diff options
| author | anholt <anholt@FreeBSD.org> | 2005-08-27 03:03:26 +0800 |
|---|---|---|
| committer | anholt <anholt@FreeBSD.org> | 2005-08-27 03:03:26 +0800 |
| commit | 1878ef07ecfd17d7ea403b9e80832e5a786410de (patch) | |
| tree | 6b48c54a50331c2f0d991b63d5cb7cf2ea78b28c /x11-servers | |
| parent | 7889d86a66ca60df5aa2024e3765145bdf41f3f2 (diff) | |
| download | freebsd-ports-gnome-1878ef07ecfd17d7ea403b9e80832e5a786410de.tar.gz freebsd-ports-gnome-1878ef07ecfd17d7ea403b9e80832e5a786410de.tar.zst freebsd-ports-gnome-1878ef07ecfd17d7ea403b9e80832e5a786410de.zip | |
Fix a use-after-free in the cursor code that's easily triggered with -AJ malloc
opts and running current gdm.
Approved by: portmgr (marcus)
Obtained from: X.Org CVS
Diffstat (limited to 'x11-servers')
| -rw-r--r-- | x11-servers/xorg-server/Makefile | 2 | ||||
| -rw-r--r-- | x11-servers/xorg-server/files/patch-dix-events.c | 42 |
2 files changed, 43 insertions, 1 deletions
diff --git a/x11-servers/xorg-server/Makefile b/x11-servers/xorg-server/Makefile index b035dd6742af..afeabd2d5f80 100644 --- a/x11-servers/xorg-server/Makefile +++ b/x11-servers/xorg-server/Makefile @@ -7,7 +7,7 @@ PORTNAME= xorg-server PORTVERSION= 6.8.2 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= x11-servers MASTER_SITES= ${MASTER_SITE_XORG} MASTER_SITE_SUBDIR= X11R${PORTVERSION}/src diff --git a/x11-servers/xorg-server/files/patch-dix-events.c b/x11-servers/xorg-server/files/patch-dix-events.c new file mode 100644 index 000000000000..1270ee6dbde2 --- /dev/null +++ b/x11-servers/xorg-server/files/patch-dix-events.c @@ -0,0 +1,42 @@ +Index: programs/Xserver/dix/events.c +=================================================================== +RCS file: /cvs/xorg/xc/programs/Xserver/dix/events.c,v +retrieving revision 1.16 +retrieving revision 1.17 +diff -u -u -r1.16 -r1.17 +--- programs/Xserver/dix/events.c 15 Jul 2005 05:48:29 -0000 1.16 ++++ programs/Xserver/dix/events.c 25 Aug 2005 22:11:04 -0000 1.17 +@@ -1,4 +1,4 @@ +-/* $XdotOrg: xc/programs/Xserver/dix/events.c,v 1.16 2005/07/15 05:48:29 kem Exp $ */ ++/* $XdotOrg: xc/programs/Xserver/dix/events.c,v 1.17 2005/08/25 22:11:04 anholt Exp $ */ + /* $XFree86: xc/programs/Xserver/dix/events.c,v 3.51 2004/01/12 17:04:52 tsi Exp $ */ + /************************************************************ + +@@ -675,7 +675,9 @@ + (sprite.current->bits->yhot != cursor->bits->yhot)) + XineramaCheckPhysLimits(cursor, FALSE); + (*sprite.screen->DisplayCursor)(sprite.screen, cursor); ++ FreeCursor(sprite.current, (Cursor)0); + sprite.current = cursor; ++ sprite.current->refcnt++; + } + } + +@@ -930,7 +932,9 @@ + (ScreenPtr)NULL); + (*sprite.hotPhys.pScreen->DisplayCursor) (sprite.hotPhys.pScreen, + cursor); ++ FreeCursor(sprite.current, (Cursor)0); + sprite.current = cursor; ++ sprite.current->refcnt++; + } + } + +@@ -2184,6 +2188,7 @@ + #endif + sprite.win = win; + sprite.current = wCursor (win); ++ sprite.current->refcnt++; + spriteTraceGood = 1; + ROOT = win; + (*pScreen->CursorLimits) ( |