diff --git a/srcpkgs/xorg-server/patches/fix-use-after-free-after-switch-vt.patch b/srcpkgs/xorg-server/patches/fix-use-after-free-after-switch-vt.patch new file mode 100644 index 0000000000..8627de7e70 --- /dev/null +++ b/srcpkgs/xorg-server/patches/fix-use-after-free-after-switch-vt.patch @@ -0,0 +1,30 @@ +From 919f1f46fc67dae93b2b3f278fcbfc77af34ec58 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Mon, 31 Aug 2020 12:10:43 +0200 +Subject: [PATCH] xfree86: Take second reference for SavedCursor in + xf86CursorSetCursor + +The same pointer is kept in CurrentCursor as well, therefore two +RefCursor calls are needed. + +Fixes use-after-free after switching VTs. + +Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067 +--- + hw/xfree86/ramdac/xf86CursorRD.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git hw/xfree86/ramdac/xf86CursorRD.c hw/xfree86/ramdac/xf86CursorRD.c +index 9aa3de97bd..c8362d1690 100644 +--- hw/xfree86/ramdac/xf86CursorRD.c ++++ hw/xfree86/ramdac/xf86CursorRD.c +@@ -334,6 +334,9 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs, + ScreenPriv->HotY = cursor->bits->yhot; + + if (!infoPtr->pScrn->vtSema) { ++ cursor = RefCursor(cursor); ++ if (ScreenPriv->SavedCursor) ++ FreeCursor(ScreenPriv->SavedCursor, None); + ScreenPriv->SavedCursor = cursor; + return; + } diff --git a/srcpkgs/xorg-server/template b/srcpkgs/xorg-server/template index 5f863a8af5..e04f24d115 100644 --- a/srcpkgs/xorg-server/template +++ b/srcpkgs/xorg-server/template @@ -1,7 +1,7 @@ # Template file for 'xorg-server' pkgname=xorg-server version=1.20.9 -revision=1 +revision=2 build_style=meson configure_args="-Dipv6=true -Dxorg=true -Dxnest=true -Dxephyr=true -Dxvfb=true -Dhal=false -Dudev=true -Dxkb_dir=/usr/share/X11/xkb @@ -30,8 +30,6 @@ lib32disabled=yes provides="xserver-abi-extension-10_1 xserver-abi-input-24_1 xserver-abi-video-24_1 xf86-video-modesetting-1_1" replaces="xf86-video-modesetting>=0 glamor-egl>=0" -subpackages="xorg-server-devel xorg-server-xdmx xorg-server-xephyr - xorg-server-xnest xorg-server-xvfb xorg-server-xwayland" conf_files="/etc/X11/Xwrapper.config" build_options="elogind"