Tobias Stoeckmann d0c1f0c0b6 xcursor: fix CVE-2013-2003 ... The libXcursor fix for CVE-2013-2003 has never been imported into wlroots, leaving it vulnerable to it. Changing the argument type to an unsigned type is an effective merge of Ilja Van Sprundel's commit in libXcursor. Proof of Concept (compile with address sanitizer): $ mkdir -p ~/.local/share/icons/poc/cursors $ base64 -d <<< WGN1chAAAAAAAAAA/////w== > \ ~/.local/share/icons/poc/cursors/poc $ echo "seat seat0 xcursor_theme poc 10" > ~/poc-config $ sway -c ~/poc-config		2021-05-02 17:04:59 +02:00
..
meson.build	xcursor: also look for cursor themes under ${datadir}/icons by default	2020-03-04 10:02:31 +01:00
wlr_xcursor.c	xcursor: quiet debug log	2021-04-26 20:11:05 +02:00
xcursor.c	xcursor: fix CVE-2013-2003	2021-05-02 17:04:59 +02:00