[xsrc/netbsd-8]: xsrc/external/mit Pull up the following, requested by mrg in...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/xsrc/rev/78ce8399a1d5
branches:  netbsd-8
changeset: 7513:78ce8399a1d5
user:      martin <martin%NetBSD.org@localhost>
date:      Sat Apr 01 15:36:27 2023 +0000

description:
Pull up the following, requested by mrg in ticket #1812:

        xsrc/external/mit/xorg-server/dist/composite/compwindow.c up to 1.1.1.9 (patch)
        xsrc/external/mit/xorg-server.old/dist/composite/compwindow.c   1.2 (patch)

Fix ZDI-CAN-19866 and CVE-2023-1393, a use-after-free problem.

diffstat:

 external/mit/xorg-server.old/dist/composite/compwindow.c |  5 +++++
 external/mit/xorg-server/dist/composite/compwindow.c     |  5 +++++
 2 files changed, 10 insertions(+), 0 deletions(-)

diffs (30 lines):

diff -r 5d6bb879f95c -r 78ce8399a1d5 external/mit/xorg-server.old/dist/composite/compwindow.c
--- a/external/mit/xorg-server.old/dist/composite/compwindow.c  Tue Feb 14 15:54:26 2023 +0000
+++ b/external/mit/xorg-server.old/dist/composite/compwindow.c  Sat Apr 01 15:36:27 2023 +0000
@@ -588,6 +588,11 @@ compDestroyWindow (WindowPtr pWin)
     ret = (*pScreen->DestroyWindow) (pWin);
     cs->DestroyWindow = pScreen->DestroyWindow;
     pScreen->DestroyWindow = compDestroyWindow;
+
+    /* Did we just destroy the overlay window? */
+    if (pWin == cs->pOverlayWin)
+        cs->pOverlayWin = NULL;
+
 /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
     return ret;
 }
diff -r 5d6bb879f95c -r 78ce8399a1d5 external/mit/xorg-server/dist/composite/compwindow.c
--- a/external/mit/xorg-server/dist/composite/compwindow.c      Tue Feb 14 15:54:26 2023 +0000
+++ b/external/mit/xorg-server/dist/composite/compwindow.c      Sat Apr 01 15:36:27 2023 +0000
@@ -609,6 +609,11 @@ compDestroyWindow(WindowPtr pWin)
     ret = (*pScreen->DestroyWindow) (pWin);
     cs->DestroyWindow = pScreen->DestroyWindow;
     pScreen->DestroyWindow = compDestroyWindow;
+
+    /* Did we just destroy the overlay window? */
+    if (pWin == cs->pOverlayWin)
+        cs->pOverlayWin = NULL;
+
 /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
     return ret;
 }