From 4ccaa5134482b6be9c9a7f0b66cd221ef325d082 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Mon, 20 Jan 2025 17:06:07 +0100 Subject: [PATCH xserver 3/4] sync: Do not fail SyncAddTriggerToSyncObject() We do not want to return a failure at the very last step in SyncInitTrigger() after having all changes applied. SyncAddTriggerToSyncObject() must not fail on memory allocation, if the allocation of the SyncTriggerList fails, trigger a FatalError() instead. Related to CVE-2025-26601, ZDI-CAN-25870 Signed-off-by: Olivier Fourdan Reviewed-by: Peter Hutterer --- Xext/sync.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/Xext/sync.c b/Xext/sync.c index 4eab5a6ac..c36de1a2e 100644 --- a/Xext/sync.c +++ b/Xext/sync.c @@ -200,8 +200,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger) return Success; } - if (!(pCur = malloc(sizeof(SyncTriggerList)))) - return BadAlloc; + /* Failure is not an option, it's succeed or burst! */ + pCur = XNFalloc(sizeof(SyncTriggerList)); pCur->pTrigger = pTrigger; pCur->next = pTrigger->pSync->pTriglist; @@ -409,8 +409,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject, * a new counter on a trigger */ if (newSyncObject) { - if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success) - return rc; + SyncAddTriggerToSyncObject(pTrigger); } else if (pCounter && IsSystemCounter(pCounter)) { SyncComputeBracketValues(pCounter); -- 2.48.1