sync: Do not fail SyncAddTriggerToSyncObject() - xorg/xserver - X server (mirrored from https://gitlab.freedesktop.org/xorg/xserver)

X server (mirrored from https://gitlab.freedesktop.org/xorg/xserver) keithp

diff options

author	Olivier Fourdan <ofourdan@redhat.com>	2025年01月20日 17:06:07 +0100
committer	Olivier Fourdan <ofourdan@redhat.com>	2025年02月25日 19:38:11 +0100
commit	6f567221a61663b5ec959817cc11ecb1f15ce205 (patch)
tree	c774d4c54e536b78939a933de599fa31546854d4
parent	fb6df2a68c31bd025182483b0692e36f3b9f51a3 (diff)

sync: Do not fail SyncAddTriggerToSyncObject()

We do not want to return a failure at the very last step in SyncInitTrigger() after having all changes applied. SyncAddTriggerToSyncObject() must not fail on memory allocation, if the allocation of the SyncTriggerList fails, trigger a FatalError() instead. Related to CVE-2025-26601, ZDI-CAN-25870 Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> (cherry picked from commit 8cbc90c8817306af75a60f494ec9dbb1061e50db) Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1831>

Diffstat

-rw-r--r--

Xext/sync.c

1 files changed, 3 insertions, 4 deletions

diff --git a/Xext/sync.c b/Xext/sync.c
index 9fc82443b..4fd2baf55 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c

@@ -200,8 +200,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger)

return Success;

}

- if (!(pCur = malloc(sizeof(SyncTriggerList))))

- return BadAlloc;

+ /* Failure is not an option, it's succeed or burst! */

+ pCur = XNFalloc(sizeof(SyncTriggerList));

pCur->pTrigger = pTrigger;

pCur->next = pTrigger->pSync->pTriglist;

@@ -409,8 +409,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,

* a new counter on a trigger

if (newSyncObject) {

- if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)

- return rc;

+ SyncAddTriggerToSyncObject(pTrigger);

}

else if (pCounter && IsSystemCounter(pCounter)) {

SyncComputeBracketValues(pCounter);

generated by cgit v1.2.3 (git 2.39.1) at 2025年04月27日 00:20:12 +0000