xwayland-24.1.14

[Bruce Dubbs]

New point version.

[Joe Locash]

This release contains the fixes for the issues reported in today's
security advisory:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html

* CVE-2026-88812: XKB SetGeometry TextDoodad Double Free
* CVE-2026-93515: Present Extension Cross-Window Notify Use-After-Free
* CVE-2026-93516: XInput Passive Grab modifierDevice Use-After-Free
* CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow
* CVE-2026-93518: XKB ResizeKeyType Numeric Truncation
* CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow
* CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write
* CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow
* CVE-2026-93522: Glamor CopyArea CPU-FBO Heap Buffer Overflow
* CVE-2026-93523: XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write
* CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read
* CVE-2026-93536: GestureBuildSprite Use-After-Free

In addition we have a variety of fixes outlined by the shortlog below.

Alan Coopersmith (3):
      xkb: Fix -Wcalloc-transposed-args warning in _XkbCopyGeom()
      test: silence -Wanalyzer-null-argument warnings in strndup tests
      Handle -Wimplicit-fallthrough warnings from gcc 16.1

Jeremy Huddleston Sequoia (6):
      RegionValidate: Fix double free of badreg->data on the error path
      damage: Unlink a damage from the list it was actually inserted on
      xkb: Guard XkbAdjustGroup() against a keymap with no groups
      xkb: Default to one group whenever a keymap reports none
      xkb: Never recompute a keymap's group count down to zero
      xkb: Keep the group counts of a loaded keymap in range

Leon M. Busch-George (1):
      xwayland/glamor/gbm: get_render_node_path without enumeration

Lukáš Lipinský (2):
      Xi: byte-swap DeviceChanged valuator and scroll data
      Xi: byte-swap XIQueryDevice ScrollClass flags

Michel Dänzer (1):
      xwayland/present: Only flip if the window pixmap dimensions match

Octavia Togami (1):
      Fix use-after-free caused by duplicate glyphs in one glyphset

Olivier Fourdan (5):
      xwayland: Skip xwl_cursor_warped_to() without an xwl_seat
      xwayland: Handle libxcvt_gen_mode_info() failure
      xwayland: Skip optional RR modes if CVT generation fails
      xwayland: Do not fail if cannot add the native or logical mode
      xwayland: Update RR modes only if valid

Pavel Ondračka (1):
      xwayland: let glamor initialize SHM fences

Peter Hutterer (13):
      xkb: NULL text pointer after free in _CheckSetDoodad error path
      xkb: allocate names->keys to MAP_LENGTH in XkbAllocNames
      xkb: widen size_syms, num_syms, size_acts, num_acts to unsigned int
      xkb: fix CheckKeySyms overwriting request-range symsPerKey entries
      randr: fix size and offset in RRChangeProviderProperty PrependMode
      Xi: validate modifier values in ProcXIPassiveUngrabDevice
      glx: validate dataBytes against cmdlen in RenderLarge first request
      present: unlink notifies from window list in present_clear_window_notifies
      dix: remove passive grabs referencing a device on removal
      Xi: add bounds check for barrier events in input_constrain_cursor
      Xi: clean up gesture sprite traces in WindowGone
      glamor: size tmp_bits buffer for source coordinate range in upload_boxes
      Bump version to 24.1.24

dongshengyuan (1):
      enhance: popen-fdopen-error-handling

stefan11111 (1):
      glamor: Set `need_free_region` immediately after pixman region allocation

git tag: xwayland-24.1.14

Fixed at ad2aa0008e. Leaving open for SA.

[Bruce Dubbs]

Advisory sa-13.1-059 has been issued.