Commit 1ded2009 authored by Eric Vidal's avatar Eric Vidal 💬
Browse files

upgrel: 1.20.9-3

parent 612e972b
Pipeline #346264 passed with stages
in 21 minutes and 16 seconds
From 919f1f46fc67dae93b2b3f278fcbfc77af34ec58 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
Date: Mon, 31 Aug 2020 12:10:43 +0200
Subject: [PATCH] xfree86: Take second reference for SavedCursor in
xf86CursorSetCursor
The same pointer is kept in CurrentCursor as well, therefore two
RefCursor calls are needed.
Fixes use-after-free after switching VTs.
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067
Signed-off-by: Laurent Carlier <lordheavym@gmail.com>
---
hw/xfree86/ramdac/xf86CursorRD.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/hw/xfree86/ramdac/xf86CursorRD.c b/hw/xfree86/ramdac/xf86CursorRD.c
index 9aa3de97b..c8362d169 100644
--- a/hw/xfree86/ramdac/xf86CursorRD.c
+++ b/hw/xfree86/ramdac/xf86CursorRD.c
@@ -334,6 +334,9 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
ScreenPriv->HotY = cursor->bits->yhot;
if (!infoPtr->pScrn->vtSema) {
+ cursor = RefCursor(cursor);
+ if (ScreenPriv->SavedCursor)
+ FreeCursor(ScreenPriv->SavedCursor, None);
ScreenPriv->SavedCursor = cursor;
return;
}
--
2.28.0
......@@ -16,7 +16,7 @@ pkgname=(
'xorg-server-common-rootless'
'xorg-server-devel-rootless')
pkgver=1.20.8
pkgver=1.20.9
pkgrel=3
track=
......@@ -29,7 +29,8 @@ source=(https://xorg.freedesktop.org/releases/individual/xserver/${target}
xvfb-run # with updates from FC master
xvfb-run.1
0001-v2-FS-58644.patch
0002-fix-libshadow-2.patch)
0002-fix-libshadow-2.patch
'0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch')
#-------------------------------------| BUILD CONFIGURATION |-----------------------------------
......@@ -68,18 +69,21 @@ makedepends=(
#--------------------------------------| BUILD PREPARATION |------------------------------------
prepare() {
#cd xserver
cd "${pkgbase}-${pkgver}"
# patch from Fedora, not yet merged
patch -Np1 -i ../xserver-autobind-hotplug.patch
# https://bugs.freedesktop.org/show_bug.cgi?id=106588
patch -Np1 -i ../0001-v2-FS-58644.patch
# Fix libshadow.so: libfb.so => not found - FS#58731
# https://bugs.freedesktop.org/show_bug.cgi?id=106656
patch -Np1 -i ../0002-fix-libshadow-2.patch
#cd xserver
cd "${pkgbase}-${pkgver}"
# patch from Fedora, not yet merged
patch -Np1 -i ../xserver-autobind-hotplug.patch
# https://bugs.freedesktop.org/show_bug.cgi?id=106588
patch -Np1 -i ../0001-v2-FS-58644.patch
# Fix libshadow.so: libfb.so => not found - FS#58731
# https://bugs.freedesktop.org/show_bug.cgi?id=106656
patch -Np1 -i ../0002-fix-libshadow-2.patch
# Fix FS#67774 - merged upstream
patch -Np1 -i ../0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment