Skip to content
  1. Oct 30, 2024
    • Alan Coopersmith's avatar
      dix-config.h: add HAVE_SOCKLEN_T definition · a1b5aa5a
      Alan Coopersmith authored 
      

Needed to build with IPv6 disabled using gcc 14 on some platforms to avoid:

In file included from /usr/X11/include/X11/Xtrans/transport.c:67,
                 from xstrans.c:17:
/usr/X11/include/X11/Xtrans/Xtranssock.c: In function ‘_XSERVTransSocketOpen’:
/usr/X11/include/X11/Xtrans/Xtranssock.c:467:28: error: passing argument 5
 of ‘getsockopt’ from incompatible pointer type [-Wincompatible-pointer-types]
  467 |             (char *) &val, &len) == 0 && val < 64 * 1024)
      |                            ^~~~
      |                            |
      |                            size_t * {aka long unsigned int *}

Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1736>
      a1b5aa5a
    • Michel Dänzer's avatar
      xwayland/present: Check allow_commits in xwl_present_flip · 56ba0b2a
      Michel Dänzer authored and Marge Bot's avatar Marge Bot committed 
      We're not supposed to call wl_surface_commit while
xwl_window->allow_commits is false. Bailing results in falling back to
a copy.

Noticed by inspection while looking into an issue which turned out to be
due to something else.

Closes: #1764
Part-of: <!1732>
      56ba0b2a
  3. Oct 29, 2024
  5. Oct 28, 2024
    • Alan Coopersmith's avatar
      modesetting: avoid memory leak when ms_present_check_unflip() returns FALSE · bf63d9b3
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      

Found by Oracle Parfait 13.3 static analyzer:
   Memory leak [memory-leak]:
      Memory leak of pointer event allocated with calloc(1, 16)
        at line 470 of hw/xfree86/drivers/modesetting/present.c in
	function 'ms_present_unflip'.
          event allocated at line 431 with calloc(1, 16)
          event leaks when ms_present_check_unflip(...) == 0 at line 438
              and i >= config->num_crtc at line 445

Fixes: 13c7d53d ("modesetting: Implement page flipping support for Present.")
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      bf63d9b3
    • Alan Coopersmith's avatar
      dix: limit checks to MAX_VALUATORS when generating Xi events · b65eea43
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      

Previously, it was looping through sizeof(ev->valuators.mask) * 8
valuators, where valuators.mask is defined as an array of
(MAX_VALUATORS + 7) / 8 entries.  Since MAX_VALUATORS is defined as 36,
this made it actually loop through 40 entries.  The last 4 bits in this
array should never be set, so we should never access memory outside the
bounds of the arrays defined to be exactly MAX_VALUATORS in length, but
we can make the static analyzer happier and not waste time checking bits
that should never be set.

Found by Oracle Parfait 13.3 static analyzer:

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 741 of dix/eventconvert.c in function 'eventToDeviceEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 808 of dix/eventconvert.c in function 'eventToRawEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data_raw[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 809 of dix/eventconvert.c in function 'eventToRawEvent'.

Fixes: b2ba77ba ("dix: add EventToXI2 and GetXI2Type.")
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      b65eea43
    • Alan Coopersmith's avatar
      dix: fix button offset when generating DeviceButtonStateNotify events · 4b073d65
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      

Found by Oracle Parfait 13.3 static analyzer:
   Buffer Overflow in STD C function [buffer-overflow-call-stdc]:
      Buffer overflow in call to memcpy. Buffer &bev->buttons[4] of
       size 24 is written at an offset of 28
      Array size is 28 bytes, index is 32
        at line 743 of dix/enterleave.c in function
	 'DeliverStateNotifyEvent'.

Fixes: a85f0d6b ("Xi: fix use of button->down - bitflags instead of int arrays.")
Reviewed-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      4b073d65
    • Alan Coopersmith's avatar
      render: avoid NULL pointer dereference if PictureFindVisual returns NULL · 7af077dd
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer pVisual
        at line 257 of dix/colormap.c in function 'CreateColormap'.
          Null pointer introduced at line 412 of render/picture.c in
	   function 'PictureFindVisual'.
          Constant 'NULL' passed into function CreateColormap, argument
	   pVisual, from call at line 431 in function
	   'PictureInitIndexedFormat'.
          Function PictureFindVisual may return constant 'NULL' at
	   line 412, called at line 429.

Fixes: d4a101d4 ("Integration of DAMAGE-XFIXES branch to trunk")
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      7af077dd
    • Alan Coopersmith's avatar
      Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL · d10589cc
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      

The comments in that function say "This only happens if master is a
slave device. don't do that" but static analysis doesn't respect that.

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestptr
        at line 274 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 273 of Xi/xichangehierarchy.c in function
	   'remove_master'.
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestkeybd
        at line 279 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 278 of Xi/xichangehierarchy.c in function
	   'remove_master'.

Fixes: 0814f511 ("input: store the master device's ID in the devPrivate for XTest devices.")
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      d10589cc
    • Alan Coopersmith's avatar
      xfree86: avoid memory leak on realloc failure · fa711c48
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      

Found by Oracle Parfait 13.3 static analyzer:
   Memory leak [memory-leak]:
      Memory leak of pointer optname allocated with asprintf(&optname,
      "\"%s\"", p->name)
        at line 326 of hw/xfree86/common/xf86Configure.c in function
	'configureDeviceSection'.
          optname allocated at line 309 with asprintf(&optname, "\"%s\"",
	  p->name)

Fixes: code inherited from XFree86
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      fa711c48
  7. Oct 26, 2024
  9. Oct 22, 2024
  11. Oct 11, 2024
  13. Oct 10, 2024