From 4bc21015127a47330bba1f2a69c10ba9f6c0aa2f Mon Sep 17 00:00:00 2001
From: MSVSphere Packaging Team <packager@msvsphere.ru>
Date: Wed, 5 Apr 2023 18:48:11 +0300
Subject: [PATCH] import tigervnc-1.12.0-5.el9_1.2

---
 ...posite-Fix-use-after-free-of-the-COW.patch | 42 +++++++++++++++++++
 SPECS/tigervnc.spec                           |  9 +++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch

diff --git a/SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch b/SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch
new file mode 100644
index 0000000..ee1ae7b
--- /dev/null
+++ b/SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch
@@ -0,0 +1,42 @@
+From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Mar 2023 11:08:47 +0100
+Subject: [PATCH xserver] composite: Fix use-after-free of the COW
+
+ZDI-CAN-19866/CVE-2023-1393
+
+If a client explicitly destroys the compositor overlay window (aka COW),
+we would leave a dangling pointer to that window in the CompScreen
+structure, which will trigger a use-after-free later.
+
+Make sure to clear the CompScreen pointer to the COW when the latter gets
+destroyed explicitly by the client.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ composite/compwindow.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/composite/compwindow.c b/composite/compwindow.c
+index 4e2494b86..b30da589e 100644
+--- a/composite/compwindow.c
++++ b/composite/compwindow.c
+@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
+     ret = (*pScreen->DestroyWindow) (pWin);
+     cs->DestroyWindow = pScreen->DestroyWindow;
+     pScreen->DestroyWindow = compDestroyWindow;
++
++    /* Did we just destroy the overlay window? */
++    if (pWin == cs->pOverlayWin)
++        cs->pOverlayWin = NULL;
++
+ /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
+     return ret;
+ }
+-- 
+2.40.0
+
diff --git a/SPECS/tigervnc.spec b/SPECS/tigervnc.spec
index 292f2fd..9fc4cf4 100644
--- a/SPECS/tigervnc.spec
+++ b/SPECS/tigervnc.spec
@@ -5,7 +5,7 @@
 
 Name:           tigervnc
 Version:        1.12.0
-Release:        5%{?dist}.1
+Release:        5%{?dist}.2
 Summary:        A TigerVNC remote display system
 
 %global _hardened_build 1
@@ -37,6 +37,8 @@ Patch101:       0001-rpath-hack.patch
 
 # CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
 Patch110:       xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
+# CVE-2023-1393 tigervnc: xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
+Patch111:       xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch
 
 BuildRequires:  make
 BuildRequires:  gcc-c++
@@ -162,6 +164,7 @@ done
 %patch100 -p1 -b .xserver120-rebased
 %patch101 -p1 -b .rpath
 %patch110 -p1 -b .Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
+%patch111 -p1 -b .composite-Fix-use-after-free-of-the-COW
 popd
 
 %patch1 -p1 -b .use-gnome-as-default-session
@@ -349,6 +352,10 @@ fi
 %ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
 
 %changelog
+*Mon Mar 27 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-5.2
+- xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
+  Resolves: bz#2180308
+
 * Wed Mar 15 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 1.12.0-4
 - Rebuilt for MSVSphere 9.1.