head 1.6; access; symbols pkgsrc-2026Q3:1.5.0.2 pkgsrc-2026Q3-base:1.5 pkgsrc-2026Q2:1.4.0.2 pkgsrc-2026Q2-base:1.4; locks; strict; comment @# @; 1.6 date 2026.10.07.08.31.04; author wiz; state Exp; branches; next 1.5; commitid 2pwTkONSbyatowYG; 1.5 date 2026.07.08.07.41.45; author wiz; state Exp; branches; next 1.4; commitid kHFg3KzFUjVW2PMG; 1.4 date 2026.06.02.11.51.56; author kikadf; state Exp; branches; next 1.3; commitid Js6BYcZL1K9VzdIG; 1.3 date 2026.04.27.13.40.03; author wiz; state Exp; branches; next 1.2; commitid BCok6U40lShllBDG; 1.2 date 2026.04.15.19.03.17; author wiz; state Exp; branches; next 1.1; commitid c7xJWYHO3SQ7w5CG; 1.1 date 2026.04.13.16.52.50; author kikadf; state Exp; branches; next ; commitid oUG6JZREbEt6LOBG; desc @@ 1.6 log @xwayland: update to 24.1.14. This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-October/003747.html * CVE-2026-88812: XKB SetGeometry TextDoodad Double Free * CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free * CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free * CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow * CVE-2026-93518: XKB ResizeKeyType Numeric Truncation * CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow * CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write * CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow * CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow * CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write * CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read * CVE-2026-93536: GestureBuildSprite Use-After-Free @ text @# $NetBSD: Makefile,v 1.5 2026/07/08 07:41:45 wiz Exp $ DISTNAME= xwayland-24.1.14 CATEGORIES= wayland MASTER_SITES= ${MASTER_SITE_XORG:=xserver/} EXTRACT_SUFX= .tar.xz MAINTAINER= pkgsrc-users@@NetBSD.org HOMEPAGE= https://xorg.freedesktop.org/ COMMENT= Server for running X clients under Wayland from modular X.org LICENSE= mit AND modified-bsd AND x11 # with no-advertising clause USE_TOOLS+= pkg-config .include "../../mk/bsd.prefs.mk" .if ${OPSYS} == "NetBSD" MESON_ARGS+= -Dsecure-rpc=false . if ${OPSYS_VERSION} < 100000 CPPFLAGS+= -D_OPENBSD_SOURCE # reallocarray . endif .endif .include "../../devel/wayland/platform.mk" .if empty(PLATFORM_SUPPORTS_WAYLAND:M[Yy][Ee][Ss]) PKG_SKIP_REASON+= "Platform does not support Wayland" .endif post-install: ${RM} ${DESTDIR}${PREFIX}/lib/xorg/protocol.txt ${RM} ${DESTDIR}${PREFIX}/${PKGMANDIR}/man1/Xserver.1 if [ -f ${DESTDIR}${PREFIX}/share/doc/xorg-server/Xserver-DTrace.xml ]; then \ ${RM} ${DESTDIR}${PREFIX}/share/doc/xorg-server/Xserver-DTrace.xml; \ fi .include "../../devel/input-headers/buildlink3.mk" .include "../../devel/wayland/buildlink3.mk" .include "../../devel/wayland-protocols/buildlink3.mk" .include "../../x11/xorgproto/buildlink3.mk" .include "../../graphics/libepoxy/buildlink3.mk" .if ${X11_TYPE} == "modular" .include "../../x11/libXfont2/buildlink3.mk" .else .include "../../graphics/freetype2/buildlink3.mk" .endif .include "../../x11/libxcvt/buildlink3.mk" .include "../../x11/libdrm/buildlink3.mk" .include "../../x11/libei/buildlink3.mk" .include "../../x11/xkbcomp/buildlink3.mk" .include "../../x11/libxkbfile/buildlink3.mk" .include "../../x11/pixman/buildlink3.mk" .include "../../x11/xtrans/buildlink3.mk" .include "../../devel/meson/build.mk" .include "../../mk/bsd.pkg.mk" @ 1.5 log @xwayland: update to 24.1.13. This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-July/003716.html - CVE-2026-55999: glamor Font Atlas Heap Buffer Overflow - CVE-2026-56000: GLX contextTags Use-After-Free in CommonMakeCurrent() In addition we have a few other smaller cleanup fixes. @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.4 2026/06/02 11:51:56 kikadf Exp $ d3 1 a3 1 DISTNAME= xwayland-24.1.13 @ 1.4 log @ xwayland: update to 24.1.12 This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-June/003702.html - Font Alias Stack-based Buffer Overflow - XSYNC Use-After-Free in miSyncDestroyFence() - XKB Key Types Stack-based Buffer Overflow - XKB SetMap Request Stack-based Buffer Overflow - XSYNC Use-After-Free in FreeCounter() - XSYNC Use-After-Free in SyncChangeCounter() - GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write - CreateSaverWindow Use-After-Free Information Disclosure Additionally, it contains a number of other various fixes from the stable xwayland-24.1 branch. Mikhail Dmitrichenko (2): xkb: fix incorrect size check when growing doodads in a section xkb: fix potential buff overflow in XkbVModIndexText for XkbCFile format Peter Hutterer (15): Xi: add missing gesture grab type checks in ProcXIPassiveUngrabDevice xkb: Fix out-of-bounds array access in _CheckSetShapes() xkb: Fix off-by-one in color index validation in _CheckSetGeom() xkb: Fix off-by-one and NULL dereferences in _CheckSetOverlay() xkb: Add bounds check for action data in CheckKeyActions() present: actually return the created notifies glx: reject negative size in FeedbackBuffer and SelectBuffer requests sync: fix deletion of counters and fences sync: restart trigger list iteration in SyncChangeCounter after TriggerFired xkb: reject key types with num_levels exceeding XkbMaxShiftLevel xkb: clamp nMaps to mapWidths buffer size in CheckKeyTypes glx: fix reversed length check in ChangeDrawableAttributes saver: re-fetch screen private after CheckScreenPrivate in CreateSaverWindow dix: increase XLFDMAXFONTNAMELEN to match libXfont2's MAXFONTNAMELEN Bump version to 24.1.11 @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.3 2026/04/27 13:40:03 wiz Exp $ d3 1 a3 1 DISTNAME= xwayland-24.1.12 @ 1.3 log @xwayland: update to 24.1.11. This release addresses a number of regressions found in Xwayland 24.1.10: * Avoids spurious focus changes with KDE when listening for mouse buttons is enabled for legacy X11 application support * Fix tablet tools not working anymore as "slave" devices * Fix a crash when running some XTS tests * Fix a crash in window damage handling caused a NULL pointer dereference @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.2 2026/04/15 19:03:17 wiz Exp $ d3 1 a3 1 DISTNAME= xwayland-24.1.11 @ 1.2 log @This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg-announce/2026-April/003677.html * CVE-2026-33999: XKB Integer Underflow in XkbSetCompatMap() * CVE-2026-34000: XKB Out-of-bounds Read in CheckSetGeom() * CVE-2026-34001: XSYNC Use-after-free in miSyncTriggerFence() * CVE-2026-34002: XKB Out-of-bounds read in CheckModifierMap() * CVE-2026-34003: XKB Buffer overflow in CheckKeyTypes() Additionally, it contains a number of other various fixes from the stable xwayland-24.1 branch: Alan Coopersmith (18): xf86bigfont: fix -Wimplicit-function-declaration error dix: Fix builds with meson -Dxace=false -Dwerror=true meson: don't build xselinux if xace is disabled xwayland: fix builds with xace disabled panoramix: avoid null dereference in PanoramiXMaybeAddDepth() panoramix: avoid null dereference in PanoramiXConsolidate() glamor: handle potential NULL return from GetPictureScreenIfSet() glamor: handle allocation failure in glamor_create_pixmap() glamor: silence false positive in glamor_validate_gc() glamor: handle allocation failures in glamor_largepixmap.c glamor: avoid null dereference in glamor_dash_setup() glamor: avoid null dereference in glamor_composite_clipped_region() glamor: avoid double free in glamor_make_pixmap_exportable() Create a SECURITY.md file dix: set errorValue correctly when XID lookup fails in ChangeGCXIDs() os: make FormatInt64() handle LONG_MIN correctly os: fix sha1 build error with Nettle 4.0 os: include in ospoll.c Alexander Melnyk (1): xkb: Fix locked/latched indicator desync across multiple keyboards Liu Heng (2): xwayland: Fix incorrect pointer coordinates in enter events xwayland: prevent X11 get enter event when pointer is over Wayland client Michel Dänzer (3): xwayland: Update surface window from xwl_unrealize_window xwayland: Use WindowPtr for damage closure again Revert "xwayland: Call register_damage depending on ensure_surface_for_window" Mikhail Dmitrichenko (3): os: avoid closing null fd at Fopen render: fix multiple mem leaks on err paths dix: avoid null ptr deref at doListFontsAndAliases Olivier Fourdan (9): xwayland: Do not pretend leaving the X11 surface if buttons are down xwayland: Expunge the SECURITY.md file xwayland: Use viewport scale for warping coordinates xkb: Fix bounds check in _CheckSetGeom() miext/sync: Fix use-after-free in miSyncTriggerFence() xkb: Fix out-of-bounds read in CheckModifierMap() xkb: Add additional bound checking in CheckKeyTypes() xkb: Add more _XkbCheckRequestBounds() Bump version to 24.1.10 Peter Harris (1): xkb: fix buffer re-use in _XkbSetCompatMap Pierre Le Marre (2): xkb: Fix key type without level names in XkbCopyKeymap xkb: Fix serialization of key type without level names Twaik Yont (1): os: use close-on-exec for X server socket to prevent fd leaks Yixue Wang (1): xwayland: wrong expecting_event hongao (1): randr: clear primary screen's primaryOutput when the output is deleted quantenzitrone (2): COPYING: add missing paragraph to SGI-B-2.0 COPYING: add author to HPND-sell-MIT-disclaimer-xserver @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.1 2026/04/13 16:52:50 kikadf Exp $ d3 1 a3 1 DISTNAME= xwayland-24.1.10 @ 1.1 log @ xwayland: move and rename x11/modular-xorg-xwayland package update to 24.1.9 The modular-xorg-xwayland package is not used by any pkgsrc package, and it is not usable on its own. Therefore, instead of following the usual move and rename steps, it has been removed, and a new xwayland package has been added. This change is justified by the fact that xwayland can be built against native X11, making it usable with Wayland compositors. @@kikadf @ text @d1 1 a1 1 # $NetBSD: Makefile,v 1.20 2025/01/24 20:50:27 riastradh Exp $ d3 1 a3 1 DISTNAME= xwayland-24.1.9 @