Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libXtst for openSUSE:Factory checked in at 2026-10-16 20:07:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libXtst (Old) and /work/SRC/openSUSE:Factory/.libXtst.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libXtst" Fri Oct 16 20:07:04 2026 rev:15 rq:1384975 version:1.2.5 Changes: -------- --- /work/SRC/openSUSE:Factory/libXtst/libXtst.changes 2026-09-28 10:35:00.508190045 +0200 +++ /work/SRC/openSUSE:Factory/.libXtst.new.3698736/libXtst.changes 2026-10-16 20:07:20.753267383 +0200 @@ -1,0 +2,7 @@ +Thu Oct 15 03:28:53 UTC 2026 - Stefan Dirsch <[email protected]> + +- boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch + * libXtst RECORD EnableContext Reply Endless Loop + (boo#1285083, CVE-2026-109088) + +------------------------------------------------------------------- New: ---- boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch ----------(New B)---------- New: - boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch * libXtst RECORD EnableContext Reply Endless Loop ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libXtst.spec ++++++ --- /var/tmp/diff_new_pack.B6VkUF/_old 2026-10-16 20:07:21.564301272 +0200 +++ /var/tmp/diff_new_pack.B6VkUF/_new 2026-10-16 20:07:21.566301356 +0200 @@ -30,6 +30,7 @@ Source: http://xorg.freedesktop.org/releases/individual/lib/%{name}-%{version}.tar.xz Source1: baselibs.conf Patch1: 0001-boo1281665_CVE-2026-94286_parse_reply_call_callback-check-element-size-against.patch +Patch2: boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch BuildRoot: %{_tmppath}/%{name}-%{version}-build #git#BuildRequires: autoconf >= 2.60, automake, libtool BuildRequires: fdupes ++++++ boo1285083_CVE-2026-109088_parse_reply_call_callback-reject-zero-progress-RECOR.patch ++++++ >From 2ec44091bebb4496ad56e601ecbfb1b42f5524e6 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan <[email protected]> Date: Thu, 1 Oct 2026 16:09:33 +0200 Subject: [PATCH] parse_reply_call_callback: reject zero-progress RECORD reply elements Commit 9556ad67a to address CVE-2016-7952 added no-forward-progress checks for StartOfData, EndOfData, and ClientDied without a sequence. That is however missing two server-controlled cases that can still leave datum_bytes at 0 while bytes remain in the reply buffer: - A XRecordFromClient with a zero BIG-REQUESTS length - An undefined category byte (switch had no default) So XRecordEnableContext() enters an endless busy loop keeping the lock and invoking the application callback with empty data. We need to take care of special case XRecordClientDied though, which is a legitimate case with zero-sized element, so we cannot just reject any element that make no forward progress. To avoid that issue, reject zero-sized XRecordFromClient elements, unknown categories, and any iteration that makes no progress while data remains. This is a follow-up on CVE-2016-7952 and CVE-2026-94286. CVE-2026-109088 Reported-by: Kaya Emre Arikan <[email protected]> Signed-off-by: Olivier Fourdan <[email protected]> Assisted-by: AI --- src/XRecord.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/XRecord.c b/src/XRecord.c index 656f377..ae612d5 100644 --- a/src/XRecord.c +++ b/src/XRecord.c @@ -733,6 +733,8 @@ parse_reply_call_callback( current_index = 0; end = rep->length << 2; do { + unsigned int start_index = current_index; + data = alloc_inter_data(info); if (!data) return Error; @@ -808,6 +810,9 @@ parse_reply_call_callback( if (datum_bytes < 0 || datum_bytes > INT_MAX >> 2) goto out; datum_bytes <<= 2; + /* A client request cannot be zero-sized (incl. BIG-REQUESTS). */ + if (datum_bytes == 0) + goto out; break; case XRecordClientStarted: if (reply == NULL) @@ -838,8 +843,23 @@ parse_reply_call_callback( goto out; datum_bytes = 0; break; + default: + /* + * A follow-up on the previous fix for CVE-2016-7952: + * An unknown category would leave datum_bytes at 0 and + * "livelock" the loop. + */ + goto out; } + /* + * Malformed if this element neither grew nor advanced the index. + * StartOfData / EndOfData are already rejected if current_index < end + * so not a change in behavior. + */ + if (datum_bytes == 0 && current_index == start_index && current_index < end) + goto out; + if (datum_bytes > 0) { if ((unsigned int)datum_bytes > end - current_index) { fprintf(stderr, -- 2.51.0
