Skip to content

Out of bounds memory read in ActivateGrabNoDelivery() in 21.1.1

Xorg 21.1.1 users on OpenBSD experience a crashes in ActivateGrabNoDelivery() in dix/events.c line 3876:

*grabinfo->sync.event = *real_event;

This seem to happen because 23a8b62d introduces a bad cast from a DeviceEvent* pointer to InternalEvent* pointer : *real_event is in fact smaller than InternalEvent and since OpenBSD's malloc is stricted than the default Linux one, reading past the DeviceEvent struct causes a segfault rather than just an out of bounds memory read.

So far I've not been able to figure out the proper fix. Maybe someone can help ?

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information