From 39986f495e051108b7f1603f71c7abd17022200b Mon Sep 17 00:00:00 2001
From: Rmys <muscnsl@gmail.com>
Date: Sat, 3 Oct 2020 12:33:23 +0300
Subject: [PATCH] xorg-server-1.20.9

---
 ...ond-reference-for-SavedCursor-in-xf8.patch | 34 +++++++++++++++++++
 x11/server/xorg-server/pspec.xml              | 11 ++++--
 2 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 x11/server/xorg-server/files/0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch

diff --git a/x11/server/xorg-server/files/0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch b/x11/server/xorg-server/files/0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch
new file mode 100644
index 0000000000..872259bb80
--- /dev/null
+++ b/x11/server/xorg-server/files/0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch
@@ -0,0 +1,34 @@
+From 919f1f46fc67dae93b2b3f278fcbfc77af34ec58 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Michel=20D=C3=A4nzer?= <mdaenzer@redhat.com>
+Date: Mon, 31 Aug 2020 12:10:43 +0200
+Subject: [PATCH] xfree86: Take second reference for SavedCursor in
+ xf86CursorSetCursor
+
+The same pointer is kept in CurrentCursor as well, therefore two
+RefCursor calls are needed.
+
+Fixes use-after-free after switching VTs.
+
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067
+Signed-off-by: Laurent Carlier <lordheavym@gmail.com>
+---
+ hw/xfree86/ramdac/xf86CursorRD.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/hw/xfree86/ramdac/xf86CursorRD.c b/hw/xfree86/ramdac/xf86CursorRD.c
+index 9aa3de97b..c8362d169 100644
+--- a/hw/xfree86/ramdac/xf86CursorRD.c
++++ b/hw/xfree86/ramdac/xf86CursorRD.c
+@@ -334,6 +334,9 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
+         ScreenPriv->HotY = cursor->bits->yhot;
+ 
+         if (!infoPtr->pScrn->vtSema) {
++            cursor = RefCursor(cursor);
++            if (ScreenPriv->SavedCursor)
++                FreeCursor(ScreenPriv->SavedCursor, None);
+             ScreenPriv->SavedCursor = cursor;
+             return;
+         }
+-- 
+2.28.0
+
diff --git a/x11/server/xorg-server/pspec.xml b/x11/server/xorg-server/pspec.xml
index 1656faf7c3..917e1b9d33 100644
--- a/x11/server/xorg-server/pspec.xml
+++ b/x11/server/xorg-server/pspec.xml
@@ -11,7 +11,7 @@
         <License>MIT</License>
         <Summary>X.Org X Server</Summary>
         <Description>X server is the main application that allows a graphical interface.</Description>
-        <Archive sha1sum="077d081f912faf11c87ea1c9d0e29490961b0cd4" type="tarbz2">mirrors://xorg/individual/xserver/xorg-server-1.20.8.tar.bz2</Archive>
+        <Archive sha1sum="4b70ac63fa864f0569712d634a61496d015c3b86" type="tarbz2">mirrors://xorg/individual/xserver/xorg-server-1.20.9.tar.bz2</Archive>
         <BuildDependencies>
             <Dependency>libbsd-devel</Dependency>
             <Dependency>font-util</Dependency>
@@ -64,7 +64,7 @@
             <Patch level="1">xserver-autobind-hotplug.patch</Patch>
             <Patch level="1">xorg-server-1.12-unloadsubmodule.patch</Patch>
             <Patch level="1">xorg-server-1.18-support-multiple-Files-sections.patch</Patch>
-<!--             <Patch level="1">xorg-server-1.19.4-sysmacros.patch</Patch> -->
+            <Patch level="1">0001-xfree86-Take-second-reference-for-SavedCursor-in-xf8.patch</Patch>
         </Patches>
     </Source>
 
@@ -274,6 +274,13 @@
     </Package>
 
     <History>
+        <Update release="16">
+            <Date>2020-10-03</Date>
+            <Version>1.20.9</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Mustafa Cinasal</Name>
+            <Email>muscnsl@gmail.com</Email>
+        </Update>
         <Update release="15">
             <Date>2020-06-04</Date>
             <Version>1.20.8</Version>