From 90208249e644b2d720ff3c7b71e1a6f85bc9f9c3 Mon Sep 17 00:00:00 2001 From: Bill Nottingham Date: Tue, 10 Aug 2010 11:15:58 -0400 Subject: [PATCH 1/2] Add upstream patch to fix use-after-free that makes clients crash. --- ...63608d23d35cd9233b2223f880ac3671f10b.patch | 33 +++++++++++++++++++ libX11.spec | 8 +++-- 2 files changed, 39 insertions(+), 2 deletions(-) create mode 100644 54a963608d23d35cd9233b2223f880ac3671f10b.patch diff --git a/54a963608d23d35cd9233b2223f880ac3671f10b.patch b/54a963608d23d35cd9233b2223f880ac3671f10b.patch new file mode 100644 index 0000000..55330a1 --- /dev/null +++ b/54a963608d23d35cd9233b2223f880ac3671f10b.patch @@ -0,0 +1,33 @@ +From 54a963608d23d35cd9233b2223f880ac3671f10b Mon Sep 17 00:00:00 2001 +From: Jamey Sharp +Date: Fri, 06 Aug 2010 22:51:56 +0000 +Subject: Fix use-after-free in _XReply on X errors. + +_XReply would always call dequeue_pending_request on errors. When it +got an error for the current request, it would call dequeue, then break +out of the loop; then, if it had an error in the event queue, it would +compare it with the sequence number of the now-freed pending request. +_XReply already stored that sequence number in dpy->last_request_read +before freeing it, so look at that instead. + +Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=29412 + +Signed-off-by: Jamey Sharp +Signed-off-by: Josh Triplett +(cherry picked from commit 4b8ff7db39f2fe7ef12968d462aaf3f9054b6c18) +--- +diff --git a/src/xcb_io.c b/src/xcb_io.c +index dac7622..72881d8 100644 +--- a/src/xcb_io.c ++++ b/src/xcb_io.c +@@ -579,7 +579,7 @@ Status _XReply(Display *dpy, xReply *rep, int extra, Bool discard) + xcb_generic_event_t *event = dpy->xcb->next_event; + unsigned long event_sequence = dpy->last_request_read; + widen(&event_sequence, event->full_sequence); +- if(event_sequence == current->sequence) ++ if(event_sequence == dpy->last_request_read) + { + error = (xcb_generic_error_t *) event; + dpy->xcb->next_event = NULL; +-- +cgit v0.8.3-6-g21f6 diff --git a/libX11.spec b/libX11.spec index 31a863b..c9f4ea7 100644 --- a/libX11.spec +++ b/libX11.spec @@ -4,7 +4,7 @@ Summary: Core X11 protocol client library Name: libX11 Version: 1.3.4 -Release: 2%{?dist} +Release: 3%{?dist} License: MIT Group: System Environment/Libraries URL: http://www.x.org @@ -16,7 +16,7 @@ Source0: http://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.t #Source1: make-git-snapshot.sh Patch2: dont-forward-keycode-0.patch - +Patch3: 54a963608d23d35cd9233b2223f880ac3671f10b.patch BuildRequires: xorg-x11-util-macros BuildRequires: pkgconfig(xproto) >= 7.0.15 BuildRequires: xorg-x11-xtrans-devel >= 1.0.3-4 @@ -48,6 +48,7 @@ X.Org X11 libX11 development package %setup -q #setup -q -n %{tarball}-%{gitdate} %patch2 -p1 -b .dont-forward-keycode-0 +%patch3 -p1 %build # sodding libtool @@ -114,6 +115,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man5/*.5* %changelog +* Tue Aug 10 2010 Bill Nottingham - 1.3.4-3 +- Merge upstream commit 54a96360, fixes use-after-free (fd.o 29412) + * Mon Jul 19 2010 Matěj Cepl - 1.3.4-2 - don't own /usr/share/X11, filesystem owns it already (#569395) From 8d7be798e03eb501663bec12008005e3812ab4ac Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Tue, 22 Mar 2011 11:41:17 +1000 Subject: [PATCH 2/2] Add XF86TouchpadOn/Off to KeysymDB (#683950) --- ...adOn-and-XF86TouchpadOff-to-keysymdb.patch | 29 +++++++++++++++++++ libX11.spec | 8 ++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 0001-Add-XF86TouchpadOn-and-XF86TouchpadOff-to-keysymdb.patch diff --git a/0001-Add-XF86TouchpadOn-and-XF86TouchpadOff-to-keysymdb.patch b/0001-Add-XF86TouchpadOn-and-XF86TouchpadOff-to-keysymdb.patch new file mode 100644 index 0000000..aed31f3 --- /dev/null +++ b/0001-Add-XF86TouchpadOn-and-XF86TouchpadOff-to-keysymdb.patch @@ -0,0 +1,29 @@ +From f5b6c3f955ea7b65d2506a3c4a7111166f003704 Mon Sep 17 00:00:00 2001 +From: Peter Hutterer +Date: Tue, 22 Mar 2011 11:28:56 +1000 +Subject: [PATCH] Add XF86TouchpadOn and XF86TouchpadOff to keysymdb + +This patch isn't necessary in Xlib 1.4 and later since the keysymdb has been +made redunant. While we're on 1.3.x, we need it. + +Signed-off-by: Peter Hutterer +--- + src/XKeysymDB | 2 ++ + 1 files changed, 2 insertions(+), 0 deletions(-) + +diff --git a/src/XKeysymDB b/src/XKeysymDB +index 45d8929..28718b4 100644 +--- a/src/XKeysymDB ++++ b/src/XKeysymDB +@@ -352,6 +352,8 @@ XF86Blue :1008FFA6 + XF86Suspend :1008FFA7 + XF86Hibernate :1008FFA8 + XF86TouchpadToggle :1008FFA9 ++XF86TouchpadOn :1008FFB0 ++XF86TouchpadOff :1008FFB1 + + ! XFree86 special action keys + XF86_Switch_VT_1 :1008FE01 +-- +1.7.4 + diff --git a/libX11.spec b/libX11.spec index c9f4ea7..25dc2f6 100644 --- a/libX11.spec +++ b/libX11.spec @@ -4,7 +4,7 @@ Summary: Core X11 protocol client library Name: libX11 Version: 1.3.4 -Release: 3%{?dist} +Release: 4%{?dist} License: MIT Group: System Environment/Libraries URL: http://www.x.org @@ -17,6 +17,8 @@ Source0: http://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.t Patch2: dont-forward-keycode-0.patch Patch3: 54a963608d23d35cd9233b2223f880ac3671f10b.patch +Patch4: 0001-Add-XF86TouchpadOn-and-XF86TouchpadOff-to-keysymdb.patch + BuildRequires: xorg-x11-util-macros BuildRequires: pkgconfig(xproto) >= 7.0.15 BuildRequires: xorg-x11-xtrans-devel >= 1.0.3-4 @@ -49,6 +51,7 @@ X.Org X11 libX11 development package #setup -q -n %{tarball}-%{gitdate} %patch2 -p1 -b .dont-forward-keycode-0 %patch3 -p1 +%patch4 -p1 %build # sodding libtool @@ -115,6 +118,9 @@ rm -rf $RPM_BUILD_ROOT %{_mandir}/man5/*.5* %changelog +* Tue Mar 22 2011 Peter Hutterer 1.3.4-4 +- Add XF86TouchpadOn/Off to KeysymDB (#683950) + * Tue Aug 10 2010 Bill Nottingham - 1.3.4-3 - Merge upstream commit 54a96360, fixes use-after-free (fd.o 29412)