ahill/xlibre-xserver
1
0
Fork 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-01-26 14:03:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs()

Browse Source 
dixLookupResourceByType always overwrites the pointer passed in as the
first arg, so we shouldn't use the union it's in after that to get the
requested XID value to put in the errorValue.

Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1857
Fixes: 2d7eb4a19b ("Pre-validate ChangeGC XIDs.")
Reported-by: Mouse <mouse@Rodents-Montreal.ORG>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2111>
This commit is contained in:
Alan Coopersmith 2025-12-09 00:40:09 +02:00 committed by Enrico Weigelt
parent 408b3076a7
commit 2be080c4e3
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
dix/gc.c
View File

@ -438,6 +438,7 @@ ChangeGCXIDs(ClientPtr client, GCPtr pGC, BITS32 mask, CARD32 *pC32)
vals[i].val = pC32[i];
for (int i = 0; i < ARRAY_SIZE(xidfields); ++i) {
int offset, rc;
XID id;
if (!(mask & xidfields[i].mask))
continue;
@ -446,11 +447,13 @@ ChangeGCXIDs(ClientPtr client, GCPtr pGC, BITS32 mask, CARD32 *pC32)
vals[offset].ptr = NullPixmap;
continue;
}
rc = dixLookupResourceByType(&vals[offset].ptr, vals[offset].val,
/* save the id, since dixLookupResourceByType overwrites &vals[offset] */
id = vals[offset].val;
rc = dixLookupResourceByType(&vals[offset].ptr, id,
xidfields[i].type, client,
xidfields[i].access_mode);
if (rc != Success) {
client->errorValue = vals[offset].val;
client->errorValue = id;
return rc;
}
}