Grab the pointer against the root window instead of the client we're attempting
to move and/or resize; prevents XNextEvent() from blocking on a client that
might have been moved to a Withdrawn state.
behavior noticed and reported by zenitds at proton.me - thanks!
Need to use unswapped length to send reply in
ProcXIGetSelectedEvents() (CVE-2024-31080) and
ProcXiPassiveGrabDevice() (CVE-2024-31081)
Fix refcounting of glyphs during ProcRenderAddGlyphs() (CVE-2024-31083)
from matthieu@
this is errata/7.3/028_xserver.patch.sig
Need to use unswapped length to send reply in
ProcXIGetSelectedEvents() (CVE-2024-31080) and
ProcXiPassiveGrabDevice() (CVE-2024-31081)
Fix refcounting of glyphs during ProcRenderAddGlyphs() (CVE-2024-31083)
from matthieu@
this is errata/7.4/016_xserver.patch.sig
Need to use unswapped length to send reply in
ProcXIGetSelectedEvents() (CVE-2024-31080) and
ProcXiPassiveGrabDevice() (CVE-2024-31081)
Fix refcounting of glyphs during ProcRenderAddGlyphs() (CVE-2024-31083)
from matthieu@
this is errata/7.5/001_xserver.patch.sig
Fix off-by-one in dlist allocation when checking whether to allocate a
new block. This fixes segfaults in dlist functions that occur on
applications making heavy use of display lists that exceed BLOCK_SIZE.
ok jsg@ and stsp@, who also both helped me track down the issue.