X11Libre/xserver xlibre-xserver-25.2.3 on GitHub

What's Changed

(release/25.2) glx: fix out-of-bounds read in RenderLarge variable-size dispatch by @metux in #3114
(release/25.2) glx: fix integer overflow in CreateContextAttribsARB length check by @metux in #3104
(release/25.2) randr: fix heap overflow and size tracking in RRChangeProviderProperty by @metux in #3097
(release/25.2) glx: fix DrawableGone use-after-free without rejecting duplicate drawables by @metux in #3333
(release/25.2) Xi: fix wrong/late NULL check on touch-class alloc in DeepCopyPointerClasses() by @metux in #3367
(release/25.2) Xi: xiselectev: fix OOB read in ProcXISelectEvents' non-swapped path by @metux in #3246
(release/25.2) render: filter: fix integer-overflow bypass of convolution size check by @metux in #3245
(release/25.2) Xi: fix NULL pointer dereference in ProcXQueryDeviceState by @metux in #3110
(release/25.2) xkb: bounds-check indicator index in ReadXkmIndicators by @metux in #3109
(release/25.2) Xi: zero feedback reply buffer in ProcXGetFeedbackControl by @metux in #3107
(release/25.2) randr: zero provider info reply buffer in ProcRRGetProviderInfo by @metux in #3106
(release/25.2) Xext: xvideo: zero padding in ProcXvListImageFormats reply by @metux in #3101
(release/25.2) render: zero reply buffers in QueryPictFormats and QueryFilters by @metux in #3100
(release/25.2) randr: zero name padding in GetScreenResources replies by @metux in #3092
(release/25.2) glx: zero-init xGLXQueryVersionReply to avoid leaking uninitialised bytes by @metux in #3236
(release/25.2) panoramiX: zero-init xAllocColorReply to avoid leaking uninitialised bytes by @metux in #3233
(release/25.2) mi: fix double-free/UAF in miDCInitialize() on miSpriteInitialize() failure by @metux in #3510
(release/25.2) rootless: fix dangling screen pixmap on RootlessUpdateScreenPixmap() OOM by @metux in #3507
(release/25.2) include: compiler.h: restore MIPS port I/O port access (12-year-old bug) by @metux in #3499
(release/25.2) hw/xfree86/glamor_egl: do not link staticaly glx library by @metux in #3471
(release/25.2) xfree86: close seatd input devices after DisableDevice(), not before by @metux in #3444
(backport 25.2) glamor: glamor_egl.c do not call xorgGlxCreateVendor() by @metux in #3187
(release/25.2) present: Fix missing byte swaps in sproc_present_pixmap() by @metux in #3123
(release/25.2) Xext: xtest: fix stack out-of-bounds write in ProcXTestFakeInput by @metux in #3115
(release/25.2) Xi: fix double length scaling in ProcXIPassiveGrabDevice mask copy by @metux in #3108
(release/25.2) present: byte-swap notify list in sproc_present_pixmap_synced by @metux in #3102
(release/25.2) fix getrandom fallback by @metux in #3624
(25.2) backport glamor_egl: clean up various stuff by @cepelinas9000 in #3677
25.2: cygwin CI: install python312-lxml instead of python39-lxml by @metux in #3702
(release/25.2) xquartz: Replace assert() around side-effecting calls with unconditional error handling by @metux in #3575
(release/25.2) rootless: Fix two region leaks by @metux in #3574
(release/25.2) xquartz: Stop drawing before handing a frame to xp_frame_draw() by @metux in #3572
(release/25.2) Xephyr: fix setting physical output size by @metux in #3564
(release/25.2) xkb: Fix -Wcalloc-transposed-args warning in _XkbCopyGeom() by @metux in #3566
(release/25.2) darwin: Set thread priorities to user interactive or user initiated as appropriate by @metux in #3573
(release/25.2) fb: Don't widen the planemask over padding bits when ROOTLESS_SAFEALPHA is set by @metux in #3571
(release/25.2) exa: silence -Wold-style-declaration warning from gcc 16 by @metux in #3569
(release/25.2) modesetting: single-size hw cursor + drmGetVersion NULL guard (backport of #3749 + #3752) by @metux in #3759
xkb: harden group counts against a keymap reporting none (backport of #3784/#3785/#3786) by @metux in #3808
(release/25.2) xkb: Guard XkbAdjustGroup() against a keymap with no groups by @metux in #3807
(release/25.2) Xi: byte-swap XIQueryDevice ScrollClass flags by @metux in #3801
(release/25.2) RegionValidate: Fix double free of badreg->data on the error path by @metux in #3794
(release/25.2) miext: damage: use drawable pointer instead of list head pointer to avoid realloc() UAF by @metux in #3813
kdrive/evdev: Close the input fd after ungrabbing (backport of #3791) by @metux in #3822
Backport #3775: Xi byte-swap DeviceChanged valuator and scroll data by @metux in #3823
(release/25.2) test: Fix locale-dependent assertion in signal-logging test by @metux in #3836
(release/25.2) .github: netbsd: upgrade to 11.0 by @metux in #3846
(release/25.2) dix: make InputDevIsFloating() and InputDevIsMaster() static inline by @metux in #3852
(release/25.2) render: fix swapping and additional length check in ProcRenderSetPictureFilter() by @metux in #3096
(xorg) (release/25.2) kdrive: Don't fixup the cursor position twice in KdCursorOffScreen by @metux in #3562
(release/25.2) modesetting: save cursor in master's sprite_priv instead of slave's by @metux in #3838
modesetting: don't drop coalesced Present vblanks when re-arm fails (backport of #3516) by @metux in #3819
(release/25.2) xnest: Check malloc return values in GCOps to avoid NULL dereferences by @metux in #3667
(release/25.2) mi: Simplify byte/bit order branches in miPushPixels by @metux in #3663
(release/25.2) Xi: Guard against NULL event pointer by @metux in #3659
(release/25.2) xf86: prevent passing NULL pointer as strcat() destination by @metux in #3568
(release/25.2) xf86: prevent passing NULL pointer as strcpy destination by @metux in #3567
(release/25.2) randr: Set the legacy RandR size range to include rotations by @metux in #3563
(release/25.2) mi: guard against NULL event pointer by @metux in #3658
(xorg) (release/25.2) Fix use-after-free caused by duplicate glyphs in one glyphset by @metux in #3561
(release/25.2) Fix DPI property not reporting accurate value when autosetDPI is TRUE by @metux in #3669
(backport 25.2) glx: fix missing reply header / byte-swap in swapped pixel queries by @metux in #3159
(release/25.2) dix: rpcbuf: write empty counted string for NULL str by @metux in #3239
(release/25.2) DPMS: Don't wake display from input when timeouts are disabled by @metux in #3855
(release/25.2) modesetting: Fix use-after-free when aborting queued events by @metux in #3854
(release/25.2) xf86: mark wasset unused in xf86UnblockSIGIO() compatibility wrapper by @metux in #3853
(release/25.2) glamor: Restore GetImage proc by @metux in #3901
(release/25.2) glx: validate dataBytes against cmdlen in RenderLarge first request by @metux in #3907
(release/25.2) Xi: validate modifier values in ProcXIPassiveUngrabDevice by @metux in #3906
(release/25.2) os: Add busfault_set_jmp() for SIGBUS unwind by @metux in #3900
(release/25.2) xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames by @metux in #3898
(release/25.2) xkb: use ssize_t for XKM byte counts by @metux in #3902
(release/25.2) xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int by @metux in #3905
(release/25.2) xkb: fix CheckKeySyms overwriting request-range symsPerKey entries by @metux in #3904
(release/25.2) present: unlink notifies from window list in present_clear_window_notifies by @metux in #3908
(release/25.2) miext/sync: Handle SIGBUS from truncated shm fences by @metux in #3895
(release/25.2) xkb: NULL text pointer after free in _CheckSetDoodad error path by @metux in #3897
(release/25.2) xfree86: loader: treat empty module path as not present by @metux in #3920
(release/25.2) xfree86: platform bus: don't crash on an OutputClass without ModulePath by @metux in #3923
(release/25.2) xquartz: bundle_trampoline.c: fall back to ASL when os_log is unavailable by @metux in #3925
(release/25.2) dix: dispatch: clear the client slot when NextAvailableClient() fails by @metux in #3931
(release/25.2) dix: dispatch: return DestroySubwindows() errors from ProcDestroySubwindows by @metux in #3928
(release/25.2) glamor/glamor_egl: allocate PRIME shared pixmaps linear again by @metux in #3935
(release/25.2) Xext: composite: take the pixmap reference before AddResource() on Xinerama by @metux in #3940
(release/25.2) glamor: size tmp_bits buffer for source coordinate range in upload_boxes by @metux in #3899
(release/25.2) glamor: Set need_free_region immediately after pixman region allocation by @metux in #3896
render: free animated cursor timers on destruction by @CC-David-CC in #3865
(release/25.2) xquartz: fix regression due to unconditional usage of qos APIs by @metux in #3932
(release/25.2) Xext/namespace: fix potential NULL-pointer dereference in select_ns() by @metux in #3856
(release/25.2) Xext: security: fix double free when AddResource() fails by @metux in #3950
(release/25.2) ci(workflows): retry the DragonFlyBSD VM step on transient boot flakes by @metux in #3938
(release/25.2) modesetting: Fix RandR output leasing while TearFree is enabled. by @metux in #3894
(release/25.2) ci(workflows): retry the netbsd BSD VM step on transient boot flakes by @metux in #3943
(release/25.2) dix/window: Fix UnmapNotify and DestroyNotify order in DestroySubwindows by @metux in #3953
(25.2) xfree86: seatd-libseat: release GPUs through libseat instead of a plain close() by @galternat in #3959
(release/25.2) ci(workflows): retry the freebsd BSD VM step on transient boot flakes by @metux in #3942
(release/25.2) ci: decouple apt cache — build jobs only pull, separate job pushes by @metux in #3969
backport-25.2: dix, Xi: remove spurious dereference when checking function pointers by @metux in #3963
(release/25.2) xfree86: don't make a failed GPU screen ScreenInit fatal by @metux in #4005
(release/25.2) xkb: reject incomplete keymaps in GetKbdByName by @metux in #4007
(release/25.2) glamor: use highp for fill_pos UVs on GLES by @metux in #3903
[backport-25.2] test/info: run display-info tests serialised to avoid display-number race by @metux in #4020
(release/25.2) Xi: add bounds check for barrier events in input_constrain_cursor by @metux in #4025
(release/25.2) dix: remove passive grabs referencing a device on removal (backport of CVE-2026-93516) by @metux in #4034
backport glamor memleak fix + Xi barrier follow-ups to release/25.2 by @metux in #4039

Full Changelog: xlibre-xserver-25.2.2...xlibre-xserver-25.2.3