Stefan Dirsch
f15e897874
U_CVE-2025-26594-0002-dix-keep-a-ref-to-the-rootCursor.patch * Use-after-free of the root cursor (CVE-2025-26594, bsc#1237427) - U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch * Buffer overflow in XkbVModMaskText() (CVE-2025-26595, bsc#1237429) - U_CVE-2025-26596-0001-xkb-Fix-computation-of-XkbSizeKeySyms.patch * Heap overflow in XkbWriteKeySyms() (CVE-2025-26596, bsc#1237430) - U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch * Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597, bsc#1237431) - U_CVE-2025-26598-0001-Xi-Fix-barrier-device-search.patch * Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598, bsc#1237432) - U_CVE-2025-26599-0001-composite-Handle-failure-to-redirect-in-compRedirect.patch U_CVE-2025-26599-0002-composite-initialize-border-clip-even-when-pixmap-al.patch * Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599, bsc#1237433) - U_CVE-2025-26600-0001-dix-Dequeue-pending-events-on-frozen-device-on-remov.patch * Use-after-free in PlayReleasedEvents() (CVE-2025-26600, bsc#1237434) - U_CVE-2025-26601-0001-sync-Do-not-let-sync-objects-uninitialized.patch U_CVE-2025-26601-0002-sync-Check-values-before-applying-changes.patch U_CVE-2025-26601-0003-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch U_CVE-2025-26601-0004-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch * Use-after-free in SyncInitTrigger() (CVE-2025-26601, bsc#1237435) OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=907
59 lines
2.2 KiB
Diff
59 lines
2.2 KiB
Diff
Index: xorg-server-1.12.1/Xext/sync.c
|
|
===================================================================
|
|
--- xorg-server-1.12.1.orig/Xext/sync.c
|
|
+++ xorg-server-1.12.1/Xext/sync.c
|
|
@@ -2615,9 +2615,43 @@ static XSyncValue *pIdleTimeValueGreater
|
|
static void
|
|
IdleTimeQueryValue(pointer pCounter, CARD64 * pValue_return)
|
|
{
|
|
- CARD32 idle = GetTimeInMillis() - lastDeviceEventTime.milliseconds;
|
|
+ static CARD32 previousLastDeviceEventTimeMilliseconds = 0;
|
|
+ CARD32 now = GetTimeInMillis();
|
|
+ CARD32 idle = now - lastDeviceEventTime.milliseconds;
|
|
+ CARD32 previousIdle = now - previousLastDeviceEventTimeMilliseconds;
|
|
+ SyncCounter *pIdleTimeCounter = (SyncCounter*)pCounter;
|
|
|
|
XSyncIntsToValue(pValue_return, idle, 0);
|
|
+ if (pCounter == NULL)
|
|
+ {
|
|
+ return;
|
|
+ }
|
|
+ if (previousLastDeviceEventTimeMilliseconds == 0)
|
|
+ {
|
|
+ /* initialize static var when this function is invoked the first time. */
|
|
+ previousLastDeviceEventTimeMilliseconds = lastDeviceEventTime.milliseconds;
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ if (previousLastDeviceEventTimeMilliseconds == lastDeviceEventTime.milliseconds)
|
|
+ {
|
|
+ /* no new user event, no need to change idle counter. */
|
|
+ return;
|
|
+ }
|
|
+ previousLastDeviceEventTimeMilliseconds = lastDeviceEventTime.milliseconds;
|
|
+
|
|
+ /*
|
|
+ * Some user event occured; now update idle counter with previous
|
|
+ * event time, so idle counter has the most up-to-date value with
|
|
+ * respect to previous user event (we need old and new counter
|
|
+ * value to compute if a transition occured). Recompute bracket
|
|
+ * values if this is system counter.
|
|
+ */
|
|
+
|
|
+ XSyncIntsToValue (&pIdleTimeCounter->value, previousIdle, 0);
|
|
+ if (IsSystemCounter(pIdleTimeCounter)) {
|
|
+ SyncComputeBracketValues(pIdleTimeCounter);
|
|
+ }
|
|
}
|
|
|
|
static void
|
|
@@ -2700,7 +2734,7 @@ IdleTimeWakeupHandler(pointer env, int r
|
|
if (!pIdleTimeValueLess && !pIdleTimeValueGreater)
|
|
return;
|
|
|
|
- IdleTimeQueryValue(NULL, &idle);
|
|
+ IdleTimeQueryValue(IdleTimeCounter, &idle);
|
|
|
|
if ((pIdleTimeValueGreater &&
|
|
XSyncValueGreaterOrEqual(idle, *pIdleTimeValueGreater)) ||
|