summaryrefslogtreecommitdiff
path: root/os
AgeCommit message (Collapse)AuthorFilesLines
2014-12-08dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]Alan Coopersmith1-0/+6
GetHosts() iterates over all the hosts it has in memory, and copies them to a buffer. The buffer length is calculated by iterating over all the hosts and adding up all of their combined length. There is a potential integer overflow, if there are lots and lots of hosts (with a combined length of > ~4 gig). This should be possible by repeatedly calling ProcChangeHosts() on 64bit machines with enough memory. This patch caps the list at 1mb, because multi-megabyte hostname lists for X access control are insane. Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-12-08unchecked malloc may allow unauthed client to crash Xserver [CVE-2014-8091]Alan Coopersmith1-0/+4
authdes_ezdecode() calls malloc() using a length provided by the connection handshake sent by a newly connected client in order to authenticate to the server, so should be treated as untrusted. It didn't check if malloc() failed before writing to the newly allocated buffer, so could lead to a server crash if the server fails to allocate memory (up to UINT16_MAX bytes, since the len field is a CARD16 in the X protocol). Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com> Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-11-30Fix overflow of ConnectionOutput->size and ->countPeter Harris1-3/+4
When (long) is larger than (int), and when realloc succeeds with sizes larger than INT_MAX, ConnectionOutput->size and ConnectionOutput->count overflow and become negative. When ConnectionOutput->count is negative, InsertIOV does not actually insert an IOV, and FlushClient goes into an infinite loop of writev(fd, iov, 0) [an empty list]. Avoid this situation by killing the client when it has more than INT_MAX unread bytes of data. Signed-off-by: Peter Harris <pharris@opentext.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-11-30os: "Server terminated successfully" is not an errorAaron Plattner1-2/+5
ErrorFSigSafe calls LogVMessageVerbSigSafe with the message type set to X_ERROR. That generates this in the log: (EE) Server terminated successfully (0). Closing log file. People periodically report this as an error, sometimes quoting this "error" rather than an earlier error that actually caused a problem. v2: Use X_INFO instead of X_NOTICE Signed-off-by: Aaron Plattner <aplattner@nvidia.com> Reviewed-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-11-12Drop trailing whitespacesPeter Hutterer10-61/+61
sed -i "s/[ ]\+$//g" **/*.(c|h) happy reviewing... git diff -w is an empty diff. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-10-28os: Eliminate uninitialized value warnings from access.cKeith Packard1-8/+8
The ConvertAddr function doesn't reliably set the 'addr' return value, and so callers are getting flagged for using potentially uninitialized values. Initialize the value in the callers to NULL and then go ahead and check for NULL values before using them. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-10-27os: -displayfd should check ports up to 65535Jon TURNEY1-1/+1
-displayfd should check ports up to 65535 Noticed during https://cygwin.com/ml/cygwin-xfree/2014-07/msg00024.html Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-23If fork fails in System(), don't fallthrough to exec()Alan Coopersmith1-0/+1
In the unlikely event of a failure in creating processes, signal masks will fall from the panels above you. Secure your mask before telling your child what to do, since it won't exist, and you will instead cause the server itself to be replaced by a shell running the target program. Found by Coverity #53397: Missing break in switch Execution falls through to the next case statement or default; this might indicate a common typo. In System: Missing break statement between cases in switch statement (CWE-484) Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Matthieu Herrb <matthieu@herrb.eu> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-09-22os: Don't listen to 'tcp' by default. Add '-listen' option. [v2]Keith Packard1-0/+29
This disables the tcp listen socket by default. Then, it uses a new xtrans interface, TRANS(Listen), to provide a command line option to re-enable those if desired. v2: Leave unix socket enabled by default. Add configure options. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2014-09-18xserver: Move 'pragma GCC diagnostic' outside functionsJon TURNEY1-6/+4
$ gcc --version gcc (Gentoo 4.4.3-r2 p1.2) 4.4.3 /jhbuild/checkout/xorg/xserver/os/log.c: In function ‘LogInit’: /jhbuild/checkout/xorg/xserver/os/log.c:199: error: #pragma GCC diagnostic not allowed inside functions /jhbuild/checkout/xorg/xserver/os/log.c:201: warning: format not a string literal, argument types not checked /jhbuild/checkout/xorg/xserver/os/log.c:212: error: #pragma GCC diagnostic not allowed inside functions /jhbuild/checkout/xorg/xserver/os/log.c:214: warning: format not a string literal, argument types not checked etc. Reviewed-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-09-17Update help text since -iglx is now the defaultJon TURNEY1-2/+2
This should have been part of d0da0e9c3bb8fe0cd4879ecb24d21715bfaa209b Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Eric Anholt <eric@anholt.net> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-09-11glx: Disable indirect GLX contexts by default.Eric Anholt1-1/+1
Almost every situation of someone running indirect GLX is a mistake that results in X Server crashes. Indirect GLX is the cause of regular security vulnerabilities, and rarely provides any capability to the user. Just disable it unless someone wants to enable it for their special use case (using +iglx on the command line). Signed-off-by: Eric Anholt <eric@anholt.net> Acked-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-09-11os/log: adjust gcc version conditions for #pragmaThomas Petazzoni1-2/+2
In commit e67f2d7e0f9189beb2907fa06cff5ecc7f35f922 ("gcc 4.2.1 doesn't support #pragma GCC diagnostic ignored"), some compile time conditionals were added around the #pragma usage. Those conditionals ensure that the #pragma are not used on gcc <= 4.2. However, the usage of #pragma diagnostic inside functions was only added in gcc 4.6, and a build failure is therefore experienced with gcc 4.5: log.c: In function 'LogInit': log.c:199:9: error: #pragma GCC diagnostic not allowed inside functions log.c:201:9: warning: format not a string literal, argument types not checked log.c:212:9: error: #pragma GCC diagnostic not allowed inside functions log.c:214:17: warning: format not a string literal, argument types not checked $ ./host/usr/bin/powerpc-linux-gnu-gcc -v [...] gcc version 4.5.2 (Sourcery G++ Lite 2011.03-38) This patch therefore adjusts the compile time conditionals to make sure the #pragma is not used on gcc <= 4.5, and only used on gcc >= 4.6. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Acked-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-08-12Merge remote-tracking branch 'jeremyhu/master'Keith Packard1-7/+0
2014-08-12os: Regenerate os/oscolor.c from app/rgb #52289Daphne Pfister1-745/+809
Regenerate os/oscolor.c from rgb.txt. This adds the following colors: aqua, lime, fuchsia, crimson, indigo, olive, rebecca purple, silver and teal. It also adds versions of gray, grey, green, maroon and purple prefixed with web and x11 for the colors that are different between X11 and HTML/CSS web colors. Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=52289 Related: https://bugs.freedesktop.org/show_bug.cgi?id=80371 Signed-off-by: nobody Tested-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-08-11ListenOnOpenFD: Remove Resets since this is intended to be for hotplugging ↵Jeremy Huddleston Sequoia1-7/+0
connections pharris says that the resets should not be done in the hotplugging case. This may fix a crash reported against XQuartz: http://xquartz.macosforge.org/trac/ticket/869 Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com> Reviewed-by: Peter Harris <pharris@opentext.com>
2014-07-29os: Remove LocalClientCredAdam Jackson1-27/+0
The comment lies, shm hasn't used this code since: commit fdef7be5c8d5989e0aa453d0a5b86d0a6952e960 Author: Alan Coopersmith <alan.coopersmith@sun.com> Date: Tue Oct 9 18:44:04 2007 -0700 Sun bug 6589829: include zoneid of shm segment in access [...] Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-07-29os: Remove deprecated malloc/free wrappersAdam Jackson1-48/+0
Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-07-17Avoid starting a comment with */*Peter Harris1-3/+3
Even though -Wcomment doesn't mind it (in gcc or clang), the appearance of */* confuses the syntax highlighter of some editors (eg. vim), and causes warnings in MSVC. Signed-off-by: Peter Harris <pharris@opentext.com> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-07-10os: prevent negative array index access (#80890)Peter Hutterer1-1/+1
If an empty string is provided to LogMessageVerbSigSafe, the length of the printed string is 0. Read-only access only and the only effect it had was adding a linebreak or not. X.Org Bug 80890 <http://bugs.freedesktop.org/show_bug.cgi?id=80890> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-05-23os: automatically switch to sigsafe logging when neededPeter Hutterer1-32/+33
If we're smart enough to warn, we should be smart enough to just pass it through to the right function. Worst case we lose some formatting specifiers which pnprintf will complain about anyway. And in most cases it won't matter. This requires renaming pnprintf to vpnprintf and changing the size_t to int to be compatible with Xvscnprintf. pnprintf is internal only, the others are exported API so we can't change them as easily. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-04-30os: Add -displayfd into -help textRobert Ancell1-0/+1
Add -displayfd into -help text. It was mentioned in the man page but seem to have been missed from the -help text. Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-23Add a command line argument for disabling indirect GLX.Eric Anholt1-0/+8
The attack surface for indirect GLX is huge, and it's of no use to most people (if you get an indirect GL context, you're better served by a immediate X error than actually trying to use an indirect GL context and finding out that it doesn't support doing anything you want, slowly). This flag gives you a chance to disable indirect GLX in environments where you just don't need it. I put in both the '+' and '-' arguments right now, so that it's easy to patch the value to change the default policy. Signed-off-by: Eric Anholt <eric@anholt.net> Acked-by: Julien Cristau <jcristau@debian.org> Reviewed-by: Keith Packard <keithp@keithp.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-21os: Initialize the set of signals to be suppressed during our handler.Eric Anholt1-0/+1
Fixes a valgrind complaint: ==8805== Syscall param rt_sigaction(act->sa_mask) points to uninitialised byte(s) ==8805== at 0x5EB8315: __libc_sigaction (sigaction.c:66) ==8805== by 0x5B13DA: busfault_init (busfault.c:145) ==8805== by 0x5A60A2: OsInit (osinit.c:191) ==8805== by 0x46EBA2: dix_main (main.c:163) Signed-off-by: Eric Anholt <eric@anholt.net> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-18os: Ignore log file write failuresKeith Packard1-2/+8
There's no place to log the message if writing to the log file fails, and we surely don't want to crash in that case, so just ignore errors and keep going. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Jamey Sharp <jamey@minilop.net>
2014-04-18os: Make sure that writing our pid to the lock file actually workedKeith Packard1-1/+2
There's no sense verifying that we can create the lock file and then ignoring the return value from write. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Jamey Sharp <jamey@minilop.net>
2014-04-18os: FatalError if -displayfd writes failKeith Packard1-2/+4
When the server is started with the -displayfd option, check to make sure that the writes succeed and give up running if they don't. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Jamey Sharp <jamey@minilop.net>
2014-04-18os: Clear the -displayfd option after closing the fileKeith Packard1-0/+1
Failing to clear this means that we'll attempt to write the display number to a random file descriptor on subsequent X server generations. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Jamey Sharp <jamey@minilop.net>
2014-03-27Handle -displayfd and an explicit display number sensiblyJon TURNEY2-7/+7
Handle -displayfd and an explicit display number sensibly, e.g. use the explicitly specified display number, and write it to the displayfd v2: displayfd might be 0, so use -1 as invalid value v3: Rebase for addition of NoListenAll flag Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk> Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
2014-03-25os: Add AddClientOnOpenFD() to create a new client for an file descriptorKristian Høgsberg1-0/+27
When the Xwayland server is socket-activated, we need to connect and initialize the window manager before the activating client gets to proceed with connecting. We do this by passing a socket file descriptor for the window manager connection to the Xwayland server, which then uses this new function to set it up as an X client. Signed-off-by: Kristian Høgsberg <krh@bitplanet.net> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-03-20os: Add a mechanism to prevent creating any listen socketsKristian Høgsberg2-4/+9
A socket-activated server will receive its listening sockets from the parent process and should not create its own sockets. This patch introduces a NoListen flag that can be set by a DDX to prevent the server from creating the sockets. When NoListen is enabled, we also disable the server lock checking, since the parent process is responsible for checking the lock before picking the display name and creating the sockets. Signed-off-by: Kristian Høgsberg <krh@bitplanet.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2014-03-20os: Always compile ListenOnOpenFD() and export itKristian Høgsberg1-5/+2
This function was written to allow the X server to inherit the listen socket from launchd on OS X. The code is not specific to OS X though and will be useful for on-demand launched Xwayland servers. Signed-off-by: Kristian Høgsberg <krh@bitplanet.net> Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2014-02-24gcc 4.2.1 doesn't support #pragma GCC diagnostic ignoredMatthieu Herrb1-0/+4
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-02-04Revert "os: xstrtokenize takes and returns const char * now"Peter Hutterer1-3/+3
This reverts commit d0339a5c66846c9f14e3b584e34688520a0916ab. seriously, what the fuck? Are we making xstrdup() return a const char now too? Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2014-01-22os: Fix -Wshadow errorsKeith Packard2-24/+22
Rename variables to avoid shadowing globals Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-22Ignore a couple of format-nonliteral warningsKeith Packard1-0/+2
These are generated in code which uses sprintf as a convenient way to construct strings from various pieces. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-22Merge remote-tracking branch 'whot/for-keith'Keith Packard1-0/+27
2014-01-22If EAGAIN == EWOULDBLOCK, only need to check errno for one of themAlan Coopersmith1-3/+8
Solaris <sys/errno.h> has: #define EWOULDBLOCK EAGAIN so checking (errno == EAGAIN || errno == EWOULDBLOCK) is overkill. This leads cppcheck 1.62 to complain: [xserver/os/io.c:365] -> [xserver/os/io.c:365]: (style) Same expression on both sides of '||'. [xserver/os/io.c:941] -> [xserver/os/io.c:941]: (style) Same expression on both sides of '||'. This quiets it, and reduces the number of calls Solaris Studio cc generates to the __errno() function to get the thread-specific errno value. Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> Signed-off-by: Keith Packard <keithp@keithp.com>
2014-01-15os: restrict display names to digitsPeter Hutterer1-0/+27
We call atoi() on the server's display to get the socket but otherwise use the unmodified display for log file name, xkb paths, etc. This results in Xorg :banana being the equivalent of Xorg :0, except for the log files being in /var/log/Xorg.banana.log. I'm not sure there's a good use-case for this behaviour. Check the display for something that looks reasonable, i.e. digits only, but do allow for :0.0 (i.e. digits, followed by a period, followed by one or two digits). Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> Reviewed-by: Keith Packard <keithp@keithp.com>
2014-01-12Clean up a few function prototypes to not place formals in /**/Keith Packard1-24/+27
This just removes the comment markers from around the formals in several function prototypes near where pointer -> void * changes were made. There are plenty more of these to fix. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-01-12Replace 'pointer' type with 'void *'Keith Packard8-67/+67
This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer' is used throughout the X server for other things, and having duplicate names generates compiler warnings. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-12os: xstrtokenize takes and returns const char * nowKeith Packard1-3/+3
Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12os: Clean up warningsKeith Packard2-3/+3
Just const char stuff. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-12-12darwin: Don't leave stdin/stdout closedJeremy Huddleston Sequoia1-2/+11
<rdar://problem/15609419> Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
2013-12-02miext: Move SyncShm FDs out of the way of clientsKeith Packard1-0/+24
Applications may end up allocating a bunch of shmfence objects, each of which uses a file descriptor, which must be kept open lest some other client ask for a copy of it later on. Lacking an API that can turn a memory mapping back into a file descriptor, about the best we can do is push the file descriptors out of the way of other X clients so that we don't run out of the ability to accept new connections. This uses fcntl F_GETFD to push the FD up above MAXCLIENTS. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Julien Cristau <jcristau@debian.org>
2013-11-11Proper spelling of MAP_ANONYMOUS is MAP_ANON.Keith Packard1-1/+2
The former doesn't exist on BSD and the latter is available everywhere AFAIK (checked Solaris and Linux). You also might want to wrap that line ;). Reported-by: Mark Kettenis <mark.kettenis@xs4all.nl> Signed-off-by: Keith Packard <keithp@keithp.com>
2013-11-11Get rid of the rest of the FD passing code when XTRANS_SEND_FDS isn't setKeith Packard1-0/+4
req_fds and SetReqFds in include/dixstruct.h ReadFdFromClient, WriteFdToClient and the FD flushing in os/io.c Signed-off-by: Keith Packard <keithp@keithp.com>
2013-11-11Trap SIGBUS to handle truncated shared memory segmentsKeith Packard4-0/+164
If a client passes a section of memory via file descriptor and then subsequently truncates that file, the underlying pages will be freed and the addresses invalidated. Subsequent accesses to the page will fail with a SIGBUS error. Trap that SIGBUS, figure out which segment was causing the error and then allocate new pages to fill in for that region. Mark the offending shared segment as invalid and free the resource ID so that the client will be able to tell when subsequently attempting to use the segment. Signed-off-by: Keith Packard <keithp@keithp.com> v2: Use MAP_FIXED to simplify the recovery logic (Mark Kettenis) v3: Also catch errors in ShmCreateSegment Conflicts: include/dix-config.h.in include/xorg-config.h.in
2013-11-05os: Actually use the computed clockid in GetTimeInMicrosJulien Cristau1-1/+1
The selection of which clock to use for this function was not actually getting used when fetching the final clock value. Reported-by: Julien Cristau <jcristau@debian.org> Signed-off-by: Keith Packard <keithp@keithp.com>
2013-11-01Merge remote-tracking branch 'whot/for-keith'Keith Packard1-2/+3
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-25 13:24:09 +0000