Skip to content
Snippets Groups Projects
Commit b07192a8 authored by Olivier Fourdan's avatar Olivier Fourdan :tools:
Browse files

composite: initialize border clip even when pixmap alloc fails


If it fails to allocate the pixmap, the function compAllocPixmap() would
return early and leave the borderClip region uninitialized, which may
lead to the use of uninitialized value as reported by valgrind:

 Conditional jump or move depends on uninitialised value(s)
    at 0x4F9B33: compClipNotify (compwindow.c:317)
    by 0x484FC9: miComputeClips (mivaltree.c:476)
    by 0x48559A: miValidateTree (mivaltree.c:679)
    by 0x4F0685: MapWindow (window.c:2693)
    by 0x4A344A: ProcMapWindow (dispatch.c:922)
    by 0x4A25B5: Dispatch (dispatch.c:560)
    by 0x4B082A: dix_main (main.c:282)
    by 0x429233: main (stubmain.c:34)
  Uninitialised value was created by a heap allocation
    at 0x4841866: malloc (vg_replace_malloc.c:446)
    by 0x4F47BC: compRedirectWindow (compalloc.c:171)
    by 0x4FA8AD: compCreateWindow (compwindow.c:592)
    by 0x4EBB89: CreateWindow (window.c:925)
    by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
    by 0x4A25B5: Dispatch (dispatch.c:560)
    by 0x4B082A: dix_main (main.c:282)
    by 0x429233: main (stubmain.c:34)

 Conditional jump or move depends on uninitialised value(s)
    at 0x48EEDBC: pixman_region_translate (pixman-region.c:2233)
    by 0x4F9255: RegionTranslate (regionstr.h:312)
    by 0x4F9B7E: compClipNotify (compwindow.c:319)
    by 0x484FC9: miComputeClips (mivaltree.c:476)
    by 0x48559A: miValidateTree (mivaltree.c:679)
    by 0x4F0685: MapWindow (window.c:2693)
    by 0x4A344A: ProcMapWindow (dispatch.c:922)
    by 0x4A25B5: Dispatch (dispatch.c:560)
    by 0x4B082A: dix_main (main.c:282)
    by 0x429233: main (stubmain.c:34)
  Uninitialised value was created by a heap allocation
    at 0x4841866: malloc (vg_replace_malloc.c:446)
    by 0x4F47BC: compRedirectWindow (compalloc.c:171)
    by 0x4FA8AD: compCreateWindow (compwindow.c:592)
    by 0x4EBB89: CreateWindow (window.c:925)
    by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
    by 0x4A25B5: Dispatch (dispatch.c:560)
    by 0x4B082A: dix_main (main.c:282)
    by 0x429233: main (stubmain.c:34)

 Conditional jump or move depends on uninitialised value(s)
    at 0x48EEE33: UnknownInlinedFun (pixman-region.c:2241)
    by 0x48EEE33: pixman_region_translate (pixman-region.c:2225)
    by 0x4F9255: RegionTranslate (regionstr.h:312)
    by 0x4F9B7E: compClipNotify (compwindow.c:319)
    by 0x484FC9: miComputeClips (mivaltree.c:476)
    by 0x48559A: miValidateTree (mivaltree.c:679)
    by 0x4F0685: MapWindow (window.c:2693)
    by 0x4A344A: ProcMapWindow (dispatch.c:922)
    by 0x4A25B5: Dispatch (dispatch.c:560)
    by 0x4B082A: dix_main (main.c:282)
    by 0x429233: main (stubmain.c:34)
  Uninitialised value was created by a heap allocation
    at 0x4841866: malloc (vg_replace_malloc.c:446)
    by 0x4F47BC: compRedirectWindow (compalloc.c:171)
    by 0x4FA8AD: compCreateWindow (compwindow.c:592)
    by 0x4EBB89: CreateWindow (window.c:925)
    by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
    by 0x4A25B5: Dispatch (dispatch.c:560)
    by 0x4B082A: dix_main (main.c:282)
    by 0x429233: main (stubmain.c:34)

Fix compAllocPixmap() to initialize the border clip even if the creation
of the backing pixmap has failed, to avoid depending later on
uninitialized border clip values.

Related to CVE-2025-26599, ZDI-CAN-25851

Signed-off-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
Acked-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Part-of: <xorg/xserver!1828>
parent c1ff84be
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment