|
 |
6996b1 |
From 337d8d48b618d4fc0168a7b978be4c3447650b04 Mon Sep 17 00:00:00 2001
|
|
|
6996b1 |
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
|
6996b1 |
Date: Fri, 5 Apr 2024 15:24:49 +0200
|
|
|
6996b1 |
Subject: [PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs()
|
|
|
6996b1 |
|
|
|
6996b1 |
ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and
|
|
|
6996b1 |
then frees it using FreeGlyph() to decrease the reference count, after
|
|
|
6996b1 |
AddGlyph() has increased it.
|
|
|
6996b1 |
|
|
|
6996b1 |
AddGlyph() however may chose to reuse an existing glyph if it's already
|
|
|
6996b1 |
in the glyphSet, and free the glyph that was given, in which case the
|
|
|
6996b1 |
caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an
|
|
|
6996b1 |
already freed glyph, as reported by ASan:
|
|
|
6996b1 |
|
|
|
6996b1 |
READ of size 4 thread T0
|
|
|
6996b1 |
#0 in FreeGlyph xserver/render/glyph.c:252
|
|
|
6996b1 |
#1 in ProcRenderAddGlyphs xserver/render/render.c:1174
|
|
|
6996b1 |
#2 in Dispatch xserver/dix/dispatch.c:546
|
|
|
6996b1 |
#3 in dix_main xserver/dix/main.c:271
|
|
|
6996b1 |
#4 in main xserver/dix/stubmain.c:34
|
|
|
6996b1 |
#5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
|
6996b1 |
#6 in __libc_start_main_impl ../csu/libc-start.c:360
|
|
|
6996b1 |
#7 (/usr/bin/Xwayland+0x44fe4)
|
|
|
6996b1 |
Address is located 0 bytes inside of 64-byte region
|
|
|
6996b1 |
freed by thread T0 here:
|
|
|
6996b1 |
#0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
|
|
|
6996b1 |
#1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538
|
|
|
6996b1 |
#2 in AddGlyph xserver/render/glyph.c:295
|
|
|
6996b1 |
#3 in ProcRenderAddGlyphs xserver/render/render.c:1173
|
|
|
6996b1 |
#4 in Dispatch xserver/dix/dispatch.c:546
|
|
|
6996b1 |
#5 in dix_main xserver/dix/main.c:271
|
|
|
6996b1 |
#6 in main xserver/dix/stubmain.c:34
|
|
|
6996b1 |
#7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
|
6996b1 |
previously allocated by thread T0 here:
|
|
|
6996b1 |
#0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69
|
|
|
6996b1 |
#1 in AllocateGlyph xserver/render/glyph.c:355
|
|
|
6996b1 |
#2 in ProcRenderAddGlyphs xserver/render/render.c:1085
|
|
|
6996b1 |
#3 in Dispatch xserver/dix/dispatch.c:546
|
|
|
6996b1 |
#4 in dix_main xserver/dix/main.c:271
|
|
|
6996b1 |
#5 in main xserver/dix/stubmain.c:34
|
|
|
6996b1 |
#6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
|
|
|
6996b1 |
SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph
|
|
|
6996b1 |
|
|
|
6996b1 |
To avoid that, make sure not to free the given glyph in AddGlyph().
|
|
|
6996b1 |
|
|
|
6996b1 |
v2: Simplify the test using the boolean returned from AddGlyph() (Michel)
|
|
|
6996b1 |
v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter)
|
|
|
6996b1 |
|
|
|
6996b1 |
Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs
|
|
|
6996b1 |
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
|
|
|
6996b1 |
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
|
6996b1 |
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1476>
|
|
|
6996b1 |
---
|
|
|
6996b1 |
render/glyph.c | 2 --
|
|
|
6996b1 |
1 file changed, 2 deletions(-)
|
|
|
6996b1 |
|
|
|
6996b1 |
diff --git a/render/glyph.c b/render/glyph.c
|
|
|
6996b1 |
index 13991f8a1..5fa7f3b5b 100644
|
|
|
6996b1 |
--- a/render/glyph.c
|
|
|
6996b1 |
+++ b/render/glyph.c
|
|
|
6996b1 |
@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id)
|
|
|
6996b1 |
gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature,
|
|
|
6996b1 |
TRUE, glyph->sha1);
|
|
|
6996b1 |
if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) {
|
|
|
6996b1 |
- FreeGlyphPicture(glyph);
|
|
|
6996b1 |
- dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH);
|
|
|
6996b1 |
glyph = gr->glyph;
|
|
|
6996b1 |
}
|
|
|
6996b1 |
else if (gr->glyph != glyph) {
|
|
|
6996b1 |
--
|
|
|
6996b1 |
2.44.0
|
|
|
6996b1 |
|