Accepting request 1076649 from home:iznogood:branches:X11:XOrg

- Update to version 23.1.1 (CVE-2023-1393):
  + This release contains the fix for CVE-2023-1393.
  + xkbUtils: use existing symbol names instead of deleted
    deprecated ones
  + glamor: Don't glFlush/ctx switch unless any work has been
    performed
  + xwayland:
    - Refactor xwl_present_for_each_frame_callback helper
    - Prevent nested xwl_present_for_each_frame_callback calls
  + composite: Fix use-after-free of the COW
- Drop U_xserver-composite-Fix-use-after-free-of-the-COW.patch:
  Fixed upstream.

OBS-URL: https://build.opensuse.org/request/show/1076649
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xwayland?expand=0&rev=50

U_xserver-composite-Fix-use-after-free-of-the-COW.patch

@@ -1,42 +0,0 @@
-From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001
-From: Olivier Fourdan <ofourdan@redhat.com>
-Date: Mon, 13 Mar 2023 11:08:47 +0100
-Subject: [PATCH xserver] composite: Fix use-after-free of the COW
-
-ZDI-CAN-19866/CVE-2023-1393
-
-If a client explicitly destroys the compositor overlay window (aka COW),
-we would leave a dangling pointer to that window in the CompScreen
-structure, which will trigger a use-after-free later.
-
-Make sure to clear the CompScreen pointer to the COW when the latter gets
-destroyed explicitly by the client.
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
-Reviewed-by: Adam Jackson <ajax@redhat.com>
----
- composite/compwindow.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/composite/compwindow.c b/composite/compwindow.c
-index 4e2494b86..b30da589e 100644
---- a/composite/compwindow.c
-+++ b/composite/compwindow.c
-@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
-     ret = (*pScreen->DestroyWindow) (pWin);
-     cs->DestroyWindow = pScreen->DestroyWindow;
-     pScreen->DestroyWindow = compDestroyWindow;
-+
-+    /* Did we just destroy the overlay window? */
-+    if (pWin == cs->pOverlayWin)
-+        cs->pOverlayWin = NULL;
-+
- /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
-     return ret;
- }
--- 
-2.40.0
-

xwayland-23.1.0.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:40e0a0c050446ac558ec0f54be4930ffef6be63c6ea980fb654f264ef065af9e
-size 1286056

xwayland-23.1.1.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:fb9461f5cb9fea5e07e91882311b0c88b43e8843b017ebac05eb5af69aa34c15
+size 1286460

xwayland.changes

@@ -1,3 +1,19 @@
+-------------------------------------------------------------------
+Sat Apr  1 11:35:04 UTC 2023 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 23.1.1 (CVE-2023-1393):
+  + This release contains the fix for CVE-2023-1393.
+  + xkbUtils: use existing symbol names instead of deleted
+    deprecated ones
+  + glamor: Don't glFlush/ctx switch unless any work has been
+    performed
+  + xwayland:
+    - Refactor xwl_present_for_each_frame_callback helper
+    - Prevent nested xwl_present_for_each_frame_callback calls
+  + composite: Fix use-after-free of the COW
+- Drop U_xserver-composite-Fix-use-after-free-of-the-COW.patch:
+  Fixed upstream.
+
 -------------------------------------------------------------------
 Thu Mar 23 12:32:18 UTC 2023 - Stefan Dirsch <sndirsch@suse.com>
 

xwayland.spec

@@ -24,7 +24,7 @@
 %endif
 
 Name:           xwayland
-Version:        23.1.0
+Version:        23.1.1
 Release:        0
 URL:            http://xorg.freedesktop.org
 Summary:        Xwayland Xserver
@@ -33,7 +33,6 @@ Group:          System/X11/Servers/XF86_4
 Source0:        %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz
 Source1:        %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig
 Source2:        xwayland.keyring
-Patch1209543:   U_xserver-composite-Fix-use-after-free-of-the-COW.patch
 
 BuildRequires:  meson
 BuildRequires:  ninja
@@ -66,7 +65,7 @@ BuildRequires:  pkgconfig(renderproto)
 BuildRequires:  pkgconfig(resourceproto)
 BuildRequires:  pkgconfig(scrnsaverproto)
 BuildRequires:  pkgconfig(videoproto)
-BuildRequires:  pkgconfig(wayland-client)
+BuildRequires:  pkgconfig(wayland-client) >= 1.21.0
 BuildRequires:  pkgconfig(wayland-protocols)
 %if 0%{?have_wayland_eglstream} == 1
 BuildRequires:  pkgconfig(wayland-eglstream-protocols)