-
- Downloads
composite: initialize border clip even when pixmap alloc fails
If it fails to allocate the pixmap, the function compAllocPixmap() would return early and leave the borderClip region uninitialized, which may lead to the use of uninitialized value as reported by valgrind: Conditional jump or move depends on uninitialised value(s) at 0x4F9B33: compClipNotify (compwindow.c:317) by 0x484FC9: miComputeClips (mivaltree.c:476) by 0x48559A: miValidateTree (mivaltree.c:679) by 0x4F0685: MapWindow (window.c:2693) by 0x4A344A: ProcMapWindow (dispatch.c:922) by 0x4A25B5: Dispatch (dispatch.c:560) by 0x4B082A: dix_main (main.c:282) by 0x429233: main (stubmain.c:34) Uninitialised value was created by a heap allocation at 0x4841866: malloc (vg_replace_malloc.c:446) by 0x4F47BC: compRedirectWindow (compalloc.c:171) by 0x4FA8AD: compCreateWindow (compwindow.c:592) by 0x4EBB89: CreateWindow (window.c:925) by 0x4A2E6E: ProcCreateWindow (dispatch.c:768) by 0x4A25B5: Dispatch (dispatch.c:560) by 0x4B082A: dix_main (main.c:282) by 0x429233: main (stubmain.c:34) Conditional jump or move depends on uninitialised value(s) at 0x48EEDBC: pixman_region_translate (pixman-region.c:2233) by 0x4F9255: RegionTranslate (regionstr.h:312) by 0x4F9B7E: compClipNotify (compwindow.c:319) by 0x484FC9: miComputeClips (mivaltree.c:476) by 0x48559A: miValidateTree (mivaltree.c:679) by 0x4F0685: MapWindow (window.c:2693) by 0x4A344A: ProcMapWindow (dispatch.c:922) by 0x4A25B5: Dispatch (dispatch.c:560) by 0x4B082A: dix_main (main.c:282) by 0x429233: main (stubmain.c:34) Uninitialised value was created by a heap allocation at 0x4841866: malloc (vg_replace_malloc.c:446) by 0x4F47BC: compRedirectWindow (compalloc.c:171) by 0x4FA8AD: compCreateWindow (compwindow.c:592) by 0x4EBB89: CreateWindow (window.c:925) by 0x4A2E6E: ProcCreateWindow (dispatch.c:768) by 0x4A25B5: Dispatch (dispatch.c:560) by 0x4B082A: dix_main (main.c:282) by 0x429233: main (stubmain.c:34) Conditional jump or move depends on uninitialised value(s) at 0x48EEE33: UnknownInlinedFun (pixman-region.c:2241) by 0x48EEE33: pixman_region_translate (pixman-region.c:2225) by 0x4F9255: RegionTranslate (regionstr.h:312) by 0x4F9B7E: compClipNotify (compwindow.c:319) by 0x484FC9: miComputeClips (mivaltree.c:476) by 0x48559A: miValidateTree (mivaltree.c:679) by 0x4F0685: MapWindow (window.c:2693) by 0x4A344A: ProcMapWindow (dispatch.c:922) by 0x4A25B5: Dispatch (dispatch.c:560) by 0x4B082A: dix_main (main.c:282) by 0x429233: main (stubmain.c:34) Uninitialised value was created by a heap allocation at 0x4841866: malloc (vg_replace_malloc.c:446) by 0x4F47BC: compRedirectWindow (compalloc.c:171) by 0x4FA8AD: compCreateWindow (compwindow.c:592) by 0x4EBB89: CreateWindow (window.c:925) by 0x4A2E6E: ProcCreateWindow (dispatch.c:768) by 0x4A25B5: Dispatch (dispatch.c:560) by 0x4B082A: dix_main (main.c:282) by 0x429233: main (stubmain.c:34) Fix compAllocPixmap() to initialize the border clip even if the creation of the backing pixmap has failed, to avoid depending later on uninitialized border clip values. Related to CVE-2025-26599, ZDI-CAN-25851 Signed-off-by:Olivier Fourdan <ofourdan@redhat.com> Acked-by:
Peter Hutterer <peter.hutterer@who-t.net> Part-of: <xorg/xserver!1828>
Loading
Please register or sign in to comment