Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package xorg-x11-server for openSUSE:Factory
checked in at 2026-07-09 22:18:14
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/xorg-x11-server (Old)
and /work/SRC/openSUSE:Factory/.xorg-x11-server.new.1991 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xorg-x11-server"
Thu Jul 9 22:18:14 2026 rev:452 rq:1364442 version:21.1.21
Changes:
--------
--- /work/SRC/openSUSE:Factory/xorg-x11-server/xorg-x11-server.changes
2026-06-11 17:25:52.898603383 +0200
+++
/work/SRC/openSUSE:Factory/.xorg-x11-server.new.1991/xorg-x11-server.changes
2026-07-09 22:18:26.920225139 +0200
@@ -1,0 +2,11 @@
+Thu Jul 2 09:25:39 UTC 2026 - Stefan Dirsch <[email protected]>
+
+-
bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch
+ * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999, bsc#1268893)
+-
bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch
+ * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-55999,
bsc#1268893)
+- U_GLX-Free-the-tag-of-the-old-context-later.patch
+
bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch
+ * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000,
bsc#1268894)
+
+-------------------------------------------------------------------
New:
----
U_GLX-Free-the-tag-of-the-old-context-later.patch
bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch
bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch
bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch
----------(New B)----------
New: * GLX contextTags Use-After-Free in CommonMakeCurrent()
(CVE-2026-55999, bsc#1268893)
- U_GLX-Free-the-tag-of-the-old-context-later.patch
bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch
New:
-
bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch
* glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999, bsc#1268893)
New: * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999, bsc#1268893)
-
bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch
* GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-55999,
bsc#1268893)
New:- U_GLX-Free-the-tag-of-the-old-context-later.patch
bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch
* GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000,
bsc#1268894)
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ xorg-x11-server.spec ++++++
--- /var/tmp/diff_new_pack.nU8JgG/_old 2026-07-09 22:18:28.512279338 +0200
+++ /var/tmp/diff_new_pack.nU8JgG/_new 2026-07-09 22:18:28.516279474 +0200
@@ -259,6 +259,11 @@
Patch1266302:
bsc1266302_CVE-2026-XXXX9_0001-dri2-Use-booleans-for-fake-front-buffer-tracking-in-.patch
Patch1266303:
bsc1266302_CVE-2026-XXXX9_0002-dri2-Deduplicate-attachments-in-do_get_buffer.patch
+Patch1268893:
bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch
+Patch1268894:
bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch
+Patch1268895: U_GLX-Free-the-tag-of-the-old-context-later.patch
+Patch1268896:
bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch
+
%description
This package contains the X.Org Server.
@@ -429,6 +434,11 @@
%patch -P 1266302 -p1
%patch -P 1266303 -p1
+%patch -P 1268893 -p1
+%patch -P 1268894 -p1
+%patch -P 1268895 -p1
+%patch -P 1268896 -p1
+
%build
# We have some -z now related errors during X default startup (boo#1197994):
# - when loading modesetting: gbm_bo_get_plane_count
++++++ U_GLX-Free-the-tag-of-the-old-context-later.patch ++++++
>From 4781f2a5a8c2c2b000374e2d87982a6701d5a6b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Do=C4=9Fukan=20Korkmazt=C3=BCrk?= <[email protected]>
Date: Tue, 22 Nov 2022 13:43:16 -0500
Subject: [PATCH] GLX: Free the tag of the old context later
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
In CommonMakeCurrent() function, the tag of the old context is freed
before the new context is made current. This is problematic because if
the CommonMakeNewCurrent() function fails, the tag of the old context
ends up being removed, even though it is still active. This causes
subsequent glXMakeCurrent() or glXMakeContextCurrent() requests to
generate a GLXBadContextTag error.
This change moves the function call that frees the old tag to a location
where the result of CommonMakeNewCurrent() call is known and it is safe
to free it.
Signed-off-by: Doğukan Korkmaztürk <[email protected]>
---
glx/vndcmds.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/glx/vndcmds.c b/glx/vndcmds.c
index d6d8719e1..d1e088973 100644
--- a/glx/vndcmds.c
+++ b/glx/vndcmds.c
@@ -165,9 +165,6 @@ static int CommonLoseCurrent(ClientPtr client,
GlxContextTagInfo *tagInfo)
tagInfo->tag, // No old context tag,
None, None, None, 0);
- if (ret == Success) {
- GlxFreeContextTag(tagInfo);
- }
return ret;
}
@@ -259,7 +256,6 @@ static int CommonMakeCurrent(ClientPtr client,
if (ret != Success) {
return ret;
}
- oldTag = NULL;
}
if (newVendor != NULL) {
@@ -270,6 +266,9 @@ static int CommonMakeCurrent(ClientPtr client,
} else {
reply.contextTag = 0;
}
+
+ GlxFreeContextTag(oldTag);
+ oldTag = NULL;
}
reply.contextTag = GlxCheckSwap(client, reply.contextTag);
--
2.51.0
++++++
bsc1268893_CVE-2026-55999_0002-fb-mi-glamor-reject-glyphs-with-negative-dimensions.patch
++++++
@@ -, +, @@
dimensions
---
fb/fbglyph.c | 4 +-
glamor/glamor_glyphblt.c | 2 +-
mi/miglblt.c | 2 +-
test/pyxtest/meson.build | 1 +
test/pyxtest/test_fb.py | 176 +++++++++++++++++++++++++++++++++++++++
5 files changed, 181 insertions(+), 4 deletions(-)
create mode 100644 test/pyxtest/test_fb.py
--- a/fb/fbglyph.c
+++ a/fb/fbglyph.c
@@ -95,7 +95,7 @@ fbPolyGlyphBlt(DrawablePtr pDrawable,
pglyph = FONTGLYPHBITS(pglyphBase, pci);
gWidth = GLYPHWIDTHPIXELS(pci);
gHeight = GLYPHHEIGHTPIXELS(pci);
- if (gWidth && gHeight) {
+ if (gWidth > 0 && gHeight > 0) {
gx = x + pci->metrics.leftSideBearing;
gy = y - pci->metrics.ascent;
if (glyph && gWidth <= sizeof(FbStip) * 8 &&
@@ -197,7 +197,7 @@ fbImageGlyphBlt(DrawablePtr pDrawable,
pglyph = FONTGLYPHBITS(pglyphBase, pci);
gWidth = GLYPHWIDTHPIXELS(pci);
gHeight = GLYPHHEIGHTPIXELS(pci);
- if (gWidth && gHeight) {
+ if (gWidth > 0 && gHeight > 0) {
gx = x + pci->metrics.leftSideBearing;
gy = y - pci->metrics.ascent;
if (glyph && gWidth <= sizeof(FbStip) * 8 &&
--- a/glamor/glamor_glyphblt.c
+++ a/glamor/glamor_glyphblt.c
@@ -90,7 +90,7 @@ glamor_poly_glyph_blt_gl(DrawablePtr drawable, GCPtr gc,
int h = GLYPHHEIGHTPIXELS(charinfo);
uint8_t *glyphbits = FONTGLYPHBITS(NULL, charinfo);
- if (w && h) {
+ if (w > 0 && h > 0) {
int glyph_x = x + charinfo->metrics.leftSideBearing;
int glyph_y = y - charinfo->metrics.ascent;
int glyph_stride = GLYPHWIDTHBYTESPADDED(charinfo);
--- a/mi/miglblt.c
+++ a/mi/miglblt.c
@@ -143,7 +143,7 @@ miPolyGlyphBlt(DrawablePtr pDrawable, GC * pGC, int x, int
y, unsigned int nglyp
pglyph = FONTGLYPHBITS(pglyphBase, pci);
gWidth = GLYPHWIDTHPIXELS(pci);
gHeight = GLYPHHEIGHTPIXELS(pci);
- if (gWidth && gHeight) {
+ if (gWidth > 0 && gHeight > 0) {
nbyGlyphWidth = GLYPHWIDTHBYTESPADDED(pci);
nbyPadGlyph = BitmapBytePad(gWidth);
--
++++++
bsc1268893_CVE-2026-55999_0003-glamor-reject-fonts-with-per-glyph-metrics-exceeding.patch
++++++
--- a/glamor/glamor_font.c
+++ a/glamor/glamor_font.c
@@ -77,6 +77,9 @@ glamor_font_get(ScreenPtr screen, FontPtr font)
glyph_width_pixels = font->info.maxbounds.rightSideBearing -
font->info.minbounds.leftSideBearing;
glyph_height = font->info.maxbounds.ascent + font->info.maxbounds.descent;
+ if (glyph_width_pixels <= 0 || glyph_height <= 0)
+ return NULL;
+
glyph_width_bytes = (glyph_width_pixels + 7) >> 3;
glamor_font->glyph_width_pixels = glyph_width_pixels;
@@ -136,7 +139,28 @@ glamor_font_get(ScreenPtr screen, FontPtr font)
if (count) {
char *dst;
char *src = glyph->bits;
- unsigned y;
+ int gw = GLYPHWIDTHBYTES(glyph);
+ int gh = GLYPHHEIGHTPIXELS(glyph);
+
+ /* Reject fonts where any per-glyph metric is negative
+ * or exceeds the atlas slot size derived from maxbounds.
+ * The PCF parser in libXfont2 does not recompute
+ * maxbounds from per-glyph data, so a crafted PCF file
+ * can violate the maxbounds invariant.
+ *
+ * gw is passed as size_t to memcpy and a negative value
+ * would thus result in OOB access.
+ *
+ * Returning NULL makes glamor fall back to software
+ * rendering.
+ */
+ if (gw < 0 || gh < 0 ||
+ gw > glyph_width_bytes || gh > glyph_height) {
+ glDeleteTextures(1, &glamor_font->texture_id);
+ glamor_font->texture_id = 0;
+ free(bits);
+ return NULL;
+ }
dst = bits;
/* get offset of start of first row */
@@ -145,8 +169,8 @@ glamor_font_get(ScreenPtr screen, FontPtr font)
dst += (row & 1) ? glamor_font->row_width : 0;
dst += col * glyph_width_bytes;
- for (y = 0; y < GLYPHHEIGHTPIXELS(glyph); y++) {
- memcpy(dst, src, GLYPHWIDTHBYTES(glyph));
+ for (int y = 0; y < gh; y++) {
+ memcpy(dst, src, gw);
dst += overall_width;
src += GLYPHWIDTHBYTESPADDED(glyph);
}
++++++
bsc1268894_CVE-2026-56000_0001-glx-free-old-context-tag-before-allocating-new-one-i.patch
++++++
diff --git a/glx/vndcmds.c b/glx/vndcmds.c
index cb3732d2aa..97a6b685e9 100644
--- a/glx/vndcmds.c
+++ b/glx/vndcmds.c
@@ -256,6 +256,11 @@ static int CommonMakeCurrent(ClientPtr client,
if (ret != Success) {
return ret;
}
+ // Free the old tag before calling CommonMakeNewCurrent(),
+ // which may call GlxAllocContextTag() and realloc the
+ // contextTags array, invalidating the oldTag pointer.
+ GlxFreeContextTag(oldTag);
+ oldTag = NULL;
}
if (newVendor != NULL) {
@@ -266,9 +271,6 @@ static int CommonMakeCurrent(ClientPtr client,
} else {
reply.contextTag = 0;
}
-
- GlxFreeContextTag(oldTag);
- oldTag = NULL;
}
reply.contextTag = GlxCheckSwap(client, reply.contextTag);
