The LogVHdrMessageVerb function may access an array out of bounds in a
specific edge case. Specifically, the line:
newline = (buf[len - 1] == '\n');
can result in accessing buf[-1] if len == 0, which is undefined behavior.
Commit adds check to avoid access out of bounds at pointed line.
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1841
Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2061>
This reverts commit 8e8bf63908.
It failed to build if xf86bigfont was enabled:
../os/utils.c: In function ‘AbortServer’:
../os/utils.c:1555:5: error: implicit declaration of function
‘XF86BigfontCleanup’ [-Wimplicit-function-declaration]
1555 | XF86BigfontCleanup();
| ^~~~~~~~~~~~~~~~~~
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2053>
In most typical Linux X servers (like Xvfb, Xephyr, or Xwayland), no child process outlives the server, so this issue rarely arises. However, in embedded X servers (based on Xvfb or Kdrive) or in custom Xorg modules, the server might launch a long-running command with regular fork+exec calls. If the X server crashes or exits while that command is still running (for example, it spawns a tombstone generator or any process that hangs or turns to zombie), the file descriptor associated with the abstract socket can remain open in the child process. This leads to the kernel refusing to allow another X server to bind the same socket until the child process terminates (because there is no explicit way to unlink abstract socket, unlike Unix socket). By marking the file descriptor as close-on-exec, we ensure it is automatically closed in child processes, preserving the ability of a new X server process to bind the socket immediately.
Signed-off-by: Twaik Yont <9674930+twaik@users.noreply.github.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1906>
Check for another possible integer overflow once we get a complete xReq
with BigRequest.
Related to CVE-2025-49176
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
When reading requests from the clients, the input buffer might be shared
and used between different clients.
If a given client sends a full request with non-zero bytes to ignore,
the bytes to ignore may still be non-zero even though the request is
full, in which case the buffer could be shared with another client who's
request will not be processed because of those bytes to ignore, leading
to a possible hang of the other client request.
To avoid the issue, make sure we have zero bytes to ignore left in the
input request when sharing the input buffer with another client.
CVE-2025-49178
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
The BigRequest extension allows requests larger than the 16-bit length
limit.
It uses integers for the request length and checks for the size not to
exceed the maxBigRequestSize limit, but does so after translating the
length to integer by multiplying the given size in bytes by 4.
In doing so, it might overflow the integer size limit before actually
checking for the overflow, defeating the purpose of the test.
To avoid the issue, make sure to check that the request size does not
overflow the maxBigRequestSize limit prior to any conversion.
The caller Dispatch() function however expects the return value to be in
bytes, so we cannot just return the converted value in case of error, as
that would also overflow the integer size.
To preserve the existing API, we use a negative value for the X11 error
code BadLength as the function only return positive values, 0 or -1 and
update the caller Dispatch() function to take that case into account to
return the error code to the offending client.
CVE-2025-49176
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
reported by Julian Suleder via ERNW Vulnerability Disclosure.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
We stopped including this in error messages back in 2008
Clears warning from clang 19.1.7:
os/utils.c:1338:9: warning: macro is not used [-Wunused-macros]
1338 | #define BUGADDRESS BUILDERADDR
| ^
Fixes: ef77e4c44 ("Remove useless commentary from environment and argument processing.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1910>
Several pieces of the code, as well as drivers are using %X, which
we don't support, so leading to error messages like this:
[2025-02-27 14:28:44] BUG: 'if (f[f_idx])'
[2025-02-27 14:28:44] BUG: ../xserver/os/log.c:538 in vpnprintf()
[2025-02-27 14:28:44] Unsupported printf directive 'X'
[2025-02-27 14:28:44]
[2025-02-27 14:28:44] Backtrace:
[2025-02-27 14:28:44] unw_get_proc_name failed: no unwind info found [-10]
[2025-02-27 14:28:44] 0: /usr/lib/Xorg (?+0x0) [0x5f4d1261bc47]
[2025-02-27 14:28:44] 1: /usr/lib/Xorg (LogVHdrMessageVerb+0x10f) [0x5f4d1261ca3f]
[2025-02-27 14:28:44] 2: /usr/lib/Xorg (LogHdrMessageVerb+0x85) [0x5f4d1261cae5]
[2025-02-27 14:28:44] 3: /usr/lib/Xorg (xf86VDrvMsgVerb+0x54) [0x5f4d12636604]
[2025-02-27 14:28:44] 4: /usr/lib/Xorg (xf86DrvMsg+0x97) [0x5f4d126367d7]
[2025-02-27 14:28:44] 5: /usr/lib/Xorg (xf86PrintEDID+0x545) [0x5f4d12654315]
[2025-02-27 14:28:44] 6: /usr/lib/Xorg (xf86OutputSetEDID+0x1bd) [0x5f4d12657e0d]
In the longer run, we'll have to decide whether we actually want to
implement the upper-case directive or change all callers to lower-case.
But for now it's better to just accept %X and interpret it as lower-case,
in order to fix those error messages. Whether it's printed as upper or
lower case is more or less an aesthetic matter.
Reported-By: guido iodice <guido.iodice@gmail.com>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1846>
Not used by any external modules, so no need to keep it in public API.
Since it's used by DRI, still needs the _X_EXPORT flag, as long as DRI
is a dynamically loaded module.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1790>
Upstart is long dead, discontinued a decade ago, so there's no
need to keep around a special signaling logic just for it.
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1791>
HAVE_BACKTRACE gets set on systems with libunwind however
execinfo.h may be missing (on *BSD or musl for example).
HAVE_EXECINFO_H has been defined by the build system for a long
time but previously not used.
Signed-off-by: Randy Palamar <randy@rnpnr.xyz>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1207>
This function doesn't much to do with logging, except for being
called once by FatalError(). It's better placed in utils.c
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1678>
```
../os/backtrace.c: In function ‘print_registers’:
../os/backtrace.c:94:52: error: passing argument 3 of ‘_ULarm_get_reg’ from incompatible pointer type [-Wincompatible-pointer-types]
94 | ret = unw_get_reg(&cursor, regs[i].regnum, &val);
| ^~~~
| |
| uint64_t * {aka long long unsigned int *}
```
Switched to libunwind's un_word_t type and PRIxPTR fprintf fmt specification
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1763>
