Bug 1357694
| Summary: | XFixesGetCursorImage can access released cursor memory | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | hprhelbugzilla |
| Component: | xorg-x11-server | Assignee: | Adam Jackson <ajax> |
| Status: | CLOSED WONTFIX | QA Contact: | Desktop QE <desktop-qa-list> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | alanh, egkristi, fabrice |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-12-15 07:43:04 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
The call to XFixesGetCursorImage is being made by the gnome window manager. The call was found in mutter. Any news when this would be fixed ? FWIW, the suggested fix works for me (fedora 27, same issue : chromium-browser over x11vnc) This fix works, and is essential for VMWare Horizon 7 on Linux (Ubuntu16.04), as it causes session shutdown for active users.(In reply to Alan Hourihane from comment #3) > Any news when this would be fixed ? After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |
Description of problem: Calls to XFixesGetCursorImage can cause the X server to access released memory resulting in a crash. The code in the CursorDisplayCursor function in xfixes/cursor.c stores a pointer to the cursor as follows CursorCurrent[pDev->id] = pCursor; The cursor pointer can get accessed by calling XFixesGetCursorImage even if the cursor has been released. A suggested fix is to increase the cursor reference count when storing the pointer. Any currently stored pointer would need to be released prior to storing the reference if (CursorCurrent[pDev->id]) FreeCursor(CursorCurrent[pDev->id], (Cursor)0); CursorCurrent[pDev->id] = RefCursor(pCursor); Version-Release number of selected component (if applicable): xorg-x11-server-Xorg-1.17.2-10.el7.x86_64 How reproducible: Problem was discovered running Google Chrome with VNC. Steps to Reproduce: 1. start x0vncserver 2. start Google Chrome 3. Move the Google Chrome window using a remove viewer Actual results: X server crashes Expected results: No crash Additional info: