Commit graph

19345 commits

Author SHA1 Message Date
Alan Coopersmith
e2dee499c7 COPYING: drop copyright & license notice for removed dmx input drivers
Drivers were removed in 2017 for xorg-server-1.20

Fixes: d740e1830 ("dmx: Remove non-evdev hardware input drivers")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:27:49 -07:00
Alan Coopersmith
1fb51720b2 COPYING: drop copyright & license notice for removed lnx_font.c
Code was removed in 2009 for xorg-server-1.8

Fixes: c61e77c77 ("Remove lnx_font.c and lnx.h")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:26:11 -07:00
Alan Coopersmith
d9cfc051fa COPYING: drop copyright & license notice for removed extmod code
Code was removed in 2012 for xorg-server-1.13

Fixes: a7a2f9f66 ("Remove the last remnants of extmod")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:25:35 -07:00
Alan Coopersmith
dee1c503c1 COPYING: drop copyright & license notice for removed SysV os-support code
Code was removed in 2010 for xorg-server-1.10

Fixes: 6ce1908ba ("xfree86: Remove os-support/sysv")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:24:50 -07:00
Alan Coopersmith
2f74d93eed COPYING: drop copyright & license notice for removed kdrive linux backend
Code was removed in 2017 for xorg-server-1.20

Fixes: 27819950e ("kdrive: Remove now-unused linux backend")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:24:13 -07:00
Alan Coopersmith
f5258cf0a2 COPYING: drop copyright & license notice for removed mibstore.h
Removed in 2012 for xorg-server-1.14

Fixes: 1cb0261ef ("dix: Delete mibstore.h")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:23:35 -07:00
Alan Coopersmith
cba07c5801 COPYING: drop copyright & license notice for removed assyntax.h
Removed in 2008 for xorg-server-1.6

Fixes: 593144ddd ("Remove some unused assembly code and assyntax.h")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:23:00 -07:00
Alan Coopersmith
661c242556 COPYING: drop copyright & license notice for removed xorgcfg code
Removed in 2008 for xorg-server-1.6

Fixes: 5c1e254cc ("Remove xorgcfg")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:21:52 -07:00
Alan Coopersmith
1a39367dc5 COPYING: drop copyright & license notice for removed DMX code
Removed in 2021 for xorg-server-21.1

Fixes: b3b81c8c2 ("Drop DMX DDX")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:20:48 -07:00
Alan Coopersmith
9d3ca5f3bc COPYING: drop copyright & license notice for removed glxvisuals.c
Removed in 2007 for xorg-server-1.5

Fixes: 7d7469053 ("Simplify and clean up GLX visual initialization.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:19:31 -07:00
Alan Coopersmith
1d9a3aafe8 COPYING: drop copyright & license notice for removed dlloader code
Removed in 2010 for xorg-server-1.10

Fixes: 2a24a013b ("loader: Merge dlloader directly into the loader")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:18:29 -07:00
Alan Coopersmith
66c96a4e5a COPYING: drop copyright for removed xf8_16bpp overlay module
Removed in 2010 for xorg-server-1.10

Fixes: b85f9063c ("xfree86: Remove the xf8_16bpp overlay module")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:14:52 -07:00
Alan Coopersmith
be6682c5e5 COPYING: drop copyright for removed non-evdev input drivers
Drivers were removed in 2017 for xorg-server-1.20

Fixes: e7b8b7b13 ("kdrive: Remove non-evdev input drivers")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:14:52 -07:00
Alan Coopersmith
9a5b873b2e COPYING: drop copyright & license notice for removed USL code
Code was removed in 2008 for xorg-server-1.6

Fixes: 446fe9eec ("Dead code removal")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:14:49 -07:00
Alan Coopersmith
135f86dac0 COPYING: drop copyright & license notice for removed SCO code
Code was removed in 2010 for xorg-server-1.10

Fixes: f28e48834 ("Remove SCO support")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2026-05-30 11:13:25 -07:00
Richard Purdie
827e82b749 COPYING: Add SPDX-License-Identifier entries
Trying to work out which licences are in the COPYING file is a challenge.
Since I went through and did it, add SPDX-License-Identifier strings before
each one so that others don't have to repeat the work. This makes it easier
to work out which licenses are present.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2218>
2026-05-30 10:32:14 -07:00
Olivier Fourdan
5348d7d792 xwayland: Add have_clipboard flag in pkgconfig file
We use the pkgconfig file to indicate the availability of the command
line options, add the newly added clipboard option there as well.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2223>
2026-05-27 10:04:50 +00:00
Olivier Fourdan
c3198080fc Revert "xwayland: Do not pretend leaving the X11 surface if buttons are down"
Kwin may send button events to Xwayland even when there is no Xwayland
surface with input focus.

With this change applied, that causes spurious input focus changes.

And even with that change reverted, I fail to reproduce the bug from
issue #1811.

This reverts commit 8cb078f8b6.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/work_items/1883
See-also: https://gitlab.freedesktop.org/xorg/xserver/-/work_items/1811
See-also: https://gitlab.freedesktop.org/xorg/xserver/-/work_items/1818
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2194>
2026-05-27 09:36:31 +00:00
Mikhail Dmitrichenko
d6c462f599 xkb: preserve buffer on realloc failure
_Concat() stored the realloc() result directly in its input pointer, so
an allocation failure could drop the only reference to the original
buffer when callers assigned the return value back to their destination
pointer.

Keep the old pointer until realloc() succeeds, avoiding the leak
reported by static analysis.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2221>
2026-05-25 12:48:50 +03:00
Alan Coopersmith
ab0a7dacad dix: Fix Collabora's name in copyright notices
Fixes: 3fb258ca2 ("input: add a TouchClassRec to the devices")
Fixes: 7656a9c8d ("dix: Implement internal gesture state handling")

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2219>
2026-05-23 14:19:30 -07:00
Mikhail Dmitrichenko
08e65ce8ae os: check ospoll allocation failures
ospoll_create() initializes backend-specific state immediately after
allocating the ospoll structure. Check the allocation result for each
backend before dereferencing it and return NULL on failure.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2217>
2026-05-23 16:30:21 +00:00
Mikhail Dmitrichenko
872ece04f9 xwayland: check queued DRM lease allocation
registry_global() queues DRM lease devices before the root window is
available and initializes the queued entry immediately after malloc().
Return early on allocation failure to avoid dereferencing a NULL
pointer.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2217>
2026-05-23 16:30:21 +00:00
Mikhail Dmitrichenko
731cb81ba1 glx: use XNFcallocarray for DRI config allocation
createModeFromConfig() dereferences the allocated GLX DRI config
immediately after allocation. Use the X server no-fail allocator so
allocation failure is handled consistently instead of risking a NULL
dereference.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2217>
2026-05-23 16:30:21 +00:00
Peter Hutterer
2409bfda88 pyxtest: rework the request handling to avoid to_bytes() invocations
xclient.send_request() should just take a Request object and handle
to_bytes with the right byte order. This avoids typos/copy-paste errors
in tests when the byte order changes between tests.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2216>
2026-05-20 23:05:35 +00:00
Peter Hutterer
7e22a5cfb5 pyxtest: replace numerical error values with BadValue, etc.
Let's use human-readable variables for this.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2216>
2026-05-20 23:05:35 +00:00
Peter Hutterer
a49dc5c7d5 pyxtest: document the --display option in the README
Fixes: 4d79ddd0b4 ("pyxtest: add --display for running a test against a manually started server")
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2216>
2026-05-20 23:05:35 +00:00
Peter Hutterer
54860e6c7f glx: reject negative size in FeedbackBuffer and SelectBuffer requests
Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2206>
2026-05-18 00:09:39 +00:00
Peter Hutterer
b4f2807a40 dix/colormap: fix out-of-bounds read in FindColorInRootCmap
The for loop here always iterates size times but the client controls the
starting offset. When the starting pixel is non-zero (e.g., pixel=10 in
a size=256 colormap), the loop reads from pentFirst[10] through
pentFirst[265], reading 10 entries past the end of the array.

Fix this by wrapping around once we reach size, same as FindColor()
already does.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2215>
2026-05-18 00:04:02 +00:00
Peter Hutterer
93d1441487 cursor: fix AllocARGBCursor leak/double-free for psrcbits/pmaskbits/argb
AllocARGBCursor took ownership of the psrcbits/pmaskbits/argb arguments.
But if the initial calloc failed none of them were freed, without the
caller knowing about it. Depending on the code path, those arguments
would thus either leak or be double-freed.

Fix it by always freeing those on error and updating the callers
accordingly.

Assisted-by: Claude:claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2214>
2026-05-17 23:57:42 +00:00
Peter Hutterer
14caf91be2 pyxtest: fix the vidmode SwitchToModeRequest test
This test was missing SetClientVersion(2) so the reply was a the old 0.x
protocol (and the 36 byte GetModeLine reply). Update so it runs for both
versions now.

Fixes: acbc46e708 ("pyxtest: add tests for the byteswapping patches")
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2213>
2026-05-15 04:14:37 +00:00
Peter Hutterer
9ad275a8f1 pyxtest: require root to run the test as Xorg
This is the easiest way to notify users that it just won't run as-is.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2213>
2026-05-15 04:14:37 +00:00
Peter Hutterer
87dd72ce99 pyxtest: fix xorg invocations when running from the build dir
We need a proper module tree set up so let's do this via symlinks during
the setup phase and then start the server with that as module path.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2213>
2026-05-15 04:14:37 +00:00
Alan Coopersmith
a94d6bfac6 meson: raise minimum supported version to meson 1.0.0
Fixes warning:
include/meson.build:208: WARNING: Project targets '>= 0.60.0' but uses
 feature introduced in '1.0.0': "compiler.has_member" keyword argument
 "prefix" of type list.

Fixes: b289d5e2e ("meson: define BSD44SOCKETS and LOCALCONN for xtrans when appropriate")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2210>
2026-05-15 04:05:58 +00:00
Peter Hutterer
165d2810a0 pyxtest: add test for present notify array byte-swap fix
The test sends a PresentPixmap request with a notify entry from a
byte-swapped client. Without the fix, the window ID in the notify
is not swapped, causing dixLookupWindow to fail with BadWindow.
With the fix, the window ID is correctly interpreted.

See 925edb6c9e ("present: Fix missing byte swaps in sproc_present_pixmap()")

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2212>
2026-05-15 04:01:11 +00:00
Peter Hutterer
2e876bc39b pyxtest: add test cases for the recent XKB fixes
See https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2208

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2211>
2026-05-15 03:55:15 +00:00
Olivier Fourdan
58a086d907 config: Fix build with udev disabled
Commit b5b52979 has split the options "udev" and "udev_kms" for systems
without systemd.

Yet, when building with "-Dudev=false", "udev_kms" still defaults to
true.

That breaks the build because "config_udev_odev_probe()" is not defined:

| config/config.c: In function ‘config_odev_probe’:
| config/config.c:77:5: error: implicit declaration of function
|                       ‘config_udev_odev_probe’; did you mean
|                       ‘config_odev_probe’?
|                       [-Wimplicit-function-declaration]
|   77 |     config_udev_odev_probe(probe_callback);
|      |     ^~~~~~~~~~~~~~~~~~~~~~
|      |     config_odev_probe
| config/config.c:77:5: warning: nested extern declaration of
|                       ‘config_udev_odev_probe’ [-Wnested-externs]

Yet, the code of the function "config_udev_odev_probe()" in config/udev.c
is within a "#ifdef udev_kms" conditional, so it is built.

The problem is that the function definition is within an "#ifdef udev"
in the "config_backends.h" header.

So, even though the actual code is compiled, the compiler will fail to
find the function definition, hence the "implicit declaration" error.

To avoid the issue, move the function definition within a separate
"udev_kms" conditional in the "config-backends.h" header file.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/work_items/1890
Fixes: b5b52979 ("meson: split udev from udev_kms which requires systemd")
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2203>
2026-05-11 23:58:47 +00:00
Peter Hutterer
4d79ddd0b4 pyxtest: add --display for running a test against a manually started server
This makes it much easier to debug an individual test since we can now
start an X server via valgrind/gdb/whatever and have the test client
connect to that server.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:44 +00:00
Peter Hutterer
b9ed4bd4c0 pyxtest: add tests for XI property data byte-swap fix
Add tests for commit b243ef9bc2 ("Xi: Swap property data in
SProcXChangeDeviceProperty/SProcXIChangeProperty").

Both tests set a format=32 property from a byte-swapped client and
read it back, verifying the values round-trip correctly. Without the
property data swap, the stored values have the wrong byte order.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:44 +00:00
Peter Hutterer
acbc46e708 pyxtest: add tests for the byteswapping patches
Not a full list since not all can easily be tested but hey, better than
nothing.
See https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2181

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:44 +00:00
Peter Hutterer
7f7bb53cf9 pyxtest: add test cases for the Screensaver extension CVEs of the last years
Commit 6c4c530107 ("Xext: Fix out of bounds access in SProcScreenSaverSuspend()")

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:44 +00:00
Peter Hutterer
33f3066ddb byxtest: add test cases for the RECORD extension CVEs of the last years
Commit 2902b78535 ("Fix XRecordRegisterClients() Integer underflow")

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:44 +00:00
Peter Hutterer
845eb56df2 pyxtest: add test cases for the various XKB CVEs from the last few years
Commit 446ff2d317 ("Check SetMap request length carefully.")
Commit 6907b6ea2b ("xkb: add request length validation for XkbSetGeometry")
Commit 4cd8533210 ("xkb: Fix buffer overflow in _XkbSetCompatMap()")
Commit f7cd1276bb ("Correct bounds checking in XkbSetNames()")

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:43 +00:00
Peter Hutterer
7d89596e6c pyxtest: add test cases for the RandR extension CVEs of the last years
Commit 541ab2ecd4 ("Xi/randr: fix handling of PropModeAppend/Prepend")
Commit 14f480010a ("randr: avoid integer truncation in length check of ProcRRChange*Property")

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:43 +00:00
Peter Hutterer
fea5cc4b54 pyxtest: add tests for XI property and passive grab CVEs
Commit 541ab2ecd4 ("Xi/randr: fix handling of PropModeAppend/Prepend")
Commit 8f454b793e ("Xi: avoid integer truncation in length check of ProcXIChangeProperty")
Commit 51eb63b0ee ("Xi: disallow passive grabs with a detail > 255")

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:43 +00:00
Peter Hutterer
bea8d65fc8 test: add pytest-based test suite
This test suite is primarily aimed at reproducing the various CVE issues
we've had over the years that require custom crafted protocol requests.
It may also be useful for other testing.

Wrapped in python because pytest is a powerful test suite runner and
writing custom buffers is easy.

The architecture is so that we fork off an X server (one or more of
Xvfb, Xwayland, Xorg) and then run our test clients against that to
check whether we get the right reply, or crash the server, or whether
valgrind complains about something (valgrind is started automatically
for tests that are marked as such).

Tests can be run manually via pytest or via meson test.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:43 +00:00
Peter Hutterer
2e4a5aecef meson: give the xorg executable an actual name
Matches e.g. xvfb_server and xwayland_server.

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2187>
2026-05-10 23:42:43 +00:00
Peter Hutterer
f70cc16c68 present: actually return the created notifies
present_create_notifies() creates an array of notifies but never returns
them to the caller, despite them being passed individually to
present_add_window_notify(). The caller proceeds with a NULL notifies
array, eventually causing an OOB in present_vblank_notify() when
vblank->notifies is NULL.

Reported-by: Feng Ning, Innora Pte. Ltd.
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2204>
2026-05-10 23:37:05 +00:00
Peter Hutterer
23e7de97c8 render: fix memory leaks on XaceHook failure in resource creation
Same pattern for all hunks here: if Xace fails, free the
allocated data.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2205>
2026-05-10 23:33:09 +00:00
Peter Hutterer
634247ef0c os/auth: prefer getrandom() over arc4random_buf() and /dev/urandom
Use getrandom() as the preferred source of random data when available,
getrandom() works in chroots and containers without the random device
node.

Note this is a build-time preference, not a runtime preference.

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2200>
2026-05-10 23:28:33 +00:00
Peter Hutterer
cbe50578f8 randr/rrsdispatch: reject invalid format in SProcRRChangeProviderProperty
No real effect here since we check stuff->format early in
ProcRRChangeProviderProperty anyway. But this just makes it a bit more
obvious (and more consistent with other functions).

Assisted-by: Claude:claude-claude-opus-4-6
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2200>
2026-05-10 23:28:33 +00:00