explicit
request to allow two FS out variables because of limitations of the ESSL
language, which is mentioned as the No.6 issue of the extension's
specification.

Fix this by adding the extension request.

The original behavior on GLES3 is slightly against the specification of
GL_EXT_blend_func_extended extension, however Mesa and older version of
PowerVR closed drivers will just ignore this issue. Newest PowerVR
closed driver will bail out on this problem, so it deems a fix now.

Fixes: ee107cd491 ("glamor: support GLES3 shaders")
Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1750>
(cherry picked from commit eba15f1ba7)
2026-01-25 10:40:02 -08:00
Vlad Zahorodnii
0eb1ea5a48 xwayland: Dispatch tablet tool tip events after frame events
Xwayland dispatches tablet tool tip events immediately when they arrive.

With compositors such as mutter and sway, it is not an issue because
their libinput backends synthetize axis events before tip events. In
other words, axis data and the tip status belong to different frames.

On the other hand, kwin sends axis and tip events in a single frame
(its libinput backend generates a single tip event with axis data
attached to it). Since the tip events are dispatched immediately,
they can have wrong information associated with them, for example tool
position or pressure. It results in undesired "streaks" when the user
presses the tablet tool against the tablet.

See also https://bugs.kde.org/show_bug.cgi?id=479856.

Signed-off-by: Vlad Zahorodnii <vlad.zahorodnii@kde.org>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2032>
(cherry picked from commit 60f0bfe852)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
8fec6c7116 randr: Do not leak the provider property
When changing the RandR provider property, if the property does not
already exists, it is created.

In case of error, however, it doesn't get freed, leading to a leak of
the allocated property.

Make sure to free the RandR property in case of error if was to be
added.

Found by OpenScanHub.

Fixes: 3c3a4b767 - randr: Check for overflow in RRChangeProviderProperty()
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2035>
(cherry picked from commit c34f59ee15)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
38aa1b4a91 os: Check for integer overflow on BigRequest length
Check for another possible integer overflow once we get a complete xReq
with BigRequest.

Related to CVE-2025-49176

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
(cherry picked from commit 4fc4d76b2c)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
2961831f11 xfree86: Check for RandR provider functions
Changing XRandR provider properties if the driver has set no provider
function such as the modesetting driver will cause a NULL pointer
dereference and a crash of the Xorg server.

Related to CVE-2025-49180

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 0235121c6a)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
07203788d3 randr: Check for overflow in RRChangeProviderProperty()
A client might send a request causing an integer overflow when computing
the total size to allocate in RRChangeProviderProperty().

To avoid the issue, check that total length in bytes won't exceed the
maximum integer value.

CVE-2025-49180

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 3c3a4b767b)
2026-01-25 10:40:02 -08:00
Olivier Fourdan
d308edc0e5 record: Check for overflow in RecordSanityCheckRegisterClients()
The RecordSanityCheckRegisterClients() checks for the request length,
but does not check for integer overflow.

A client might send a very large value for either the number of clients
or the number of protocol ranges that will cause an integer overflow in
the request length computation, defeating the check for request length.

To avoid the issue, explicitly check the number of clients against the
limit of clients (which is much lower than an maximum integer value) and
the number of protocol ranges (multiplied by the record length) do not
exceed the maximum integer value.

This way, we ensure that the final computation for the request length
will not overflow the maximum integer limit.

CVE-2025-49179

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 2bde9ca49a)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2025>
2026-01-25 10:40:01 -08:00
Olivier Fourdan
5279ee435c os: Account for bytes to ignore when sharing input buffer
When reading requests from the clients, the input buffer might be shared
and used between different clients.

If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.

To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.

CVE-2025-49178

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit d55c54cecb)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
721d4ff4e5 xfixes: Check request length for SetClientDisconnectMode
The handler of XFixesSetClientDisconnectMode does not check the client
request length.

A client could send a shorter request and read data from a former
request.

Fix the issue by checking the request size matches.

CVE-2025-49177

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Fixes: e167299f6 - xfixes: Add ClientDisconnectMode
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit ab02fb96b1)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
bfbd77a59a os: Do not overflow the integer size with BigRequest
The BigRequest extension allows requests larger than the 16-bit length
limit.

It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.

In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.

To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.

The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.

To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.

CVE-2025-49176

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 03731b326a)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
0dca7ea49a render: Avoid 0 or less animated cursors
Animated cursors use a series of cursors that the client can set.

By default, the Xserver assumes at least one cursor is specified
while a client may actually pass no cursor at all.

That causes an out-of-bound read creating the animated cursor and a
crash of the Xserver:

 | Invalid read of size 8
 |    at 0x5323F4: AnimCursorCreate (animcur.c:325)
 |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |  Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
 |    at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
 |    by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |
 | Invalid read of size 2
 |    at 0x5323F7: AnimCursorCreate (animcur.c:325)
 |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
 |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
 |    by 0x4A1E9D: Dispatch (dispatch.c:560)
 |    by 0x4B0169: dix_main (main.c:284)
 |    by 0x4287F5: main (stubmain.c:34)
 |  Address 0x8 is not stack'd, malloc'd or (recently) free'd

To avoid the issue, check the number of cursors specified and return a
BadValue error in both the proc handler (early) and the animated cursor
creation (as this is a public function) if there is 0 or less cursor.

CVE-2025-49175

This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
(cherry picked from commit 0885e0b262)
2026-01-25 10:40:01 -08:00
Olivier Fourdan
3c80595c7e xwayland: Do not pretend leaving the X11 surface if buttons are down
Xwayland has its own XYToWindow() handler to account for the case when
the pointer leaves an X11 surface to enter another Wayland native
window.

When that occurs, Xwayland will treat it as if the pointer had entered
the root window so that the X11 clients receive an appropriate leave
event.

When the pointer leaves the X11 surface, Xwayland will call
CheckMotion() to update the sprite coordinates and possibly the cursor.

However, if we left the surface with a button down, it means the wayland
compositor has grabbed the pointer so we will not get button release
events from the compositor.

Once the button is released, Xwayland will get a pointer enter event from
the compositor, and Xwayland will clear up the buttons pressed.

But that might confuse Xwayland in thinking the pointer has crossed the
windows and leave the wrong cursor showing in the X11 surface.

To avoid the issue, if buttons are down, do not pretend the cursor has
left the X11 surface for the root window.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1811
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2008>
(cherry picked from commit 8cb078f8b6)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
6e126016e3 Xephyr.man: Use \- to get ASCII hyphens instead of Unicode dashes
Used in command-line arguments and email addresses

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit 0d2213ec44)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
8fb69863a3 man pages: don't use .BI macro with a single argument
Clears warnings from groff -rCHECKSTYLE=10:

an.tmac: Xephyr.man:53: style: .BI expects at least 2 arguments, got 1
an.tmac: Xephyr.man:55: style: .BI expects at least 2 arguments, got 1
an.tmac: Xwayland.man:151: style: .BI expects at least 2 arguments, got 1
an.tmac: Xwayland.man:166: style: .BI expects at least 2 arguments, got 1

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit ff4f2f718b)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
4837b74123 XWin.man: fix typos in font change escapes
Fixes warnings from `mandoc -T lint`:

mandoc: XWin.man:332:28: WARNING: invalid escape sequence: \fp
mandoc: XWin.man:397:1: WARNING: invalid escape sequence: \fX

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit 286578e83e)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
1176228c0b man pages: remove extraneous PP macros
Clears warnings from `mandoc -T lint` of the forms:
mandoc: Xorg.man:26:2: WARNING: skipping paragraph macro: PP after SH
mandoc: Xorg.man:40:2: WARNING: skipping paragraph macro: PP empty

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit bd08e04fcb)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
fdb85312d1 man pages: strip trailing whitespace
Gets rid of many warnings from `mandoc -T lint` of the form:
mandoc: ./man/Xserver.man:621:7: STYLE: whitespace at end of input line

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2009>
(cherry picked from commit 6dfe3e7db6)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
4a6e8a6efd mi: use common implementation of bit counting function
Reduce a bit of unexplained magic, and use ISA extensions where available

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1984>
(cherry picked from commit 7aa1f121e4)
2026-01-25 10:40:01 -08:00
Enrico Weigelt, metux IT consult
061278dc23 randr: fix unconditional byte-swap in ProcRRGetProviderInfo()
The list of the associated provider's capabilities was always swapped
unconditionally, while it should only be in case of client having
opposite endianess.

Fixes: 4c92eb00f ("randr: add output source setup")
Reported-By: dasha_uwu
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1977>
(cherry picked from commit 73f3c47608)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
b0c8e4ef7e render: miindex.c does not need header guard macros
Clears warning from clang 19.1.7:

render/miindex.c:27:9: warning: macro is not used [-Wunused-macros]
   27 | #define _MIINDEX_H_
      |         ^

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit 37b7ea8f8a)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
f19f6fac9b os: remove unused definition of BUGADDRESS
We stopped including this in error messages back in 2008

Clears warning from clang 19.1.7:

os/utils.c:1338:9: warning: macro is not used [-Wunused-macros]
 1338 | #define BUGADDRESS BUILDERADDR
      |         ^

Fixes: ef77e4c44 ("Remove useless commentary from environment and argument processing.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit f988558348)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
ecf72360c7 test: remove extra return
Clears warning from clang 19.1.7:

test/misc.c:239:12: warning: 'return' will never be executed
 [-Wunreachable-code-return]
  239 |     return 0;

Fixes: 46b579e8d ("test: switch the unit tests to something resembling a test suite")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit d1cc5a599f)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
afceb0d3d1 modesetting: fix typo in XF86ModuleVersionInfo initialization
Found by clang 19.1.7:

hw/xfree86/drivers/modesetting/driver.c:163:21:
 warning: initializer overrides prior initialization of this subobject
 [-Winitializer-overrides]
  163 |     ._modinfo1_   = MODINFOSTRING2,
      |                     ^~~~~~~~~~~~~~
hw/xfree86/drivers/modesetting/driver.c:162:21:
 note: previous initialization is here
  162 |     ._modinfo1_   = MODINFOSTRING1,
      |                     ^~~~~~~~~~~~~~

Fixes: 2a10eff6c ("xfree86: modsetting: use explicit field initializers for XF86ModuleData")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit 062c339519)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
1c0baec459 test: remove stray semi-colons after functions
Clears warnings from clang 19.1.7:

test/list.c:95:2: warning: extra ';' outside of a function [-Wextra-semi]
   95 | };
      |  ^

test/list.c:137:2: warning: extra ';' outside of a function [-Wextra-semi]
  137 | };
      |  ^

Fixes: 92788e677 ("test: add some tests for basic list manipulation.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit 3eaa19d74b)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
e0c28fc85f xfree86: make modeline2c.awk put a newline at the end of xf86DefModeSet.c
Clears warning from clang 19.1.7:
hw/xfree86/common/xf86DefModeSet.c:288:62:
 warning: no newline at end of file [-Wnewline-eof]
  288 | const int xf86NumDefaultModes = ARRAY_SIZE(xf86DefaultModes);
      |                                                              ^

Fixes: 3bf7ff703 ("Size xf86DefaultModes explicitly.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
(cherry picked from commit f9d25189fa)
2026-01-25 10:40:01 -08:00
Peter Harris
b1ebab3550 Update mailmap for Peter Harris
My division was acquired by Rocket Software. The opentext.com email
address is no longer active.

Ref: https://investors.opentext.com/press-releases/press-releases-details/2024/OpenText-Completes-Divestiture-of-Application-Modernization-and-Connectivity-AMC-Business-to-Rocket-Software-for-2.275B/default.aspx
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1914>
(cherry picked from commit dfbc672e85)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
45d9789287 Xserver.man: correct list of available authorization protocols
XDM-AUTHORIZATION-2 (IPv6 capable version of -1) was never merged.
SUN-DES-1 was removed by commit 71b207a2e in 2024
MIT-KERBEROS-5 was removed by commit dfbe32b5b in 2007

Fixes: 71b207a2e ("os: drop SUN-DES-1 authentication")
Fixes: dfbe32b5b ("Remove the old Kerberos 5 authentication code.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1913>
(cherry picked from commit 845c4ae518)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
b05498d3bf Xserver.man: add Xwayland(1) to list of server-specific man pages
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1913>
(cherry picked from commit 80ad8a2c6d)
2026-01-25 10:40:01 -08:00
Alan Coopersmith
b40f3b81e1 Xserver.man: allow line breaks in default font path
Allows nroff to insert a line break between iterm in the font path
instead of displaying it as a single, very overlength line.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1891>
(cherry picked from commit b9c31cc9bc)
2026-01-25 10:40:01 -08:00