Compare commits
1 Commits
| Author | SHA256 | Date | |
|---|---|---|---|
| 11c0d89165 |
@@ -0,0 +1,45 @@
|
||||
From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001
|
||||
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Date: Fri, 22 Mar 2024 18:51:45 -0700
|
||||
Subject: [PATCH 1/4] Xi: ProcXIGetSelectedEvents needs to use unswapped length
|
||||
to send reply
|
||||
|
||||
CVE-2024-31080
|
||||
|
||||
Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
|
||||
Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
|
||||
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
|
||||
---
|
||||
Xi/xiselectev.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
|
||||
index edcb8a0d3..ac1494987 100644
|
||||
--- a/Xi/xiselectev.c
|
||||
+++ b/Xi/xiselectev.c
|
||||
@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
|
||||
InputClientsPtr others = NULL;
|
||||
xXIEventMask *evmask = NULL;
|
||||
DeviceIntPtr dev;
|
||||
+ uint32_t length;
|
||||
|
||||
REQUEST(xXIGetSelectedEventsReq);
|
||||
REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
|
||||
@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
|
||||
}
|
||||
}
|
||||
|
||||
+ /* save the value before SRepXIGetSelectedEvents swaps it */
|
||||
+ length = reply.length;
|
||||
WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
|
||||
|
||||
if (reply.num_masks)
|
||||
- WriteToClient(client, reply.length * 4, buffer);
|
||||
+ WriteToClient(client, length * 4, buffer);
|
||||
|
||||
free(buffer);
|
||||
return Success;
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001
|
||||
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Date: Fri, 22 Mar 2024 18:56:27 -0700
|
||||
Subject: [PATCH 2/4] Xi: ProcXIPassiveGrabDevice needs to use unswapped length
|
||||
to send reply
|
||||
|
||||
CVE-2024-31081
|
||||
|
||||
Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
|
||||
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
|
||||
---
|
||||
Xi/xipassivegrab.c | 5 ++++-
|
||||
1 file changed, 4 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
|
||||
index c9ac2f855..896233bec 100644
|
||||
--- a/Xi/xipassivegrab.c
|
||||
+++ b/Xi/xipassivegrab.c
|
||||
@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
||||
GrabParameters param;
|
||||
void *tmp;
|
||||
int mask_len;
|
||||
+ uint32_t length;
|
||||
|
||||
REQUEST(xXIPassiveGrabDeviceReq);
|
||||
REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
|
||||
@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
||||
}
|
||||
}
|
||||
|
||||
+ /* save the value before SRepXIPassiveGrabDevice swaps it */
|
||||
+ length = rep.length;
|
||||
WriteReplyToClient(client, sizeof(rep), &rep);
|
||||
if (rep.num_modifiers)
|
||||
- WriteToClient(client, rep.length * 4, modifiers_failed);
|
||||
+ WriteToClient(client, length * 4, modifiers_failed);
|
||||
|
||||
out:
|
||||
free(modifiers_failed);
|
||||
--
|
||||
2.35.3
|
||||
|
||||
@@ -0,0 +1,110 @@
|
||||
From bdca6c3d1f5057eeb31609b1280fc93237b00c77 Mon Sep 17 00:00:00 2001
|
||||
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||
Date: Tue, 30 Jan 2024 13:13:35 +1000
|
||||
Subject: [PATCH 4/4] render: fix refcounting of glyphs during
|
||||
ProcRenderAddGlyphs
|
||||
|
||||
Previously, AllocateGlyph would return a new glyph with refcount=0 and a
|
||||
re-used glyph would end up not changing the refcount at all. The
|
||||
resulting glyph_new array would thus have multiple entries pointing to
|
||||
the same non-refcounted glyphs.
|
||||
|
||||
AddGlyph may free a glyph, resulting in a UAF when the same glyph
|
||||
pointer is then later used.
|
||||
|
||||
Fix this by returning a refcount of 1 for a new glyph and always
|
||||
incrementing the refcount for a re-used glyph, followed by dropping that
|
||||
refcount back down again when we're done with it.
|
||||
|
||||
CVE-2024-31083, ZDI-CAN-22880
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
|
||||
---
|
||||
render/glyph.c | 5 +++--
|
||||
render/glyphstr.h | 1 +
|
||||
render/render.c | 15 +++++++++++----
|
||||
3 files changed, 15 insertions(+), 6 deletions(-)
|
||||
|
||||
Index: xwayland-22.1.5/render/glyph.c
|
||||
===================================================================
|
||||
--- xwayland-22.1.5.orig/render/glyph.c
|
||||
+++ xwayland-22.1.5/render/glyph.c
|
||||
@@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph)
|
||||
}
|
||||
}
|
||||
|
||||
-static void
|
||||
+void
|
||||
FreeGlyph(GlyphPtr glyph, int format)
|
||||
{
|
||||
CheckDuplicates(&globalGlyphs[format], "FreeGlyph");
|
||||
+ BUG_RETURN(glyph->refcnt == 0);
|
||||
if (--glyph->refcnt == 0) {
|
||||
GlyphRefPtr gr;
|
||||
int i;
|
||||
@@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdept
|
||||
glyph = (GlyphPtr) malloc(size);
|
||||
if (!glyph)
|
||||
return 0;
|
||||
- glyph->refcnt = 0;
|
||||
+ glyph->refcnt = 1;
|
||||
glyph->size = size + sizeof(xGlyphInfo);
|
||||
glyph->info = *gi;
|
||||
dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH);
|
||||
Index: xwayland-22.1.5/render/glyphstr.h
|
||||
===================================================================
|
||||
--- xwayland-22.1.5.orig/render/glyphstr.h
|
||||
+++ xwayland-22.1.5/render/glyphstr.h
|
||||
@@ -109,6 +109,8 @@ extern GlyphPtr FindGlyph(GlyphSetPtr gl
|
||||
|
||||
extern GlyphPtr AllocateGlyph(xGlyphInfo * gi, int format);
|
||||
|
||||
+extern void FreeGlyph(GlyphPtr glyph, int format);
|
||||
+
|
||||
extern Bool
|
||||
ResizeGlyphSet(GlyphSetPtr glyphSet, CARD32 change);
|
||||
|
||||
Index: xwayland-22.1.5/render/render.c
|
||||
===================================================================
|
||||
--- xwayland-22.1.5.orig/render/render.c
|
||||
+++ xwayland-22.1.5/render/render.c
|
||||
@@ -1076,6 +1076,7 @@ ProcRenderAddGlyphs(ClientPtr client)
|
||||
|
||||
if (glyph_new->glyph && glyph_new->glyph != DeletedGlyph) {
|
||||
glyph_new->found = TRUE;
|
||||
+ ++glyph_new->glyph->refcnt;
|
||||
}
|
||||
else {
|
||||
GlyphPtr glyph;
|
||||
@@ -1168,8 +1169,10 @@ ProcRenderAddGlyphs(ClientPtr client)
|
||||
err = BadAlloc;
|
||||
goto bail;
|
||||
}
|
||||
- for (i = 0; i < nglyphs; i++)
|
||||
+ for (i = 0; i < nglyphs; i++) {
|
||||
AddGlyph(glyphSet, glyphs[i].glyph, glyphs[i].id);
|
||||
+ FreeGlyph(glyphs[i].glyph, glyphSet->fdepth);
|
||||
+ }
|
||||
|
||||
if (glyphsBase != glyphsLocal)
|
||||
free(glyphsBase);
|
||||
@@ -1179,9 +1182,13 @@ ProcRenderAddGlyphs(ClientPtr client)
|
||||
FreePicture((void *) pSrc, 0);
|
||||
if (pSrcPix)
|
||||
FreeScratchPixmapHeader(pSrcPix);
|
||||
- for (i = 0; i < nglyphs; i++)
|
||||
- if (glyphs[i].glyph && !glyphs[i].found)
|
||||
- free(glyphs[i].glyph);
|
||||
+ for (i = 0; i < nglyphs; i++) {
|
||||
+ if (glyphs[i].glyph) {
|
||||
+ --glyphs[i].glyph->refcnt;
|
||||
+ if (!glyphs[i].found)
|
||||
+ free(glyphs[i].glyph);
|
||||
+ }
|
||||
+ }
|
||||
if (glyphsBase != glyphsLocal)
|
||||
free(glyphsBase);
|
||||
return err;
|
||||
74
U_render-Avoid-possible-double-free-in-ProcRenderAddGl.patch
Normal file
74
U_render-Avoid-possible-double-free-in-ProcRenderAddGl.patch
Normal file
@@ -0,0 +1,74 @@
|
||||
From c3c2218ab797516e4d63a93a078d77c6ce872d03 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Fri, 5 Apr 2024 15:24:49 +0200
|
||||
Subject: [PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs()
|
||||
|
||||
ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and
|
||||
then frees it using FreeGlyph() to decrease the reference count, after
|
||||
AddGlyph() has increased it.
|
||||
|
||||
AddGlyph() however may chose to reuse an existing glyph if it's already
|
||||
in the glyphSet, and free the glyph that was given, in which case the
|
||||
caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an
|
||||
already freed glyph, as reported by ASan:
|
||||
|
||||
READ of size 4 thread T0
|
||||
#0 in FreeGlyph xserver/render/glyph.c:252
|
||||
#1 in ProcRenderAddGlyphs xserver/render/render.c:1174
|
||||
#2 in Dispatch xserver/dix/dispatch.c:546
|
||||
#3 in dix_main xserver/dix/main.c:271
|
||||
#4 in main xserver/dix/stubmain.c:34
|
||||
#5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
||||
#6 in __libc_start_main_impl ../csu/libc-start.c:360
|
||||
#7 (/usr/bin/Xwayland+0x44fe4)
|
||||
Address is located 0 bytes inside of 64-byte region
|
||||
freed by thread T0 here:
|
||||
#0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
|
||||
#1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538
|
||||
#2 in AddGlyph xserver/render/glyph.c:295
|
||||
#3 in ProcRenderAddGlyphs xserver/render/render.c:1173
|
||||
#4 in Dispatch xserver/dix/dispatch.c:546
|
||||
#5 in dix_main xserver/dix/main.c:271
|
||||
#6 in main xserver/dix/stubmain.c:34
|
||||
#7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
||||
previously allocated by thread T0 here:
|
||||
#0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69
|
||||
#1 in AllocateGlyph xserver/render/glyph.c:355
|
||||
#2 in ProcRenderAddGlyphs xserver/render/render.c:1085
|
||||
#3 in Dispatch xserver/dix/dispatch.c:546
|
||||
#4 in dix_main xserver/dix/main.c:271
|
||||
#5 in main xserver/dix/stubmain.c:34
|
||||
#6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
||||
SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph
|
||||
|
||||
To avoid that, make sure not to free the given glyph in AddGlyph().
|
||||
|
||||
v2: Simplify the test using the boolean returned from AddGlyph() (Michel)
|
||||
v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter)
|
||||
|
||||
Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs
|
||||
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
(cherry picked from commit 337d8d48b618d4fc0168a7b978be4c3447650b04)
|
||||
|
||||
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1478>
|
||||
---
|
||||
render/glyph.c | 2 --
|
||||
1 file changed, 2 deletions(-)
|
||||
|
||||
diff --git a/render/glyph.c b/render/glyph.c
|
||||
index d5fc5f3c9..f5069d42f 100644
|
||||
--- a/render/glyph.c
|
||||
+++ b/render/glyph.c
|
||||
@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id)
|
||||
gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature,
|
||||
TRUE, glyph->sha1);
|
||||
if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) {
|
||||
- FreeGlyphPicture(glyph);
|
||||
- dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH);
|
||||
glyph = gr->glyph;
|
||||
}
|
||||
else if (gr->glyph != glyph) {
|
||||
--
|
||||
2.35.3
|
||||
|
||||
BIN
xwayland-23.2.4.tar.xz
(Stored with Git LFS)
Normal file
BIN
xwayland-23.2.4.tar.xz
(Stored with Git LFS)
Normal file
Binary file not shown.
BIN
xwayland-23.2.4.tar.xz.sig
Normal file
BIN
xwayland-23.2.4.tar.xz.sig
Normal file
Binary file not shown.
BIN
xwayland-24.1.6.tar.xz
(Stored with Git LFS)
BIN
xwayland-24.1.6.tar.xz
(Stored with Git LFS)
Binary file not shown.
Binary file not shown.
250
xwayland.changes
250
xwayland.changes
@@ -1,244 +1,22 @@
|
||||
-------------------------------------------------------------------
|
||||
Tue Feb 25 22:20:48 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
|
||||
Wed Apr 10 13:50:16 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to version 24.1.6:
|
||||
* This release contains the fixes for the issues reported in
|
||||
today's security advisory: https://lists.x.org/archives/xorg-announce/2025-February/003584.html
|
||||
CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597,
|
||||
CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601.
|
||||
* Additionally, it reverts a recent Xkb change to fix an issue
|
||||
with gamescope.
|
||||
- Drop patches fixed upstream:
|
||||
* U_CVE-2025-26594-0001-Cursor-Refuse-to-free-the-root-cursor.patch
|
||||
* U_CVE-2025-26594-0002-dix-keep-a-ref-to-the-rootCursor.patch
|
||||
* U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch
|
||||
* U_CVE-2025-26596-0001-xkb-Fix-computation-of-XkbSizeKeySyms.patch
|
||||
* U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch
|
||||
* U_CVE-2025-26598-0001-Xi-Fix-barrier-device-search.patch
|
||||
* U_CVE-2025-26599-0001-composite-Handle-failure-to-redirect-in-compRedirect.patch
|
||||
* U_CVE-2025-26599-0002-composite-initialize-border-clip-even-when-pixmap-al.patch
|
||||
* U_CVE-2025-26600-0001-dix-Dequeue-pending-events-on-frozen-device-on-remov.patch
|
||||
* U_CVE-2025-26601-0001-sync-Do-not-let-sync-objects-uninitialized.patch
|
||||
* U_CVE-2025-26601-0002-sync-Check-values-before-applying-changes.patch
|
||||
* U_CVE-2025-26601-0003-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch
|
||||
* U_CVE-2025-26601-0004-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch
|
||||
- U_render-Avoid-possible-double-free-in-ProcRenderAddGl.patch
|
||||
* fixes regression for security fix for CVE-2024-31083 (bsc#1222312,
|
||||
boo#1222442, gitlab xserver issue #1659)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Feb 25 18:08:33 UTC 2025 - Stefan Dirsch <sndirsch@suse.com>
|
||||
Thu Apr 4 13:34:37 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- U_CVE-2025-26594-0001-Cursor-Refuse-to-free-the-root-cursor.patch
|
||||
U_CVE-2025-26594-0002-dix-keep-a-ref-to-the-rootCursor.patch
|
||||
* Use-after-free of the root cursor (CVE-2025-26594, bsc#1237427)
|
||||
- U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch
|
||||
* Buffer overflow in XkbVModMaskText() (CVE-2025-26595, bsc#1237429)
|
||||
- U_CVE-2025-26596-0001-xkb-Fix-computation-of-XkbSizeKeySyms.patch
|
||||
* Heap overflow in XkbWriteKeySyms() (CVE-2025-26596, bsc#1237430)
|
||||
- U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch
|
||||
* Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597, bsc#1237431)
|
||||
- U_CVE-2025-26598-0001-Xi-Fix-barrier-device-search.patch
|
||||
* Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598, bsc#1237432)
|
||||
- U_CVE-2025-26599-0001-composite-Handle-failure-to-redirect-in-compRedirect.patch
|
||||
U_CVE-2025-26599-0002-composite-initialize-border-clip-even-when-pixmap-al.patch
|
||||
* Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599, bsc#1237433)
|
||||
- U_CVE-2025-26600-0001-dix-Dequeue-pending-events-on-frozen-device-on-remov.patch
|
||||
* Use-after-free in PlayReleasedEvents() (CVE-2025-26600, bsc#1237434)
|
||||
- U_CVE-2025-26601-0001-sync-Do-not-let-sync-objects-uninitialized.patch
|
||||
U_CVE-2025-26601-0002-sync-Check-values-before-applying-changes.patch
|
||||
U_CVE-2025-26601-0003-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch
|
||||
U_CVE-2025-26601-0004-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch
|
||||
* Use-after-free in SyncInitTrigger() (CVE-2025-26601, bsc#1237435)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 6 11:54:10 UTC 2025 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to 24.1.5
|
||||
* os: NextDPMSTimeout: mark intentional fallthroughs in switch
|
||||
* Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL
|
||||
* render: avoid NULL pointer dereference if PictureFindVisual returns NULL
|
||||
* dix: fix button offset when generating DeviceButtonStateNotify events
|
||||
* dix: limit checks to MAX_VALUATORS when generating Xi events
|
||||
* dix-config.h: add HAVE_SOCKLEN_T definition
|
||||
* xwayland: copy repeat settings from the compositor map
|
||||
* xwayland: Don't run key behaviors and actions
|
||||
* xwayland/glamor/gbm: Don't close fence_fd after xwl_glamor_wait_fence
|
||||
* xwayland/present: Check allow_commits in xwl_present_flip
|
||||
* xwayland/glamor: Drop expecting_event bailing from xwl_drm_handle_device
|
||||
* xwayland: Always decrement expecting_event in xwl_output_create
|
||||
* xwayland/glamor: Clean-up GBM's screen private on failure
|
||||
* xwayland: Do not keep the cursor's pixmap around
|
||||
* xkb: Always use MAP_LENGTH keymap size
|
||||
* os/connection: Make sure partial is initialized
|
||||
* xwayland/glamor: Disable GLAMOR after GBM cleanup
|
||||
* glamor: return the result of gbm_format_for_depth
|
||||
* glamor: use gbm_format_for_depth instead of open-coding it
|
||||
* glamor: reject configs using unsupported rgbBits size
|
||||
* xwayland: prevent potential null pointer dereference
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Oct 29 19:29:21 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Security update 24.1.4
|
||||
This release addresses the following security issue
|
||||
* CVE-2024-9632: Heap-based buffer overflow privilege escalation
|
||||
in _XkbSetCompatMap (bsc#1231565)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Oct 3 21:35:10 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to bugfix release 24.1.3
|
||||
* dix: check for calloc() failure in Xi event conversion routines
|
||||
* dix: PolyText: fully initialize local_closure
|
||||
* dix: SetFontPath: don't set errorValue on Success
|
||||
* dix: enterleave.c: fix implicit fallthrough warnings
|
||||
* dix: CreateScratchGC: avoid dereference of pointer we just set to NULL
|
||||
* dix: InitPredictableAccelerationScheme: avoid memory leak on failure
|
||||
* dix: dixChangeWindowProperty: don't call memcpy if malloc failed
|
||||
* dix: ProcListProperties: skip unneeded work if numProps is 0
|
||||
* dix: HashResourceID: use unsigned integers for bit shifting
|
||||
* dix: GetPairedDevice: check if GetMaster returned NULL
|
||||
* dix: FindBestPixel: fix implicit fallthrough warning
|
||||
* CI: clone libdecor from fd.o instead of gnome.org
|
||||
* CI: update libdecor from 0.1.0 to 0.1.1
|
||||
* Don't crash if the client argv or argv[0] is NULL.
|
||||
* Return NULL in *cmdname if the client argv or argv[0] is NULL
|
||||
* xwayland: connect to the wl display before calling into EGL
|
||||
* xwayland: Report correct mode size when rootful
|
||||
* build: Move epoll dependency check
|
||||
* build: Add epoll to Xwayland for DragonFly and OpenBSD
|
||||
* build: Fix DRI3 on DragonFly and OpenBSD
|
||||
* os: Fix NULL pointer dereference
|
||||
* dix: don't push the XKB state to a non-existing master keyboard
|
||||
* Xi: when removing a master search for a disabled paired device
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Sep 24 11:24:48 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- added conflicts to patterns-wsl-tmpfiles as this patterns package
|
||||
creates a symlink from /tmp/.X11-unix to /mnt/wslg/.X11-unix and
|
||||
therefore prevents Xwayland from creating this needed directory
|
||||
(bsc#1230755)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Sat Aug 24 20:14:05 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to bugfix release 24.1.2
|
||||
* This release addresses several issues, including the first
|
||||
events being skipped with input emulation using libEI or a fix
|
||||
with rendering using the UYVY format with the X-Video extension
|
||||
using GLAMOR.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jul 11 13:46:12 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- added version specific requirements for dri3proto, presentproto
|
||||
and wayland-protocols
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jul 11 13:17:54 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- This supersedes the following patches
|
||||
* U_CVE-2024-31080-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch
|
||||
* U_CVE-2024-31081-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch
|
||||
* U_CVE-2024-31083-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch
|
||||
* U_render-Avoid-possible-double-free-in-ProcRenderAddGl.patch
|
||||
which fixed security issues
|
||||
* CVE-2024-31080 (bsc#1222309)
|
||||
* CVE-2024-31081 (bsc#1222310)
|
||||
* CVE-2024-31083 (bsc#1222312)
|
||||
and a regression due to a security fix for CVE-2024-31083 (bsc#1222312,
|
||||
boo#1222442, gitlab xserver issue #1659)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jul 11 11:43:22 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to bugfix release 24.1.1 for the current stable 24.1
|
||||
branch of Xwayland
|
||||
* xwayland: fix segment fault in `xwl_glamor_gbm_init_main_dev`
|
||||
* os: Explicitly include X11/Xmd.h for CARD32 definition to fix
|
||||
building on i686
|
||||
* present: On *BSD, epoll-shim is needed to emulate eventfd()
|
||||
* xwayland: Stop on first unmapped child
|
||||
* xwayland/window-buffers: Promote xwl_window_buffer
|
||||
* xwayland/window-buffers: Add xwl_window_buffer_release()
|
||||
* xwayland/glamor/gbm: Copy explicit sync code to GLAMOR/GBM
|
||||
* xwayland/window-buffers: Use synchronization from GLAMOR/GBM
|
||||
* xwayland/window-buffers: Do not always set syncpnts
|
||||
* xwayland/window-buffers: Move code to submit pixmaps
|
||||
* xwayland/window-buffers: Set syncpnts for all pixmaps
|
||||
* xwayland: Move xwl_window disposal to its own function
|
||||
* xwayland: Make sure we do not leak xwl_window on destroy
|
||||
* wayland/window-buffers: Move buffer disposal to its own function
|
||||
* xwayland/window-buffers: optionally force disposal
|
||||
* wayland: Force disposal of windows buffers for root on destroy
|
||||
* xwayland: Check for pointer in xwl_seat_leave_ptr()
|
||||
* xwayland: remove includedir from pkgconfig
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 5 11:27:13 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- disable DPMS on sle15 due to missing proto package
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 15 17:19:45 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to feature release 24.1.0
|
||||
* This fixes a couple of regressions introduced in the previous release
|
||||
candidate versions along with a fix for XTEST emulation with EI.
|
||||
+ xwayland: Send ei_device_frame on device_scroll_discrete
|
||||
+ xwayland: Restore the ResizeWindow handler
|
||||
+ xwayland: Handle rootful resize in ResizeWindow
|
||||
+ xwayland: Move XRandR emulation to the ResizeWindow hook
|
||||
+ xwayland: Use correct xwl_window lookup function in xwl_set_shape
|
||||
- eglstreams has been dropped
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed May 15 17:14:44 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to bug fix relesae 23.2.7
|
||||
* m4: drop autoconf leftovers
|
||||
* xwayland: Send ei_device_frame on device_scroll_discrete
|
||||
* xwayland: Call drmFreeDevice for dma-buf default feedback
|
||||
* xwayland: Use drmDevicesEqual in xwl_dmabuf_feedback_tranche_done
|
||||
* dri3: Free formats in cache_formats_and_modifiers
|
||||
* xwayland/glamor: Handle depth 15 in gbm_format_for_depth
|
||||
* Revert "xwayland/glamor: Avoid implicit redirection with depth 32 parent windows"
|
||||
* xwayland: Check for outputs before lease devices
|
||||
* xwayland: Do not remove output on withdraw if leased
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Apr 9 13:30:07 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Update to 23.2.6
|
||||
* This is a quick bug fix release to address a regression
|
||||
introduced by the fix for CVE-2024-31083 in xwayland-23.2.5.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Apr 4 08:07:32 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
- Security update 23.2.5
|
||||
This release contains the 3 security fixes that actually apply to
|
||||
Xwayland reported in the security advisory of April 3rd 2024
|
||||
* CVE-2024-31080
|
||||
* CVE-2024-31081
|
||||
* CVE-2024-31083
|
||||
Additionally, it also contains a couple of other fixes, a copy/paste
|
||||
error in the DeviceStateNotify event and a fix to enable buttons with
|
||||
pointer gestures for backward compatibility with legacy X11 clients.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 15 17:13:03 UTC 2024 - Joan Torres <joan.torres@suse.com>
|
||||
|
||||
- Don't provide xorg-x11-server-source
|
||||
* xwayland sources are not meant for a generic server.
|
||||
* https://github.com/TigerVNC/tigervnc/issues/1728
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Feb 15 10:41:13 UTC 2024 - Joan Torres <joan.torres@suse.com>
|
||||
|
||||
- Provide xorg-x11-server-source from xwayland
|
||||
* xwayland will be more updated than xorg-x11-server, so the server sources
|
||||
will be more updated too if are provided by xwayland.
|
||||
* Fixes bsc#1219892.
|
||||
- U_CVE-2024-31080-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch
|
||||
* Xi: ProcXIGetSelectedEvents needs to use unswapped length
|
||||
(CVE-2024-31080, bsc#1222309)
|
||||
- U_CVE-2024-31081-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch
|
||||
* Xi: ProcXIPassiveGrabDevice needs to use unswapped length to send reply
|
||||
(CVE-2024-31081, bsc#1222310)
|
||||
- U_CVE-2024-31083-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch
|
||||
* render: fix refcounting of glyphs during ProcRenderAddGlyphs
|
||||
(CVE-2024-31083, bsc#1222312)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 17 10:20:50 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# spec file for package xwayland
|
||||
#
|
||||
# Copyright (c) 2025 SUSE LLC
|
||||
# Copyright (c) 2024 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
@@ -16,13 +16,15 @@
|
||||
#
|
||||
|
||||
|
||||
%define have_wayland_eglstream 1
|
||||
|
||||
#Compat macro for new _fillupdir macro introduced in Nov 2017
|
||||
%if ! %{defined _fillupdir}
|
||||
%define _fillupdir /var/adm/fillup-templates
|
||||
%endif
|
||||
|
||||
Name: xwayland
|
||||
Version: 24.1.6
|
||||
Version: 23.2.4
|
||||
Release: 0
|
||||
URL: http://xorg.freedesktop.org
|
||||
Summary: Xwayland Xserver
|
||||
@@ -31,6 +33,10 @@ Group: System/X11/Servers/XF86_4
|
||||
Source0: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz
|
||||
Source1: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig
|
||||
Source2: xwayland.keyring
|
||||
Patch1222309: U_CVE-2024-31080-Xi-ProcXIGetSelectedEvents-needs-to-use-unswapped-le.patch
|
||||
Patch1222310: U_CVE-2024-31081-Xi-ProcXIPassiveGrabDevice-needs-to-use-unswapped-le.patch
|
||||
Patch1222312: U_CVE-2024-31083-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch
|
||||
Patch1222442: U_render-Avoid-possible-double-free-in-ProcRenderAddGl.patch
|
||||
BuildRequires: meson
|
||||
BuildRequires: ninja
|
||||
BuildRequires: pkgconfig
|
||||
@@ -39,7 +45,7 @@ BuildRequires: pkgconfig(bigreqsproto)
|
||||
BuildRequires: pkgconfig(compositeproto)
|
||||
BuildRequires: pkgconfig(damageproto)
|
||||
BuildRequires: pkgconfig(dri)
|
||||
BuildRequires: pkgconfig(dri3proto) >= 1.4
|
||||
BuildRequires: pkgconfig(dri3proto)
|
||||
BuildRequires: pkgconfig(epoxy)
|
||||
BuildRequires: pkgconfig(fixesproto)
|
||||
BuildRequires: pkgconfig(fontsproto)
|
||||
@@ -61,7 +67,7 @@ BuildRequires: pkgconfig(libtirpc)
|
||||
BuildRequires: pkgconfig(libxcvt)
|
||||
BuildRequires: pkgconfig(openssl)
|
||||
BuildRequires: pkgconfig(pixman-1)
|
||||
BuildRequires: pkgconfig(presentproto) >= 1.4
|
||||
BuildRequires: pkgconfig(presentproto)
|
||||
BuildRequires: pkgconfig(randrproto)
|
||||
BuildRequires: pkgconfig(recordproto)
|
||||
BuildRequires: pkgconfig(renderproto)
|
||||
@@ -69,7 +75,10 @@ BuildRequires: pkgconfig(resourceproto)
|
||||
BuildRequires: pkgconfig(scrnsaverproto)
|
||||
BuildRequires: pkgconfig(videoproto)
|
||||
BuildRequires: pkgconfig(wayland-client) >= 1.21.0
|
||||
BuildRequires: pkgconfig(wayland-protocols) >= 1.34
|
||||
BuildRequires: pkgconfig(wayland-protocols)
|
||||
%if 0%{?have_wayland_eglstream} == 1
|
||||
BuildRequires: pkgconfig(wayland-eglstream-protocols)
|
||||
%endif
|
||||
BuildRequires: pkgconfig(xau)
|
||||
BuildRequires: pkgconfig(xcb)
|
||||
BuildRequires: pkgconfig(xcb-damage)
|
||||
@@ -100,7 +109,6 @@ Requires: libpixman-1-0
|
||||
%endif
|
||||
Obsoletes: xorg-x11-server-wayland < %{version}
|
||||
Provides: xorg-x11-server-wayland = %{version}
|
||||
Conflicts: patterns-wsl-tmpfiles
|
||||
|
||||
%description
|
||||
This package contains the Xserver running on the Wayland Display Server.
|
||||
@@ -127,6 +135,9 @@ This package contains the Xwayland Server development files.
|
||||
%build
|
||||
%{meson} \
|
||||
-Dglamor=true \
|
||||
%if 0%{?have_wayland_eglstream} == 1
|
||||
-Dxwayland_eglstream=true \
|
||||
%endif
|
||||
-Dxvfb=true \
|
||||
-Dglx=true \
|
||||
-Dxdmcp=true \
|
||||
@@ -140,9 +151,7 @@ This package contains the Xwayland Server development files.
|
||||
-Dlisten_tcp=false \
|
||||
-Dlisten_unix=true \
|
||||
-Dlisten_local=true \
|
||||
%if 0%{?suse_version} < 1550
|
||||
-Ddpms=false \
|
||||
%endif
|
||||
-Ddpms=true \
|
||||
-Dxf86bigfont=true \
|
||||
-Dscreensaver=true \
|
||||
-Dxres=true \
|
||||
|
||||
Reference in New Issue
Block a user