src-cursor-fix-xfc-NULL-pointer-dereference.patch 1.2 KB

123456789101112131415161718192021222324252627282930
  1. From 95a10ab64c2dbbec2c8dad91a5ffb73a0d68474b Mon Sep 17 00:00:00 2001
  2. From: Jonathan Liu <net147@gmail.com>
  3. Date: Mon, 16 Mar 2020 20:04:06 +1100
  4. Subject: [PATCH] src/cursor: fix xfc NULL pointer dereference
  5. xfc->width and xfc->height for the XFixes cursor image returned from
  6. XFixesGetCursorImage(dpy) are accessed without first checking that xfc
  7. is not NULL. This can result in the server sometimes crashing when
  8. moving a Google Chrome window.
  9. Fixes: 37c946191a0f ("Broken cursor bugfix for 64 bit systems (#49)")
  10. Upstream-Status: Accepted
  11. Signed-off-by: Jonathan Liu <net147@gmail.com>
  12. ---
  13. src/cursor.c | 2 +-
  14. 1 file changed, 1 insertion(+), 1 deletion(-)
  15. diff --git a/src/cursor.c b/src/cursor.c
  16. index 39e73a6..74a08c6 100644
  17. --- a/src/cursor.c
  18. +++ b/src/cursor.c
  19. @@ -1311,7 +1311,7 @@ static int get_exact_cursor(int init) {
  20. /* retrieve the cursor info + pixels from server: */
  21. xfc = XFixesGetCursorImage(dpy);
  22. - {
  23. + if (xfc) {
  24. /* 2017-07-09, Stephan Fuhrmann: This fixes an implementation flaw for 64 bit systems.
  25. * The XFixesCursorImage structure says xfc->pixels is (unsigned long*) in the structure, but
  26. * the protocol spec says it's 32 bit per pixel