From 1dddea1217c6f7955c08af1d91134a9c8357c914 Mon Sep 17 00:00:00 2001 From: deepin-ci-robot Date: Wed, 23 Sep 2026 16:31:54 +0800 Subject: [PATCH] fix(cve): CVE-2026-88807 - Check numSubpixel against numScreens to avoid OOB writes (CVE-2026-88807 CVE: CVE-2026-88807 (high) - A malicious server could reply to XRenderQueryFormat with a numSubpixels count greater than the number of screens, causing an OOB write into screen->subpixel Upstream: https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19.patch Co-authored-by: hudeng Generated-By: qwen3.6-35b --- debian/changelog | 9 +++++++++ debian/patches/CVE-2026-88807.patch | 18 ++++++++++++++++++ debian/patches/series | 1 + debian/source/format | 1 + 4 files changed, 29 insertions(+) create mode 100644 debian/patches/CVE-2026-88807.patch create mode 100644 debian/patches/series create mode 100644 debian/source/format diff --git a/debian/changelog b/debian/changelog index 3d0d038..8fea686 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,12 @@ +libxrender (1:0.9.10-1deepin1) unstable; urgency=medium + + * fix(cve): CVE-2026-88807 (high) - Check numSubpixel against + numScreens to avoid OOB writes (CVE-2026-88807) Upstream: + https://gitlab.freedesktop.org/xorg/lib/libxrender/- + /merge_requests/19.patch + + -- deepin-ci-robot Wed, 23 Sep 2026 16:31:54 +0800 + libxrender (1:0.9.10-1) unstable; urgency=medium [ Andreas Boll ] diff --git a/debian/patches/CVE-2026-88807.patch b/debian/patches/CVE-2026-88807.patch new file mode 100644 index 0000000..188b362 --- /dev/null +++ b/debian/patches/CVE-2026-88807.patch @@ -0,0 +1,18 @@ +Description: CVE-2026-88807 (high) - A malicious server could reply to XRenderQueryFormat with a numSubpixels count greater than the number of screens, causing an OOB write into screen->subpixel +Author: Peter Hutterer +Origin: https://gitlab.freedesktop.org/xorg/lib/libxrender/-/merge_requests/19.patch +Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-88807 +Last-Update: 2026-09-16 +--- +diff --git a/src/Xrender.c b/src/Xrender.c +index 71cf3e6..b7754ff 100644 +--- a/src/Xrender.c ++++ b/src/Xrender.c +@@ -464,6 +464,7 @@ XRenderQueryFormats (Display *dpy) + (rep.numDepths < ((INT_MAX / 4) / sizeof (XRenderDepth))) && + (rep.numVisuals < ((INT_MAX / 4) / sizeof (XRenderVisual))) && + (rep.numSubpixel < ((INT_MAX / 4) / 4)) && ++ (rep.numSubpixel <= rep.numScreens) && + (rep.length < (INT_MAX >> 2)) ) { + xri = Xmalloc (sizeof (XRenderInfo) + + (rep.numFormats * sizeof (XRenderPictFormat)) + diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 0000000..a0d8abe --- /dev/null +++ b/debian/patches/series @@ -0,0 +1 @@ +CVE-2026-88807.patch diff --git a/debian/source/format b/debian/source/format new file mode 100644 index 0000000..163aaf8 --- /dev/null +++ b/debian/source/format @@ -0,0 +1 @@ +3.0 (quilt)