Attachment #870114 for bug #1216133

View | Details | Raw Unified | Return to bug 1216133
Collapse All | Expand All

Lines 58-65 extern void DeviceFocusEvent(DeviceIntPtr dev, Link Here

(-)dix/enterleave.h (-2 lines)
58		58
59	extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);	59	extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
60		60
61	extern void LeaveWindow(DeviceIntPtr dev);
62
63	extern void CoreFocusEvent(DeviceIntPtr kbd,	61	extern void CoreFocusEvent(DeviceIntPtr kbd,
64	int type, int mode, int detail, WindowPtr pWin);	62	int type, int mode, int detail, WindowPtr pWin);
65		63

Lines 335-338 union _InternalEvent { Link Here

(-)include/eventstr.h (+3 lines)
335	GestureEvent gesture_event;	335	GestureEvent gesture_event;
336	};	336	};
337		337
		338	extern void
		339	LeaveWindow(DeviceIntPtr dev);
		340
338	#endif	341	#endif




#ifdef PANORAMIX
        && noPanoramiXExtension
#endif
        ) {
            DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
            /* Hack for CVE-2023-5380: if we're moving
             * screens PointerWindows[] keeps referring to the
             * old window. If that gets destroyed we have a UAF
             * bug later. Only happens when jumping from a window
             * to the root window on the other screen.
             * Enter/Leave events are incorrect for that case but
             * too niche to fix.
             */
            LeaveWindow(pDev);
            if (master)
                LeaveWindow(master);
            UpdateSpriteForScreen(pDev, pScreen);
    }
}

/**
- 

Return to bug 1216133

Lines 397-404 miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) Link Here

(-)mi/mipointer.c (-3 / +15 lines)
397	#ifdef PANORAMIX	397	#ifdef PANORAMIX
398	&& noPanoramiXExtension	398	&& noPanoramiXExtension
399	#endif	399	#endif
400	)	400	) {
401	UpdateSpriteForScreen(pDev, pScreen);	401	DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
		402	/* Hack for CVE-2023-5380: if we're moving
		403	* screens PointerWindows[] keeps referring to the
		404	* old window. If that gets destroyed we have a UAF
		405	* bug later. Only happens when jumping from a window
		406	* to the root window on the other screen.
		407	* Enter/Leave events are incorrect for that case but
		408	* too niche to fix.
		409	*/
		410	LeaveWindow(pDev);
		411	if (master)
		412	LeaveWindow(master);
		413	UpdateSpriteForScreen(pDev, pScreen);
		414	}
402	}	415	}
403		416
404	/**	417	/**
405	-