Skip to content
Snippets Groups Projects
Commit c1ff84be authored by Olivier Fourdan's avatar Olivier Fourdan :tools:
Browse files

composite: Handle failure to redirect in compRedirectWindow()


The function compCheckRedirect() may fail if it cannot allocate the
backing pixmap.

In that case, compRedirectWindow() will return a BadAlloc error.

However that failure code path will shortcut the validation of the
window tree marked just before, which leaves the validate data partly
initialized.

That causes a use of uninitialized pointer later.

The fix is to not shortcut the call to compHandleMarkedWindows() even in
the case of compCheckRedirect() returning an error.

CVE-2025-26599, ZDI-CAN-25851

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
Acked-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Part-of: <xorg/xserver!1828>
parent bba9df1a
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment