backport WIP queue onto 25.0 - #2170
Draft
metux wants to merge 14 commits into
Draft
Conversation
metux
marked this pull request as draft
April 10, 2026 18:23
metux
force-pushed
the
rfc/backport-25.0
branch
6 times, most recently
from
April 18, 2026 17:41
585110e to
c50a90c
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
8 times, most recently
from
April 28, 2026 09:30
90fb110 to
16de288
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
2 times, most recently
from
May 8, 2026 08:06
6896aa9 to
60079d0
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
2 times, most recently
from
May 18, 2026 18:32
78eb773 to
495c165
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
3 times, most recently
from
June 3, 2026 13:51
a0614a0 to
45b453c
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
5 times, most recently
from
June 8, 2026 10:55
d1103a9 to
d6a6e64
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
2 times, most recently
from
June 12, 2026 10:54
613a3d9 to
8ba589a
Compare
metux
force-pushed
the
rfc/backport-25.0
branch
2 times, most recently
from
June 16, 2026 10:36
ea829d8 to
f0004dd
Compare
…ndow loses focus PR: #2898
- fb/fbpixmap.c: check width*bpp and height*paddedWidth overflows - hw/xfree86/common/xf86fbman.c: check length+gran-1 overflow, safe h computation, h*w overflow - hw/xfree86/drivers/modesetting/drmmode_display.c: validate multiplications before allocating shadow buffers - hw/xquartz/xpr/xprScreen.c: check displayCount * sizeof overflow - hw/xnest/Color.c: check ncolors * sizeof(uint32_t) overflow These prevent potential heap overflows due to wrapped sizes. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
- xkb/ddxLoad.c: replace mktemp() with GetTempFileNameA() on Windows; - xkb/ddxLoad.c: add safe_path() validation and sanitize XkbBaseDirectory and XkbBinDirectory; - bundle-main.c: replace tmpnam() with mkstemp() and unlink to prevent symlink attacks. Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
- LoadImageComma: dynamically allocate buffer based on path lengths instead of fixed-size stack buffer - LoadPreferences: use snprintf to avoid overflow when constructing ~/.XWinrc path Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
…monMakeCurrent oldTag in CommonMakeCurrent() is a pointer to cl->contextTags[...]. CommonMakeCurrent() may realloc(cl->contextTags) and thus move the memory, leaving oldTag as dangling pointer. If we then GlxFreeContextTag(oldTag) we end up writing into freed memory. Fix this by freeing oldTag before CommonMakeNewCurrent(). This vulnerability was discovered by: Anonymous working with Trend Micro Zero Day Initiative CVE-2026-56000/ZDI-CAN-30561 Fixes: 4781f2a ("GLX: Free the tag of the old context later") Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2250> PR: #3336
GLYPHWIDTHPIXELS and GLYPHHEIGHTPIXELS compute glyph dimensions from signed INT16 fields. A crafted PCF font can produce negative results (e.g. rightSideBearing < leftSideBearing). All callees have a while (height--) loop which will end up in OOB writes for negative height values. In the case of a negative height, some callees cast to size_t or end up with negative strides. The same pattern exists in fbPoloyGlyphBit, miPolyGlyphBlt and glamor_poly_glyph_blt_gl, so let's fix all of them in one go. Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2250> PR: #3337
…ounds glamor_font_get() computes the atlas slot size from the font's declared maxbounds, but copies each glyph's bitmap using the per-glyph metrics (GLYPHHEIGHTPIXELS/GLYPHWIDTHBYTES macros). When a malicious PCF font has per-glyph metrics exceeding maxbounds, the memcpy writes past the heap-allocated atlas buffer. Negative per-glyph metrics are even worse: the loop counter wraps to ~4 billion iterations (via unsigned cast) or memcpy's size parameter wraps to SIZE_MAX. The PCF parser in libXfont2 does not recompute maxbounds from per-glyph data (only the BDF parser does), so the file's declared maxbounds values are trusted as-is. Reject fonts where any per-glyph metric is negative or exceeds the atlas slot size, falling back to software rendering which uses per-glyph metrics directly without an atlas. This vulnerability was discovered by: Anonymous working with Trend Micro Zero Day Initiative CVE-2026-55999/ZDI-CAN-30498 Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2250> PR: #3338
If fdopen() fails, close the unused pipe fd, free the pid list node, and restore the smart scheduler signal before returning NULL. Previously the fd would leak and the node would be added to pidlist with a NULL fp. Signed-off-by: dongshengyuan <545258830@qq.com> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2236> PR: #3340
When a platform GPU device is added at runtime, xf86platformAddDevice calls AddGPUScreen without first assigning the EnableDisableFBAccess and SetDGAMode function-pointer defaults. The boot path in xf86Init.c sets both of these for every GPU screen before it calls AddGPUScreen, so a screen added by hotplug is left with SetDGAMode == NULL. modesetting's ScreenInit reaches xf86CrtcScreenInit, which wraps DGACloseScreen onto the screen regardless of how the screen was created. When the device is later removed, xf86platformRemoveDevice tears the GPU screen down and DGACloseScreen calls pScrn->SetDGAMode(pScrn, 0, NULL). On a hotplug-added screen that pointer is NULL, so the call faults and takes down the server with a SIGSEGV. This is not DisplayLink-specific: any modesetting platform GPU screen added at runtime and later removed hits it. DisplayLink/evdi just makes it easy to reproduce, because the evdi platform device is added and reconfigured at runtime. Mirror the boot path by assigning the same defaults in xf86platformAddDevice immediately before the AddGPUScreen call. Closes: #1904 Signed-off-by: Gary T. Giesen <ggiesen@giesen.me> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2244> PR: #3341
…_front_process: -[NSApplication activateIgnoringOtherApps:] is no longer supported under the macOS cooperative activation model, so use the new xp_window_activate() API instead. Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> PR: #3342
…path The indirect GLX make-current path failed silently: an unsuccessful surface creation or context attach surfaced only as a generic GLXBadContext to the client, with nothing in the server log to indicate which Xplugin call rejected the request. Add error logging on each failure branch of the make-current, surface creation, and surface configuration code so the offending call and its error code are visible. Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> PR: #3343
In a987fc7 commit glx library is statically linked which makes all glx library variables dublicated in glx.so and glamoregl.so files and leads 'split-brain' problem where same symbols exist in different depending on context (this evident when it called using functions with static attribute). This patch exports neccesary glx symbols for glamor library. Signed-off-by: Tautvis <gtautvis@gmail.com> (cherry picked from commit 9b74a3a) PR: #3473
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports from Xorg for 25.0 release line
PRs: