diff --git a/fix-cve-CVE-2025-26594-2.patch b/fix-cve-CVE-2025-26594-2.patch new file mode 100644 index 0000000000000000000000000000000000000000..212effab7cd4c926a771fa6283d91ef865f623ee --- /dev/null +++ b/fix-cve-CVE-2025-26594-2.patch @@ -0,0 +1,34 @@ +From ded614e74e7175927dd2bc5ef69accaf2de29939 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 15:49:43 +1000 +Subject: [PATCH xserver 2/2] dix: keep a ref to the rootCursor + +--- + dix/main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/dix/main.c b/dix/main.c +index aa7b020b2..0c57ba605 100644 +--- a/dix/main.c ++++ b/dix/main.c +@@ -235,6 +235,8 @@ dix_main(int argc, char *argv[], char *envp[]) + defaultCursorFont); + } + ++ rootCursor = RefCursor(rootCursor); ++ + #ifdef PANORAMIX + /* + * Consolidate window and colourmap information for each screen +@@ -275,6 +277,8 @@ dix_main(int argc, char *argv[], char *envp[]) + + Dispatch(); + ++ UnrefCursor(rootCursor); ++ + UndisplayDevices(); + DisableAllDevices(); + +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26594.patch b/fix-cve-CVE-2025-26594.patch new file mode 100644 index 0000000000000000000000000000000000000000..2801a7f74de6f866105491b1ae840df8aac52e86 --- /dev/null +++ b/fix-cve-CVE-2025-26594.patch @@ -0,0 +1,26 @@ +From efca605c45ff51b57f136222b966ce1d610ebc33 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 11:27:05 +0100 + +--- + dix/dispatch.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/dix/dispatch.c b/dix/dispatch.c +index 5f7cfe02d..d1241fa96 100644 +--- a/dix/dispatch.c ++++ b/dix/dispatch.c +@@ -3039,6 +3039,10 @@ ProcFreeCursor(ClientPtr client) + rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR, + client, DixDestroyAccess); + if (rc == Success) { ++ if (pCursor == rootCursor) { ++ client->errorValue = stuff->id; ++ return BadCursor; ++ } + FreeResource(stuff->id, RT_NONE); + return Success; + } +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26595.patch b/fix-cve-CVE-2025-26595.patch new file mode 100644 index 0000000000000000000000000000000000000000..45149f418ccec641de87d754a0fdbf7ad2f6fce7 --- /dev/null +++ b/fix-cve-CVE-2025-26595.patch @@ -0,0 +1,39 @@ +From 98602942c143075ab7464f917e0fc5d31ce28c3f Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 14:41:45 +0100 +Subject: [PATCH xserver] xkb: Fix buffer overflow in XkbVModMaskText() + +--- + xkb/xkbtext.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c +index 018466420..93262528b 100644 +--- a/xkb/xkbtext.c ++++ b/xkb/xkbtext.c +@@ -173,14 +173,14 @@ XkbVModMaskText(XkbDescPtr xkb, + len = strlen(tmp) + 1 + (str == buf ? 0 : 1); + if (format == XkbCFile) + len += 4; +- if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) { +- if (str != buf) { +- if (format == XkbCFile) +- *str++ = '|'; +- else +- *str++ = '+'; +- len--; +- } ++ if ((str - buf) + len > VMOD_BUFFER_SIZE) ++ continue; /* Skip */ ++ if (str != buf) { ++ if (format == XkbCFile) ++ *str++ = '|'; ++ else ++ *str++ = '+'; ++ len--; + } + if (format == XkbCFile) + sprintf(str, "%sMask", tmp); +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26596.patch b/fix-cve-CVE-2025-26596.patch new file mode 100644 index 0000000000000000000000000000000000000000..3d341ea6f315fe1ab3ff24418ab38cde8fde097b --- /dev/null +++ b/fix-cve-CVE-2025-26596.patch @@ -0,0 +1,31 @@ +From b41f6fce201e77a174550935330e2f7772d4adf9 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 11:49:34 +0100 +Subject: [PATCH xserver] xkb: Fix computation of XkbSizeKeySyms + +--- + xkb/xkb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 85659382d..744dba63d 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -1095,10 +1095,10 @@ XkbSizeKeySyms(XkbDescPtr xkb, xkbGetMapReply * rep) + len = rep->nKeySyms * SIZEOF(xkbSymMapWireDesc); + symMap = &xkb->map->key_sym_map[rep->firstKeySym]; + for (i = nSyms = 0; i < rep->nKeySyms; i++, symMap++) { +- if (symMap->offset != 0) { +- nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width; +- nSyms += nSymsThisKey; +- } ++ nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width; ++ if (nSymsThisKey == 0) ++ continue; ++ nSyms += nSymsThisKey; + } + len += nSyms * 4; + rep->totalSyms = nSyms; +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26597.patch b/fix-cve-CVE-2025-26597.patch new file mode 100644 index 0000000000000000000000000000000000000000..af46599c53cf6c84f25e93d52d1b0f34b1bcc1e2 --- /dev/null +++ b/fix-cve-CVE-2025-26597.patch @@ -0,0 +1,24 @@ +From c5114475db18f29d639537d60e135bdfc11a5d3a Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 14:09:04 +0100 +Subject: [PATCH xserver] xkb: Fix buffer overflow in XkbChangeTypesOfKey() + +--- + xkb/XKBMisc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/xkb/XKBMisc.c b/xkb/XKBMisc.c +index abbfed90e..fd180fad2 100644 +--- a/xkb/XKBMisc.c ++++ b/xkb/XKBMisc.c +@@ -553,6 +553,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb, + i = XkbSetNumGroups(i, 0); + xkb->map->key_sym_map[key].group_info = i; + XkbResizeKeySyms(xkb, key, 0); ++ XkbResizeKeyActions(xkb, key, 0); + return Success; + } + +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26598.patch b/fix-cve-CVE-2025-26598.patch new file mode 100644 index 0000000000000000000000000000000000000000..079aa2082f3a7f6b603653440e5ea70ec35ae2e7 --- /dev/null +++ b/fix-cve-CVE-2025-26598.patch @@ -0,0 +1,96 @@ +From 0f5ea9d269ac6225bcb302a1ec0f58878114da9f Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 11:25:11 +0100 +Subject: [PATCH xserver] Xi: Fix barrier device search + +--- + Xi/xibarriers.c | 27 +++++++++++++++++++++++---- + 1 file changed, 23 insertions(+), 4 deletions(-) + +diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c +index 80c4b5981..28bc0a24f 100644 +--- a/Xi/xibarriers.c ++++ b/Xi/xibarriers.c +@@ -131,14 +131,15 @@ static void FreePointerBarrierClient(struct PointerBarrierClient *c) + + static struct PointerBarrierDevice *GetBarrierDevice(struct PointerBarrierClient *c, int deviceid) + { +- struct PointerBarrierDevice *pbd = NULL; ++ struct PointerBarrierDevice *p, *pbd = NULL; + +- xorg_list_for_each_entry(pbd, &c->per_device, entry) { +- if (pbd->deviceid == deviceid) ++ xorg_list_for_each_entry(p, &c->per_device, entry) { ++ if (p->deviceid == deviceid) { ++ pbd = p; + break; ++ } + } + +- BUG_WARN(!pbd); + return pbd; + } + +@@ -339,6 +340,9 @@ barrier_find_nearest(BarrierScreenPtr cs, DeviceIntPtr dev, + double distance; + + pbd = GetBarrierDevice(c, dev->id); ++ if (!pbd) ++ continue; ++ + if (pbd->seen) + continue; + +@@ -447,6 +451,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen, + nearest = &c->barrier; + + pbd = GetBarrierDevice(c, master->id); ++ if (!pbd) ++ continue; ++ + new_sequence = !pbd->hit; + + pbd->seen = TRUE; +@@ -487,6 +494,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen, + int flags = 0; + + pbd = GetBarrierDevice(c, master->id); ++ if (!pbd) ++ continue; ++ + pbd->seen = FALSE; + if (!pbd->hit) + continue; +@@ -681,6 +691,9 @@ BarrierFreeBarrier(void *data, XID id) + continue; + + pbd = GetBarrierDevice(c, dev->id); ++ if (!pbd) ++ continue; ++ + if (!pbd->hit) + continue; + +@@ -740,6 +753,8 @@ static void remove_master_func(void *res, XID id, void *devid) + barrier = container_of(b, struct PointerBarrierClient, barrier); + + pbd = GetBarrierDevice(barrier, *deviceid); ++ if (!pbd) ++ return; + + if (pbd->hit) { + BarrierEvent ev = { +@@ -904,6 +919,10 @@ ProcXIBarrierReleasePointer(ClientPtr client) + barrier = container_of(b, struct PointerBarrierClient, barrier); + + pbd = GetBarrierDevice(barrier, dev->id); ++ if (!pbd) { ++ client->errorValue = dev->id; ++ return BadDevice; ++ } + + if (pbd->barrier_event_id == event_id) + pbd->release_event_id = event_id; +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26599-2.patch b/fix-cve-CVE-2025-26599-2.patch new file mode 100644 index 0000000000000000000000000000000000000000..712a807c32307981fa0b30164b3d8deb7a3c9ade --- /dev/null +++ b/fix-cve-CVE-2025-26599-2.patch @@ -0,0 +1,49 @@ +From f5ce639ff9d3af05e79efce6c51e084352d28ed1 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 16:09:43 +0100 +Subject: [PATCH xserver 2/2] composite: initialize border clip even when + +--- + composite/compalloc.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/composite/compalloc.c b/composite/compalloc.c +index ecb1b6147..d1342799b 100644 +--- a/composite/compalloc.c ++++ b/composite/compalloc.c +@@ -605,9 +605,12 @@ compAllocPixmap(WindowPtr pWin) + int h = pWin->drawable.height + (bw << 1); + PixmapPtr pPixmap = compNewPixmap(pWin, x, y, w, h); + CompWindowPtr cw = GetCompWindow(pWin); ++ Bool status; + +- if (!pPixmap) +- return FALSE; ++ if (!pPixmap) { ++ status = FALSE; ++ goto out; ++ } + if (cw->update == CompositeRedirectAutomatic) + pWin->redirectDraw = RedirectDrawAutomatic; + else +@@ -621,14 +624,16 @@ compAllocPixmap(WindowPtr pWin) + DamageRegister(&pWin->drawable, cw->damage); + cw->damageRegistered = TRUE; + } ++ status = TRUE; + ++out: + /* Make sure our borderClip is up to date */ + RegionUninit(&cw->borderClip); + RegionCopy(&cw->borderClip, &pWin->borderClip); + cw->borderClipX = pWin->drawable.x; + cw->borderClipY = pWin->drawable.y; + +- return TRUE; ++ return status; + } + + void +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26599.patch b/fix-cve-CVE-2025-26599.patch new file mode 100644 index 0000000000000000000000000000000000000000..fb904ab47cf2b6feb501dee0951fab042990fabf --- /dev/null +++ b/fix-cve-CVE-2025-26599.patch @@ -0,0 +1,40 @@ +From 10a24e364ac15983051d0bb90817c88bbe107036 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 15:19:45 +0100 +Subject: [PATCH xserver 1/2] composite: Handle failure to redirect in + +--- + composite/compalloc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/composite/compalloc.c b/composite/compalloc.c +index e52c009bd..ecb1b6147 100644 +--- a/composite/compalloc.c ++++ b/composite/compalloc.c +@@ -138,6 +138,7 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update) + CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen); + WindowPtr pLayerWin; + Bool anyMarked = FALSE; ++ int status = Success; + + if (pWin == cs->pOverlayWin) { + return Success; +@@ -216,13 +217,13 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update) + + if (!compCheckRedirect(pWin)) { + FreeResource(ccw->id, RT_NONE); +- return BadAlloc; ++ status = BadAlloc; + } + + if (anyMarked) + compHandleMarkedWindows(pWin, pLayerWin); + +- return Success; ++ return status; + } + + void +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26600.patch b/fix-cve-CVE-2025-26600.patch new file mode 100644 index 0000000000000000000000000000000000000000..4d74b621dc71e5df8567ae40a2237d3c085dce28 --- /dev/null +++ b/fix-cve-CVE-2025-26600.patch @@ -0,0 +1,48 @@ +From 70ad5d36ae80f6e5a436eabfee642c2c013e51cc Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 16:18:04 +0100 +Subject: [PATCH xserver] dix: Dequeue pending events on frozen device on + +--- + dix/devices.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/dix/devices.c b/dix/devices.c +index 969819534..740390207 100644 +--- a/dix/devices.c ++++ b/dix/devices.c +@@ -966,6 +966,23 @@ FreeAllDeviceClasses(ClassesPtr classes) + + } + ++static void ++FreePendingFrozenDeviceEvents(DeviceIntPtr dev) ++{ ++ QdEventPtr qe, tmp; ++ ++ if (!dev->deviceGrab.sync.frozen) ++ return; ++ ++ /* Dequeue any frozen pending events */ ++ xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) { ++ if (qe->device == dev) { ++ xorg_list_del(&qe->next); ++ free(qe); ++ } ++ } ++} ++ + /** + * Close down a device and free all resources. + * Once closed down, the driver will probably not expect you that you'll ever +@@ -1030,6 +1047,7 @@ CloseDevice(DeviceIntPtr dev) + free(dev->last.touches[j].valuators); + free(dev->last.touches); + dev->config_info = NULL; ++ FreePendingFrozenDeviceEvents(dev); + dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE); + free(dev); + } +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26601-2.patch b/fix-cve-CVE-2025-26601-2.patch new file mode 100644 index 0000000000000000000000000000000000000000..14637812591016ce72b7399e01c9ed821077d89f --- /dev/null +++ b/fix-cve-CVE-2025-26601-2.patch @@ -0,0 +1,66 @@ +From 7dc3f11abb51cad8a59ecbff5278c8c8a318df41 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 16:54:30 +0100 +Subject: [PATCH xserver 2/4] sync: Check values before applying changes + +--- + Xext/sync.c | 36 ++++++++++++++++++------------------ + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/Xext/sync.c b/Xext/sync.c +index 4267d3af6..4eab5a6ac 100644 +--- a/Xext/sync.c ++++ b/Xext/sync.c +@@ -351,6 +351,24 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, + } + } + ++ if (changes & (XSyncCAValueType | XSyncCAValue)) { ++ if (pTrigger->value_type == XSyncAbsolute) ++ pTrigger->test_value = pTrigger->wait_value; ++ else { /* relative */ ++ Bool overflow; ++ ++ if (pCounter == NULL) ++ return BadMatch; ++ ++ overflow = checked_int64_add(&pTrigger->test_value, ++ pCounter->value, pTrigger->wait_value); ++ if (overflow) { ++ client->errorValue = pTrigger->wait_value >> 32; ++ return BadValue; ++ } ++ } ++ } ++ + if (changes & XSyncCATestType) { + + if (pSync && SYNC_FENCE == pSync->type) { +@@ -379,24 +397,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, + } + } + +- if (changes & (XSyncCAValueType | XSyncCAValue)) { +- if (pTrigger->value_type == XSyncAbsolute) +- pTrigger->test_value = pTrigger->wait_value; +- else { /* relative */ +- Bool overflow; +- +- if (pCounter == NULL) +- return BadMatch; +- +- overflow = checked_int64_add(&pTrigger->test_value, +- pCounter->value, pTrigger->wait_value); +- if (overflow) { +- client->errorValue = pTrigger->wait_value >> 32; +- return BadValue; +- } +- } +- } +- + if (changes & XSyncCACounter) { + if (pSync != pTrigger->pSync) { /* new counter for trigger */ + SyncDeleteTriggerFromSyncObject(pTrigger); +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26601-3.patch b/fix-cve-CVE-2025-26601-3.patch new file mode 100644 index 0000000000000000000000000000000000000000..3da00b475b56d99edf0e33fa73092ab03e0f5ee8 --- /dev/null +++ b/fix-cve-CVE-2025-26601-3.patch @@ -0,0 +1,37 @@ +From 4ccaa5134482b6be9c9a7f0b66cd221ef325d082 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 17:06:07 +0100 +Subject: [PATCH xserver 3/4] sync: Do not fail SyncAddTriggerToSyncObject() + +--- + Xext/sync.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/Xext/sync.c b/Xext/sync.c +index 4eab5a6ac..c36de1a2e 100644 +--- a/Xext/sync.c ++++ b/Xext/sync.c +@@ -200,8 +200,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger) + return Success; + } + +- if (!(pCur = malloc(sizeof(SyncTriggerList)))) +- return BadAlloc; ++ /* Failure is not an option, it's succeed or burst! */ ++ pCur = XNFalloc(sizeof(SyncTriggerList)); + + pCur->pTrigger = pTrigger; + pCur->next = pTrigger->pSync->pTriglist; +@@ -409,8 +409,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, + * a new counter on a trigger + */ + if (newSyncObject) { +- if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success) +- return rc; ++ SyncAddTriggerToSyncObject(pTrigger); + } + else if (pCounter && IsSystemCounter(pCounter)) { + SyncComputeBracketValues(pCounter); +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26601-4.patch b/fix-cve-CVE-2025-26601-4.patch new file mode 100644 index 0000000000000000000000000000000000000000..9d198ac6ad3c820458bbc8fadf3f9eae49a35990 --- /dev/null +++ b/fix-cve-CVE-2025-26601-4.patch @@ -0,0 +1,114 @@ +From f0984082067f79b45383fa1eb889c6a901667331 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 17:10:31 +0100 +Subject: [PATCH xserver 4/4] sync: Apply changes last in + +--- + Xext/sync.c | 42 +++++++++++++++++++++++++++--------------- + 1 file changed, 27 insertions(+), 15 deletions(-) + +diff --git a/Xext/sync.c b/Xext/sync.c +index c36de1a2e..e282e6657 100644 +--- a/Xext/sync.c ++++ b/Xext/sync.c +@@ -800,8 +800,14 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask, + int status; + XSyncCounter counter; + Mask origmask = mask; ++ SyncTrigger trigger; ++ Bool select_events_changed = FALSE; ++ Bool select_events_value; ++ int64_t delta; + +- counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None; ++ trigger = pAlarm->trigger; ++ delta = pAlarm->delta; ++ counter = trigger.pSync ? trigger.pSync->id : None; + + while (mask) { + int index2 = lowbit(mask); +@@ -817,24 +823,24 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask, + case XSyncCAValueType: + mask &= ~XSyncCAValueType; + /* sanity check in SyncInitTrigger */ +- pAlarm->trigger.value_type = *values++; ++ trigger.value_type = *values++; + break; + + case XSyncCAValue: + mask &= ~XSyncCAValue; +- pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1]; ++ trigger.wait_value = ((int64_t)values[0] << 32) | values[1]; + values += 2; + break; + + case XSyncCATestType: + mask &= ~XSyncCATestType; + /* sanity check in SyncInitTrigger */ +- pAlarm->trigger.test_type = *values++; ++ trigger.test_type = *values++; + break; + + case XSyncCADelta: + mask &= ~XSyncCADelta; +- pAlarm->delta = ((int64_t)values[0] << 32) | values[1]; ++ delta = ((int64_t)values[0] << 32) | values[1]; + values += 2; + break; + +@@ -844,10 +850,8 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask, + client->errorValue = *values; + return BadValue; + } +- status = SyncEventSelectForAlarm(pAlarm, client, +- (Bool) (*values++)); +- if (status != Success) +- return status; ++ select_events_value = (Bool) (*values++); ++ select_events_changed = TRUE; + break; + + default: +@@ -856,25 +860,33 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask, + } + } + ++ if (select_events_changed) { ++ status = SyncEventSelectForAlarm(pAlarm, client, select_events_value); ++ if (status != Success) ++ return status; ++ } ++ + /* "If the test-type is PositiveComparison or PositiveTransition + * and delta is less than zero, or if the test-type is + * NegativeComparison or NegativeTransition and delta is + * greater than zero, a Match error is generated." + */ + if (origmask & (XSyncCADelta | XSyncCATestType)) { +- if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) || +- (pAlarm->trigger.test_type == XSyncPositiveTransition)) +- && pAlarm->delta < 0) ++ if ((((trigger.test_type == XSyncPositiveComparison) || ++ (trigger.test_type == XSyncPositiveTransition)) ++ && delta < 0) + || +- (((pAlarm->trigger.test_type == XSyncNegativeComparison) || +- (pAlarm->trigger.test_type == XSyncNegativeTransition)) +- && pAlarm->delta > 0) ++ (((trigger.test_type == XSyncNegativeComparison) || ++ (trigger.test_type == XSyncNegativeTransition)) ++ && delta > 0) + ) { + return BadMatch; + } + } + + /* postpone this until now, when we're sure nothing else can go wrong */ ++ pAlarm->delta = delta; ++ pAlarm->trigger = trigger; + if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter, + origmask & XSyncCAAllTrigger)) != Success) + return status; +-- +2.48.1 + diff --git a/fix-cve-CVE-2025-26601.patch b/fix-cve-CVE-2025-26601.patch new file mode 100644 index 0000000000000000000000000000000000000000..3b8cd6145e4a2cc8baddd2810ad5ea89a4104355 --- /dev/null +++ b/fix-cve-CVE-2025-26601.patch @@ -0,0 +1,43 @@ +From 573a2265aacfeaddcc1bb001905a6f7d4fa15ee6 Mon Sep 17 00:00:00 2001 +From: zhuhongbo +Date: Mon, 7 Apr 2025 16:52:01 +0100 +Subject: [PATCH xserver 1/4] sync: Do not let sync objects uninitialized + +--- + Xext/sync.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/Xext/sync.c b/Xext/sync.c +index b6417b3b0..4267d3af6 100644 +--- a/Xext/sync.c ++++ b/Xext/sync.c +@@ -330,11 +330,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, + client->errorValue = syncObject; + return rc; + } +- if (pSync != pTrigger->pSync) { /* new counter for trigger */ +- SyncDeleteTriggerFromSyncObject(pTrigger); +- pTrigger->pSync = pSync; +- newSyncObject = TRUE; +- } + } + + /* if system counter, ask it what the current value is */ +@@ -402,6 +397,14 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, + } + } + ++ if (changes & XSyncCACounter) { ++ if (pSync != pTrigger->pSync) { /* new counter for trigger */ ++ SyncDeleteTriggerFromSyncObject(pTrigger); ++ pTrigger->pSync = pSync; ++ newSyncObject = TRUE; ++ } ++ } ++ + /* we wait until we're sure there are no errors before registering + * a new counter on a trigger + */ +-- +2.48.1 + diff --git a/tigervnc.spec b/tigervnc.spec index 3978ebbd361cd4c8386c8140592196333432becb..9b4417b1757405ae0d922aeff91e69281898b29b 100644 --- a/tigervnc.spec +++ b/tigervnc.spec @@ -1,6 +1,6 @@ Name: tigervnc Version: 1.8.0 -Release: 35%{?dist} +Release: 36%{?dist} Summary: A TigerVNC remote display system Group: User Interface/Desktops @@ -77,7 +77,19 @@ Patch101: 0001-rpath-hack.patch Patch111: xorg-CVE-2023-5380.patch Patch112: xorg-CVE-2024-9632.patch - +Patch113: fix-cve-CVE-2025-26594.patch +Patch114: fix-cve-CVE-2025-26594-2.patch +Patch115: fix-cve-CVE-2025-26595.patch +Patch116: fix-cve-CVE-2025-26596.patch +Patch117: fix-cve-CVE-2025-26597.patch +Patch118: fix-cve-CVE-2025-26598.patch +Patch119: fix-cve-CVE-2025-26599.patch +Patch120: fix-cve-CVE-2025-26599-2.patch +Patch121: fix-cve-CVE-2025-26600.patch +Patch122: fix-cve-CVE-2025-26601.patch +Patch123: fix-cve-CVE-2025-26601-2.patch +Patch124: fix-cve-CVE-2025-26601-3.patch +Patch125: fix-cve-CVE-2025-26601-4.patch # Security fixes Patch200: tigervnc-CVE-2019-15691.patch Patch201: tigervnc-encapsulate-pixelbuffer-internal-details.patch @@ -192,6 +204,19 @@ done %patch101 -p1 -b .rpath %patch111 -p1 -b .xorg-CVE-2023-5380 %patch112 -p1 -b .xorg-CVE-2024-9632 +%patch -P113 -p1 -b .cve-CVE-2025-26594 +%patch -P114 -p1 -b .cve-CVE-2025-26594-2 +%patch -P115 -p1 -b .cve-CVE-2025-26595 +%patch -P116 -p1 -b .cve-CVE-2025-26596 +%patch -P117 -p1 -b .cve-CVE-2025-26597 +%patch -P118 -p1 -b .cve-CVE-2025-26598 +%patch -P119 -p1 -b .cve-CVE-2025-26599 +%patch -P120 -p1 -b .cve-CVE-2025-26599-2 +%patch -P121 -p1 -b .cve-CVE-2025-26600 +%patch -P122 -p1 -b .cve-CVE-2025-26601 +%patch -P123 -p1 -b .cve-CVE-2025-26601-2 +%patch -P124 -p1 -b .cve-CVE-2025-26601-3 +%patch -P125 -p1 -b .cve-CVE-2025-26601-4 popd # Don't use shebang in vncserver script. @@ -425,6 +450,10 @@ fi %{_datadir}/icons/hicolor/*/apps/* %changelog +* Mon Apr 7 2025 zhuhongbo - 1.8.0-36 +- cve: fix CVE-2025-26594 CVE-2025-26595 CVE-2025-26596 CVE-2025-26597 +- CVE-2025-26598 CVE-2025-26599 CVE-2025-26600 CVE-2025-26601 + * Mon Mar 17 2025 zhuhongbo - 1.8.0-35 - Fix build against latest xorg-x11-server