[xsrc/netbsd-9]: xsrc/external/mit Pull up the following, requested by mrg in...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/xsrc/rev/f49d3545e7c6
branches:  netbsd-9
changeset: 7512:f49d3545e7c6
user:      martin <martin%NetBSD.org@localhost>
date:      Sat Apr 01 15:34:11 2023 +0000

description:
Pull up the following, requested by mrg in ticket #1619:

        xsrc/external/mit/xorg-server/dist/composite/compwindow.c up to 1.1.1.9 (patch)
        xsrc/external/mit/xorg-server.old/dist/composite/compwindow.c   1.2 (patch)

Fix ZDI-CAN-19866 and CVE-2023-1393, a use-after-free problem.

diffstat:

 external/mit/xorg-server.old/dist/composite/compwindow.c |  5 +++++
 external/mit/xorg-server/dist/composite/compwindow.c     |  5 +++++
 2 files changed, 10 insertions(+), 0 deletions(-)

diffs (30 lines):

diff -r 016076b8a278 -r f49d3545e7c6 external/mit/xorg-server.old/dist/composite/compwindow.c
--- a/external/mit/xorg-server.old/dist/composite/compwindow.c  Tue Feb 14 16:01:05 2023 +0000
+++ b/external/mit/xorg-server.old/dist/composite/compwindow.c  Sat Apr 01 15:34:11 2023 +0000
@@ -588,6 +588,11 @@ compDestroyWindow (WindowPtr pWin)
     ret = (*pScreen->DestroyWindow) (pWin);
     cs->DestroyWindow = pScreen->DestroyWindow;
     pScreen->DestroyWindow = compDestroyWindow;
+
+    /* Did we just destroy the overlay window? */
+    if (pWin == cs->pOverlayWin)
+        cs->pOverlayWin = NULL;
+
 /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
     return ret;
 }
diff -r 016076b8a278 -r f49d3545e7c6 external/mit/xorg-server/dist/composite/compwindow.c
--- a/external/mit/xorg-server/dist/composite/compwindow.c      Tue Feb 14 16:01:05 2023 +0000
+++ b/external/mit/xorg-server/dist/composite/compwindow.c      Sat Apr 01 15:34:11 2023 +0000
@@ -613,6 +613,11 @@ compDestroyWindow(WindowPtr pWin)
     ret = (*pScreen->DestroyWindow) (pWin);
     cs->DestroyWindow = pScreen->DestroyWindow;
     pScreen->DestroyWindow = compDestroyWindow;
+
+    /* Did we just destroy the overlay window? */
+    if (pWin == cs->pOverlayWin)
+        cs->pOverlayWin = NULL;
+
 /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
     return ret;
 }