xserver/dix
Peter Hutterer 5f0c4e0bf2 dix: keep a ref to the rootCursor
CreateCursor returns a cursor with refcount 1 - that refcount is used by
the resource system, any caller needs to call RefCursor to get their own
reference. That happens correctly for normal cursors but for our
rootCursor we keep a variable to the cursor despite not having a ref for
ourselves.

Fix this by reffing/unreffing the rootCursor to ensure our pointer is
valid.

Related to CVE-2025-26594, ZDI-CAN-25544

Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
(cherry picked from commit b0a09ba602)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
2025-02-25 19:36:29 +01:00
..
.gitignore Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
atom.c atom: make FreeAtom static 2015-07-08 16:41:29 -04:00
buildatoms XFree86 4.3.0.1 2003-11-14 16:49:22 +00:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
colormap.c dix: FindBestPixel: fix implicit fallthrough warning 2024-10-11 00:18:05 +00:00
cursor.c dix: Remove -fn and -fc options to set default text/cursor fonts 2019-10-30 16:17:04 +00:00
devices.c dix: don't push the XKB state to a non-existing master keyboard 2025-02-05 15:02:23 +01:00
dispatch.c Cursor: Refuse to free the root cursor 2025-02-25 19:36:29 +01:00
dispatch.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
dixfonts.c dix: SetFontPath: don't set errorValue on Success 2024-10-11 00:18:05 +00:00
dixutils.c os: Don't crash in AttendClient if the client is gone 2019-11-19 10:15:05 -08:00
enterleave.c dix: fix button offset when generating DeviceButtonStateNotify events 2025-02-05 15:02:23 +01:00
enterleave.h mi: reset the PointerWindows reference on screen switch 2023-10-25 10:51:18 +10:00
eventconvert.c dix: limit checks to MAX_VALUATORS when generating Xi events 2025-02-05 15:02:23 +01:00
events.c dix: Use CopyPartialInternalEvent in EnqueueEvent 2023-02-07 10:21:52 +10:00
extension.c dix: Allow an extension to disable itself 2018-04-24 14:36:04 -04:00
gc.c dix: CreateScratchGC: avoid dereference of pointer we just set to NULL 2024-10-11 00:18:05 +00:00
gestures.c Implement gesture processing logic 2021-05-30 13:26:42 +03:00
getevents.c touchevents: set the screen pointer after checking the device is enabled 2021-09-07 16:58:10 +02:00
globals.c include: Remove now-empty site.h 2019-10-30 16:17:04 +00:00
glyphcurs.c Let calloc handle multiplication 2015-04-21 16:57:07 -07:00
grabs.c xi: Implement grab support for new gesture event types 2021-05-30 13:26:32 +03:00
initatoms.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
inpututils.c Implement gesture processing logic 2021-05-30 13:26:42 +03:00
main.c dix: keep a ref to the rootCursor 2025-02-25 19:36:29 +01:00
Makefile.am dix: Implement internal gesture state handling 2021-05-30 13:26:39 +03:00
meson.build dix: Implement internal gesture state handling 2021-05-30 13:26:39 +03:00
pixmap.c fix for ZDI-11426 2020-07-31 14:51:23 +00:00
privates.c dix/privates.c: Avoid undefined behaviour after realloc() 2021-10-08 21:38:01 +03:00
property.c dix: ProcListProperties: skip unneeded work if numProps is 0 2024-10-11 00:18:05 +00:00
protocol.txt protocol.txt: add GLX req. 35 - SetClientInfo2ARB 2018-02-27 13:08:35 -05:00
ptrveloc.c dix: InitPredictableAccelerationScheme: avoid memory leak on failure 2024-10-11 00:18:05 +00:00
region.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
registry.c Build required portions of registry.c automatically [v2] 2014-09-18 15:29:29 -07:00
resource.c dix: HashResourceID: use unsigned integers for bit shifting 2024-10-11 00:18:05 +00:00
selection.c dix: Push UpdateCurrentTimeIf down out of the main loop 2016-05-04 10:58:01 -04:00
stubmain.c Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
swaprep.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
swapreq.c dix: Disallow GenericEvent in SendEvent request. 2017-06-19 11:58:50 +10:00
tables.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
touch.c xwayland: add -noTouchPointerEmulation 2021-09-06 21:19:46 +00:00
window.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00