Sync changes to SLFO-1.2 branch

OBS-URL: https://build.opensuse.org/request/show/1287671
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/xwayland?expand=0&rev=43

U_CVE-2025-49175-render-Avoid-0-or-less-animated-cursors.patch

@@ -0,0 +1,83 @@
+From 8c5f521c0492941794301afe107a2ee5030128af Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Fri, 28 Mar 2025 09:43:52 +0100
+Subject: [PATCH xserver] render: Avoid 0 or less animated cursors
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Animated cursors use a series of cursors that the client can set.
+
+By default, the Xserver assumes at least one cursor is specified
+while a client may actually pass no cursor at all.
+
+That causes an out-of-bound read creating the animated cursor and a
+crash of the Xserver:
+
+ | Invalid read of size 8
+ |    at 0x5323F4: AnimCursorCreate (animcur.c:325)
+ |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
+ |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
+ |    by 0x4A1E9D: Dispatch (dispatch.c:560)
+ |    by 0x4B0169: dix_main (main.c:284)
+ |    by 0x4287F5: main (stubmain.c:34)
+ |  Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
+ |    at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
+ |    by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
+ |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
+ |    by 0x4A1E9D: Dispatch (dispatch.c:560)
+ |    by 0x4B0169: dix_main (main.c:284)
+ |    by 0x4287F5: main (stubmain.c:34)
+ |
+ | Invalid read of size 2
+ |    at 0x5323F7: AnimCursorCreate (animcur.c:325)
+ |    by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
+ |    by 0x52DC80: ProcRenderDispatch (render.c:1999)
+ |    by 0x4A1E9D: Dispatch (dispatch.c:560)
+ |    by 0x4B0169: dix_main (main.c:284)
+ |    by 0x4287F5: main (stubmain.c:34)
+ |  Address 0x8 is not stack'd, malloc'd or (recently) free'd
+
+To avoid the issue, check the number of cursors specified and return a
+BadValue error in both the proc handler (early) and the animated cursor
+creation (as this is a public function) if there is 0 or less cursor.
+
+CVE-2025-49175
+
+This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
+reported by Julian Suleder via ERNW Vulnerability Disclosure.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: José Expósito <jexposit@redhat.com>
+---
+ render/animcur.c | 3 +++
+ render/render.c  | 2 ++
+ 2 files changed, 5 insertions(+)
+
+Index: xwayland-24.1.6/render/animcur.c
+===================================================================
+--- xwayland-24.1.6.orig/render/animcur.c
++++ xwayland-24.1.6/render/animcur.c
+@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CAR
+     int rc = BadAlloc, i;
+     AnimCurPtr ac;
+ 
++    if (ncursor <= 0)
++        return BadValue;
++
+     for (i = 0; i < screenInfo.numScreens; i++)
+         if (!GetAnimCurScreen(screenInfo.screens[i]))
+             return BadImplementation;
+Index: xwayland-24.1.6/render/render.c
+===================================================================
+--- xwayland-24.1.6.orig/render/render.c
++++ xwayland-24.1.6/render/render.c
+@@ -1795,6 +1795,8 @@ ProcRenderCreateAnimCursor(ClientPtr cli
+     ncursor =
+         (client->req_len -
+          (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1;
++    if (ncursor <= 0)
++        return BadValue;
+     cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32));
+     if (!cursors)
+         return BadAlloc;

U_CVE-2025-49176-os-Check-for-integer-overflow-on-BigRequest-length.patch

@@ -0,0 +1,30 @@
+From 4fc4d76b2c7aaed61ed2653f997783a3714c4fe1 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 18 Jun 2025 08:39:02 +0200
+Subject: [PATCH] os: Check for integer overflow on BigRequest length
+
+Check for another possible integer overflow once we get a complete xReq
+with BigRequest.
+
+Related to CVE-2025-49176
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Suggested-by: Peter Harris <pharris2@rocketsoftware.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2028>
+---
+ os/io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+Index: xorg-server-21.1.15/os/io.c
+===================================================================
+--- xorg-server-21.1.15.orig/os/io.c
++++ xorg-server-21.1.15/os/io.c
+@@ -395,6 +395,8 @@ ReadRequestFromClient(ClientPtr client)
+                     needed = get_big_req_len(request, client);
+             }
+             client->req_len = needed;
++            if (needed > MAXINT >> 2)
++                return -(BadLength);
+             needed <<= 2;
+         }
+         if (gotnow < needed) {

U_CVE-2025-49176-os-Do-not-overflow-the-integer-size-with-BigRequest.patch

@@ -0,0 +1,84 @@
+From d725dfd9455ab1e5393ec46f1cd725e3a784b9cc Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 7 Apr 2025 16:13:34 +0200
+Subject: [PATCH xserver] os: Do not overflow the integer size with BigRequest
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The BigRequest extension allows request larger than the 16-bit length
+limit.
+
+It uses integers for the request length and checks for the size not to
+exceed the maxBigRequestSize limit, but does so after translating the
+length to integer by multiplying the given size in bytes by 4.
+
+In doing so, it might overflow the integer size limit before actually
+checking for the overflow, defeating the purpose of the test.
+
+To avoid the issue, make sure to check that the request size does not
+overflow the maxBigRequestSize limit prior to any conversion.
+
+The caller Dispatch() function however expects the return value to be in
+bytes, so we cannot just return the converted value in case of error, as
+that would also overflow the integer size.
+
+To preserve the existing API, we use a negative value for the X11 error
+code BadLength as the function only return positive values, 0 or -1 and
+update the caller Dispatch() function to take that case into account to
+return the error code to the offending client.
+
+CVE-2025-49176
+
+This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
+reported by Julian Suleder via ERNW Vulnerability Disclosure.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+---
+ dix/dispatch.c | 9 +++++----
+ os/io.c        | 4 ++++
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+Index: xwayland-24.1.6/dix/dispatch.c
+===================================================================
+--- xwayland-24.1.6.orig/dix/dispatch.c
++++ xwayland-24.1.6/dix/dispatch.c
+@@ -517,9 +517,10 @@ Dispatch(void)
+ 
+                 /* now, finally, deal with client requests */
+                 result = ReadRequestFromClient(client);
+-                if (result <= 0) {
+-                    if (result < 0)
+-                        CloseDownClient(client);
++                if (result == 0)
++                    break;
++                else if (result == -1) {
++                    CloseDownClient(client);
+                     break;
+                 }
+ 
+@@ -540,7 +541,7 @@ Dispatch(void)
+                                           client->index,
+                                           client->requestBuffer);
+ #endif
+-                if (result > (maxBigRequestSize << 2))
++                if (result < 0 || result > (maxBigRequestSize << 2))
+                     result = BadLength;
+                 else {
+                     result = XaceHookDispatch(client, client->majorOp);
+Index: xwayland-24.1.6/os/io.c
+===================================================================
+--- xwayland-24.1.6.orig/os/io.c
++++ xwayland-24.1.6/os/io.c
+@@ -299,6 +299,10 @@ ReadRequestFromClient(ClientPtr client)
+                 needed = get_big_req_len(request, client);
+         }
+         client->req_len = needed;
++        if (needed > MAXINT >> 2) {
++            /* Check for potential integer overflow */
++            return -(BadLength);
++        }
+         needed <<= 2;           /* needed is in bytes now */
+     }
+     if (gotnow < needed) {

U_CVE-2025-49177-xfixes-Check-request-length-for-SetClientDisconnectM.patch

@@ -0,0 +1,47 @@
+From eb1c0386535c5a6451cbf21ca351087ebfafb025 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 28 Apr 2025 10:05:36 +0200
+Subject: [PATCH xserver] xfixes: Check request length for
+ SetClientDisconnectMode
+
+The handler of XFixesSetClientDisconnectMode does not check the client
+request length.
+
+A client could send a shorter request and read data from a former
+request.
+
+Fix the issue by checking the request size matches.
+
+CVE-2025-49177
+
+This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
+reported by Julian Suleder via ERNW Vulnerability Disclosure.
+
+Fixes: e167299f6 - xfixes: Add ClientDisconnectMode
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ xfixes/disconnect.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Index: xwayland-24.1.6/xfixes/disconnect.c
+===================================================================
+--- xwayland-24.1.6.orig/xfixes/disconnect.c
++++ xwayland-24.1.6/xfixes/disconnect.c
+@@ -69,6 +69,7 @@ ProcXFixesSetClientDisconnectMode(Client
+     ClientDisconnectPtr pDisconnect = GetClientDisconnect(client);
+ 
+     REQUEST(xXFixesSetClientDisconnectModeReq);
++    REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
+ 
+     pDisconnect->disconnect_mode = stuff->disconnect_mode;
+ 
+@@ -82,7 +83,7 @@ SProcXFixesSetClientDisconnectMode(Clien
+ 
+     swaps(&stuff->length);
+ 
+-    REQUEST_AT_LEAST_SIZE(xXFixesSetClientDisconnectModeReq);
++    REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq);
+ 
+     swapl(&stuff->disconnect_mode);
+ 

U_CVE-2025-49178-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch

@@ -0,0 +1,42 @@
+From 247f1622fa8d48783b4ed5d5154791c171f00e18 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 28 Apr 2025 10:46:03 +0200
+Subject: [PATCH xserver] os: Account for bytes to ignore when sharing input
+ buffer
+
+When reading requests from the clients, the input buffer might be shared
+and used between different clients.
+
+If a given client sends a full request with non-zero bytes to ignore,
+the bytes to ignore may still be non-zero even though the request is
+full, in which case the buffer could be shared with another client who's
+request will not be processed because of those bytes to ignore, leading
+to a possible hang of the other client request.
+
+To avoid the issue, make sure we have zero bytes to ignore left in the
+input request when sharing the input buffer with another client.
+
+CVE-2025-49178
+
+This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
+reported by Julian Suleder via ERNW Vulnerability Disclosure.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ os/io.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+Index: xwayland-24.1.6/os/io.c
+===================================================================
+--- xwayland-24.1.6.orig/os/io.c
++++ xwayland-24.1.6/os/io.c
+@@ -445,7 +445,7 @@ ReadRequestFromClient(ClientPtr client)
+      */
+ 
+     gotnow -= needed;
+-    if (!gotnow)
++    if (!gotnow && !oci->ignoreBytes)
+         AvailableInput = oc;
+     if (move_header) {
+         if (client->req_len < bytes_to_int32(sizeof(xBigReq) - sizeof(xReq))) {

U_CVE-2025-49179-record-Check-for-overflow-in-RecordSanityCheckRegist.patch

@@ -0,0 +1,58 @@
+From 244101ac9d4c6963416cfc74f2174d440f1cb4b6 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 28 Apr 2025 11:47:15 +0200
+Subject: [PATCH xserver] record: Check for overflow in
+ RecordSanityCheckRegisterClients()
+
+The RecordSanityCheckRegisterClients() checks for the request length,
+but does not check for integer overflow.
+
+A client might send a very large value for either the number of clients
+or the number of protocol ranges that will cause an integer overflow in
+the request length computation, defeating the check for request length.
+
+To avoid the issue, explicitly check the number of clients against the
+limit of clients (which is much lower than an maximum integer value) and
+the number of protocol ranges (multiplied by the record length) do not
+exceed the maximum integer value.
+
+This way, we ensure that the final computation for the request length
+will not overflow the maximum integer limit.
+
+CVE-2025-49179
+
+This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
+reported by Julian Suleder via ERNW Vulnerability Disclosure.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ record/record.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+Index: xwayland-24.1.6/record/record.c
+===================================================================
+--- xwayland-24.1.6.orig/record/record.c
++++ xwayland-24.1.6/record/record.c
+@@ -37,6 +37,7 @@ and Jim Haggerty of Metheus.
+ #endif
+ 
+ #include "dix/eventconvert.h"
++#include "os/osdep.h"
+ 
+ #include "dixstruct.h"
+ #include "extnsionst.h"
+@@ -1299,6 +1300,13 @@ RecordSanityCheckRegisterClients(RecordC
+     int i;
+     XID recordingClient;
+ 
++    /* LIMITCLIENTS is 2048 at max, way less that MAXINT */
++    if (stuff->nClients > LIMITCLIENTS)
++        return BadValue;
++
++    if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange))
++        return BadValue;
++
+     if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) !=
+         4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges)
+         return BadLength;

U_CVE-2025-49180-randr-Check-for-overflow-in-RRChangeProviderProperty.patch

@@ -0,0 +1,37 @@
+From ca652633c02ceb054143207d71d24a8123733c27 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Tue, 20 May 2025 15:18:19 +0200
+Subject: [PATCH xserver 1/2] randr: Check for overflow in
+ RRChangeProviderProperty()
+
+A client might send a request causing an integer overflow when computing
+the total size to allocate in RRChangeProviderProperty().
+
+To avoid the issue, check that total length in bytes won't exceed the
+maximum integer value.
+
+CVE-2025-49180
+
+This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
+reported by Julian Suleder via ERNW Vulnerability Disclosure.
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+---
+ randr/rrproviderproperty.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+Index: xwayland-24.1.6/randr/rrproviderproperty.c
+===================================================================
+--- xwayland-24.1.6.orig/randr/rrproviderproperty.c
++++ xwayland-24.1.6/randr/rrproviderproperty.c
+@@ -179,7 +179,8 @@ RRChangeProviderProperty(RRProviderPtr p
+ 
+     if (mode == PropModeReplace || len > 0) {
+         void *new_data = NULL, *old_data = NULL;
+-
++        if (total_len > MAXINT / size_in_bytes)
++            return BadValue;
+         total_size = total_len * size_in_bytes;
+         new_value.data = (void *) malloc(total_size);
+         if (!new_value.data && total_size) {

xwayland-24.1.2.tar.xz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:141eb76e7e422a3661c08782c70be40931084755042c04506e0d97dd463ef7d2
-size 1302068

xwayland.changes

@@ -1,3 +1,151 @@
+-------------------------------------------------------------------
+Sun Jun 22 12:27:52 UTC 2025 - Stefan Dirsch <sndirsch@suse.com>
+
+- U_CVE-2025-49176-os-Check-for-integer-overflow-on-BigRequest-length.patch
+  * additional fix for CVE-2025-49176
+
+-------------------------------------------------------------------
+Thu Jun  5 12:55:30 UTC 2025 - Stefan Dirsch <sndirsch@suse.com>
+
+- U_CVE-2025-49175-render-Avoid-0-or-less-animated-cursors.patch
+  * Out-of-bounds access in X Rendering extension (Animated cursors)
+    (CVE-2025-49175, bsc#1244082)
+- U_CVE-2025-49176-os-Do-not-overflow-the-integer-size-with-BigRequest.patch
+  * Integer overflow in Big Requests Extension
+    (CVE-2025-49176, bsc#1244084)
+- U_CVE-2025-49177-xfixes-Check-request-length-for-SetClientDisconnectM.patch
+  * Data leak in XFIXES Extension 6 (XFixesSetClientDisconnectMode)
+    (CVE-2025-49177, bsc#1244085)
+- U_CVE-2025-49178-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch
+  * Unprocessed client request via bytes to ignore 
+    (CVE-2025-49178, bsc#1244087)
+- U_CVE-2025-49179-record-Check-for-overflow-in-RecordSanityCheckRegist.patch
+  * Integer overflow in X Record extension
+    (CVE-2025-49179, bsc#1244089)
+- U_CVE-2025-49180-randr-Check-for-overflow-in-RRChangeProviderProperty.patch
+  * Integer overflow in RandR extension (RRChangeProviderProperty)
+    (CVE-2025-49180, bsc#1244090)
+
+-------------------------------------------------------------------
+Tue Feb 25 22:20:48 UTC 2025 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 24.1.6:
+  * This release contains the fixes for the issues reported in
+    today's security advisory: https://lists.x.org/archives/xorg-announce/2025-February/003584.html
+    CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597,
+    CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601.
+  * Additionally, it reverts a recent Xkb change to fix an issue
+    with gamescope.
+- Drop patches fixed upstream:
+  * U_CVE-2025-26594-0001-Cursor-Refuse-to-free-the-root-cursor.patch
+  * U_CVE-2025-26594-0002-dix-keep-a-ref-to-the-rootCursor.patch
+  * U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch
+  * U_CVE-2025-26596-0001-xkb-Fix-computation-of-XkbSizeKeySyms.patch
+  * U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch
+  * U_CVE-2025-26598-0001-Xi-Fix-barrier-device-search.patch
+  * U_CVE-2025-26599-0001-composite-Handle-failure-to-redirect-in-compRedirect.patch
+  * U_CVE-2025-26599-0002-composite-initialize-border-clip-even-when-pixmap-al.patch
+  * U_CVE-2025-26600-0001-dix-Dequeue-pending-events-on-frozen-device-on-remov.patch
+  * U_CVE-2025-26601-0001-sync-Do-not-let-sync-objects-uninitialized.patch
+  * U_CVE-2025-26601-0002-sync-Check-values-before-applying-changes.patch
+  * U_CVE-2025-26601-0003-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch
+  * U_CVE-2025-26601-0004-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch
+
+-------------------------------------------------------------------
+Tue Feb 25 18:08:33 UTC 2025 - Stefan Dirsch <sndirsch@suse.com>
+
+- U_CVE-2025-26594-0001-Cursor-Refuse-to-free-the-root-cursor.patch
+  U_CVE-2025-26594-0002-dix-keep-a-ref-to-the-rootCursor.patch
+  * Use-after-free of the root cursor (CVE-2025-26594, bsc#1237427)
+- U_CVE-2025-26595-0001-xkb-Fix-buffer-overflow-in-XkbVModMaskText.patch
+  * Buffer overflow in XkbVModMaskText() (CVE-2025-26595, bsc#1237429)
+- U_CVE-2025-26596-0001-xkb-Fix-computation-of-XkbSizeKeySyms.patch
+  * Heap overflow in XkbWriteKeySyms() (CVE-2025-26596, bsc#1237430)
+- U_CVE-2025-26597-0001-xkb-Fix-buffer-overflow-in-XkbChangeTypesOfKey.patch
+  * Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597, bsc#1237431)
+- U_CVE-2025-26598-0001-Xi-Fix-barrier-device-search.patch
+  * Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598, bsc#1237432)
+- U_CVE-2025-26599-0001-composite-Handle-failure-to-redirect-in-compRedirect.patch
+  U_CVE-2025-26599-0002-composite-initialize-border-clip-even-when-pixmap-al.patch
+  * Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599, bsc#1237433)
+- U_CVE-2025-26600-0001-dix-Dequeue-pending-events-on-frozen-device-on-remov.patch
+  * Use-after-free in PlayReleasedEvents() (CVE-2025-26600, bsc#1237434)
+- U_CVE-2025-26601-0001-sync-Do-not-let-sync-objects-uninitialized.patch
+  U_CVE-2025-26601-0002-sync-Check-values-before-applying-changes.patch
+  U_CVE-2025-26601-0003-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch
+  U_CVE-2025-26601-0004-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch
+  * Use-after-free in SyncInitTrigger() (CVE-2025-26601, bsc#1237435)
+
+-------------------------------------------------------------------
+Thu Feb  6 11:54:10 UTC 2025 - Stefan Dirsch <sndirsch@suse.com>
+
+- Update to 24.1.5
+  * os: NextDPMSTimeout: mark intentional fallthroughs in switch
+  * Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL
+  * render: avoid NULL pointer dereference if PictureFindVisual returns NULL
+  * dix: fix button offset when generating DeviceButtonStateNotify events
+  * dix: limit checks to MAX_VALUATORS when generating Xi events
+  * dix-config.h: add HAVE_SOCKLEN_T definition
+  * xwayland: copy repeat settings from the compositor map
+  * xwayland: Don't run key behaviors and actions
+  * xwayland/glamor/gbm: Don't close fence_fd after xwl_glamor_wait_fence
+  * xwayland/present: Check allow_commits in xwl_present_flip
+  * xwayland/glamor: Drop expecting_event bailing from xwl_drm_handle_device
+  * xwayland: Always decrement expecting_event in xwl_output_create
+  * xwayland/glamor: Clean-up GBM's screen private on failure
+  * xwayland: Do not keep the cursor's pixmap around
+  * xkb: Always use MAP_LENGTH keymap size
+  * os/connection: Make sure partial is initialized
+  * xwayland/glamor: Disable GLAMOR after GBM cleanup
+  * glamor: return the result of gbm_format_for_depth
+  * glamor: use gbm_format_for_depth instead of open-coding it
+  * glamor: reject configs using unsupported rgbBits size
+  * xwayland: prevent potential null pointer dereference
+
+-------------------------------------------------------------------
+Tue Oct 29 19:29:21 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
+
+- Security update 24.1.4
+  This release addresses the following security issue
+  * CVE-2024-9632: Heap-based buffer overflow privilege escalation
+    in _XkbSetCompatMap (bsc#1231565)
+
+-------------------------------------------------------------------
+Thu Oct  3 21:35:10 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
+
+- Update to bugfix release 24.1.3
+  * dix: check for calloc() failure in Xi event conversion routines
+  * dix: PolyText: fully initialize local_closure
+  * dix: SetFontPath: don't set errorValue on Success
+  * dix: enterleave.c: fix implicit fallthrough warnings
+  * dix: CreateScratchGC: avoid dereference of pointer we just set to NULL
+  * dix: InitPredictableAccelerationScheme: avoid memory leak on failure
+  * dix: dixChangeWindowProperty: don't call memcpy if malloc failed
+  * dix: ProcListProperties: skip unneeded work if numProps is 0
+  * dix: HashResourceID: use unsigned integers for bit shifting
+  * dix: GetPairedDevice: check if GetMaster returned NULL
+  * dix: FindBestPixel: fix implicit fallthrough warning
+  * CI: clone libdecor from fd.o instead of gnome.org
+  * CI: update libdecor from 0.1.0 to 0.1.1
+  * Don't crash if the client argv or argv[0] is NULL.
+  * Return NULL in *cmdname if the client argv or argv[0] is NULL
+  * xwayland: connect to the wl display before calling into EGL
+  * xwayland: Report correct mode size when rootful
+  * build: Move epoll dependency check
+  * build: Add epoll to Xwayland for DragonFly and OpenBSD
+  * build: Fix DRI3 on DragonFly and OpenBSD
+  * os: Fix NULL pointer dereference
+  * dix: don't push the XKB state to a non-existing master keyboard
+  * Xi: when removing a master search for a disabled paired device
+
+-------------------------------------------------------------------
+Tue Sep 24 11:24:48 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
+
+- added conflicts to patterns-wsl-tmpfiles as this patterns package
+  creates a symlink from /tmp/.X11-unix to /mnt/wslg/.X11-unix and
+  therefore prevents Xwayland from creating this needed directory
+  (bsc#1230755)
+
 -------------------------------------------------------------------
 Sat Aug 24 20:14:05 UTC 2024 - Stefan Dirsch <sndirsch@suse.com>
 

xwayland.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package xwayland
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -22,7 +22,7 @@
 %endif
 
 Name:           xwayland
-Version:        24.1.2
+Version:        24.1.6
 Release:        0
 URL:            http://xorg.freedesktop.org
 Summary:        Xwayland Xserver
@@ -31,6 +31,13 @@ Group:          System/X11/Servers/XF86_4
 Source0:        %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz
 Source1:        %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig
 Source2:        xwayland.keyring
+Patch1244082:   U_CVE-2025-49175-render-Avoid-0-or-less-animated-cursors.patch
+Patch1244084:   U_CVE-2025-49176-os-Do-not-overflow-the-integer-size-with-BigRequest.patch
+Patch1244085:   U_CVE-2025-49177-xfixes-Check-request-length-for-SetClientDisconnectM.patch
+Patch1244087:   U_CVE-2025-49178-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch
+Patch1244089:   U_CVE-2025-49179-record-Check-for-overflow-in-RecordSanityCheckRegist.patch
+Patch1244090:   U_CVE-2025-49180-randr-Check-for-overflow-in-RRChangeProviderProperty.patch
+Patch1244092:   U_CVE-2025-49176-os-Check-for-integer-overflow-on-BigRequest-length.patch
 BuildRequires:  meson
 BuildRequires:  ninja
 BuildRequires:  pkgconfig
@@ -100,6 +107,7 @@ Requires:       libpixman-1-0
 %endif
 Obsoletes:      xorg-x11-server-wayland < %{version}
 Provides:       xorg-x11-server-wayland = %{version}
+Conflicts:      patterns-wsl-tmpfiles
 
 %description
 This package contains the Xserver running on the Wayland Display Server.