aboutsummaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-graphics
diff options
context:
space:
mode:
Diffstat (limited to 'meta-oe/recipes-graphics')
-rw-r--r--meta-oe/recipes-graphics/freeglut/freeglut_3.2.1.bb18
-rw-r--r--meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-1.patch38
-rw-r--r--meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-2.patch39
-rw-r--r--meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-3.patch31
-rw-r--r--meta-oe/recipes-graphics/graphviz/graphviz_2.50.0.bb7
-rw-r--r--meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb4
-rw-r--r--meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb3
-rw-r--r--meta-oe/recipes-graphics/lvgl/lv-drivers_7.11.0.bb8
-rw-r--r--meta-oe/recipes-graphics/lvgl/lv-lib-png_8.0.2.bb8
-rw-r--r--meta-oe/recipes-graphics/lvgl/lvgl_8.1.0.bb6
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2021-3575.patch45
-rw-r--r--meta-oe/recipes-graphics/openjpeg/openjpeg_2.4.0.bb7
-rw-r--r--meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb2
-rw-r--r--meta-oe/recipes-graphics/tslib/tslib_1.22.bb2
-rw-r--r--meta-oe/recipes-graphics/xorg-app/xkbutils_1.0.4.bb2
-rw-r--r--meta-oe/recipes-graphics/xorg-app/xsetroot_1.1.2.bb1
-rw-r--r--meta-oe/recipes-graphics/xorg-app/xterm/CVE-2022-45063.patch782
-rw-r--r--meta-oe/recipes-graphics/xorg-app/xterm/CVE-2023-40359.patch388
-rw-r--r--meta-oe/recipes-graphics/xorg-app/xterm_372.bb2
-rw-r--r--meta-oe/recipes-graphics/xscreensaver/xscreensaver_6.01.bb2
20 files changed, 1376 insertions, 19 deletions
diff --git a/meta-oe/recipes-graphics/freeglut/freeglut_3.2.1.bb b/meta-oe/recipes-graphics/freeglut/freeglut_3.2.1.bb
index 6ef9f74c70..2f4f16589d 100644
--- a/meta-oe/recipes-graphics/freeglut/freeglut_3.2.1.bb
+++ b/meta-oe/recipes-graphics/freeglut/freeglut_3.2.1.bb
@@ -7,14 +7,24 @@ SRC_URI = "https://sourceforge.net/projects/${BPN}/files/${BPN}/${PV}/${BPN}-${P
SRC_URI[md5sum] = "cd5c670c1086358598a6d4a9d166949d"
SRC_URI[sha256sum] = "d4000e02102acaf259998c870e25214739d1f16f67f99cb35e4f46841399da68"
-inherit cmake features_check
+inherit cmake features_check pkgconfig
-# depends on virtual/libx11, virtual/libgl
-REQUIRED_DISTRO_FEATURES = "x11 opengl"
+# depends on virtual/libgl
+REQUIRED_DISTRO_FEATURES = "opengl"
+PACKAGECONFIG ?= "${@bb.utils.filter('DISTRO_FEATURES', 'wayland x11', d)}"
+PACKAGECONFIG[gles] = "-DFREEGLUT_GLES=ON,-DFREEGLUT_GLES=OFF,"
+PACKAGECONFIG[wayland] = "-DFREEGLUT_WAYLAND=ON,-DFREEGLUT_WAYLAND=OFF,libxkbcommon"
+PACKAGECONFIG[demos] = "-DFREEGLUT_BUILD_DEMOS=ON,-DFREEGLUT_BUILD_DEMOS=OFF,"
+PACKAGECONFIG[x11] = ",,virtual/libx11 libice libxmu libglu libxrandr libxext"
# Do not use -fno-common, check back when upgrading to new version it might not be needed
CFLAGS += "-fcommon"
PROVIDES += "mesa-glut"
-DEPENDS = "virtual/libx11 libxmu libxi virtual/libgl libglu libxrandr"
+DEPENDS = "virtual/libgl libxi"
+
+do_install:append() {
+ # Remove buildpaths
+ sed -i "s#${RECIPE_SYSROOT}##g" ${D}${libdir}/cmake/FreeGLUT/FreeGLUTTargets.cmake
+}
diff --git a/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-1.patch b/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-1.patch
new file mode 100644
index 0000000000..a48f8aa06a
--- /dev/null
+++ b/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-1.patch
@@ -0,0 +1,38 @@
+From 361f274ca901c3c476697a6404662d95f4dd43cb Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Fri, 12 Jan 2024 17:06:17 +1100
+Subject: [PATCH] gvc gvconfig_plugin_install_from_config: more tightly scope
+ 'gv_api'
+
+Upstream-Status: Backport [https://gitlab.com/graphviz/graphviz/-/commit/361f274ca901c3c476697a6404662d95f4dd43cb]
+CVE: CVE-2023-46045
+
+Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
+---
+ lib/gvc/gvconfig.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/lib/gvc/gvconfig.c b/lib/gvc/gvconfig.c
+index 2d86321..f9d1dcc 100644
+--- a/lib/gvc/gvconfig.c
++++ b/lib/gvc/gvconfig.c
+@@ -173,7 +173,6 @@ static int gvconfig_plugin_install_from_config(GVC_t * gvc, char *s)
+ {
+ char *package_path, *name, *api;
+ const char *type;
+- api_t gv_api;
+ int quality, rc;
+ int nest = 0;
+ gvplugin_package_t *package;
+@@ -188,7 +187,7 @@ static int gvconfig_plugin_install_from_config(GVC_t * gvc, char *s)
+ package = gvplugin_package_record(gvc, package_path, name);
+ do {
+ api = token(&nest, &s);
+- gv_api = gvplugin_api(api);
++ const api_t gv_api = gvplugin_api(api);
+ do {
+ if (nest == 2) {
+ type = token(&nest, &s);
+--
+2.40.0
+
diff --git a/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-2.patch b/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-2.patch
new file mode 100644
index 0000000000..4c70b1a877
--- /dev/null
+++ b/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-2.patch
@@ -0,0 +1,39 @@
+From 3f31704cafd7da3e86bb2861accf5e90c973e62a Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Fri, 12 Jan 2024 17:06:17 +1100
+Subject: [PATCH] gvc gvconfig_plugin_install_from_config: more tightly scope
+ 'api'
+
+Upstream-Status: Backport [https://gitlab.com/graphviz/graphviz/-/commit/3f31704cafd7da3e86bb2861accf5e90c973e62a]
+CVE: CVE-2023-46045
+
+Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
+---
+ lib/gvc/gvconfig.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/gvc/gvconfig.c b/lib/gvc/gvconfig.c
+index f9d1dcc..95e8c6c 100644
+--- a/lib/gvc/gvconfig.c
++++ b/lib/gvc/gvconfig.c
+@@ -171,7 +171,7 @@ static char *token(int *nest, char **tokens)
+
+ static int gvconfig_plugin_install_from_config(GVC_t * gvc, char *s)
+ {
+- char *package_path, *name, *api;
++ char *package_path, *name;
+ const char *type;
+ int quality, rc;
+ int nest = 0;
+@@ -186,7 +186,7 @@ static int gvconfig_plugin_install_from_config(GVC_t * gvc, char *s)
+ name = "x";
+ package = gvplugin_package_record(gvc, package_path, name);
+ do {
+- api = token(&nest, &s);
++ const char *api = token(&nest, &s);
+ const api_t gv_api = gvplugin_api(api);
+ do {
+ if (nest == 2) {
+--
+2.40.0
+
diff --git a/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-3.patch b/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-3.patch
new file mode 100644
index 0000000000..4746265eeb
--- /dev/null
+++ b/meta-oe/recipes-graphics/graphviz/graphviz/CVE-2023-46045-3.patch
@@ -0,0 +1,31 @@
+From a95f977f5d809915ec4b14836d2b5b7f5e74881e Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Fri, 12 Jan 2024 17:06:17 +1100
+Subject: [PATCH] gvc: detect plugin installation failure and display an error
+
+Upstream-Status: Backport [https://gitlab.com/graphviz/graphviz/-/commit/a95f977f5d809915ec4b14836d2b5b7f5e74881e]
+CVE: CVE-2023-46045
+
+Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
+---
+ lib/gvc/gvconfig.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/lib/gvc/gvconfig.c b/lib/gvc/gvconfig.c
+index 95e8c6c..77d0865 100644
+--- a/lib/gvc/gvconfig.c
++++ b/lib/gvc/gvconfig.c
+@@ -188,6 +188,10 @@ static int gvconfig_plugin_install_from_config(GVC_t * gvc, char *s)
+ do {
+ const char *api = token(&nest, &s);
+ const api_t gv_api = gvplugin_api(api);
++ if (gv_api == (api_t)-1) {
++ agerr(AGERR, "config error: %s %s not found\n", package_path, api);
++ return 0;
++ }
+ do {
+ if (nest == 2) {
+ type = token(&nest, &s);
+--
+2.40.0
+
diff --git a/meta-oe/recipes-graphics/graphviz/graphviz_2.50.0.bb b/meta-oe/recipes-graphics/graphviz/graphviz_2.50.0.bb
index aa597cd8e4..f06e2adb02 100644
--- a/meta-oe/recipes-graphics/graphviz/graphviz_2.50.0.bb
+++ b/meta-oe/recipes-graphics/graphviz/graphviz_2.50.0.bb
@@ -20,6 +20,9 @@ DEPENDS:append:class-nativesdk = " ${BPN}-native"
inherit autotools-brokensep pkgconfig gettext qemu
SRC_URI = "https://gitlab.com/api/v4/projects/4207231/packages/generic/${BPN}-releases/${PV}/${BP}.tar.xz \
+ file://CVE-2023-46045-1.patch \
+ file://CVE-2023-46045-2.patch \
+ file://CVE-2023-46045-3.patch \
"
# Use native mkdefs
SRC_URI:append:class-target = "\
@@ -31,6 +34,10 @@ SRC_URI:append:class-nativesdk = "\
SRC_URI[sha256sum] = "6b16bf990df114195be669773a1dae975dbbffada45e1de2849ddeb5851bb9a8"
+CVE_CHECK_IGNORE += "\
+ CVE-2014-9157 \
+"
+
PACKAGECONFIG ??= "librsvg"
PACKAGECONFIG[librsvg] = "--with-librsvg,--without-librsvg,librsvg"
diff --git a/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb b/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb
index 4c17105a99..27dff82df5 100644
--- a/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb
+++ b/meta-oe/recipes-graphics/jasper/jasper_2.0.33.bb
@@ -6,6 +6,10 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a80440d1d8f17d041c71c7271d6e06eb"
SRC_URI = "git://github.com/jasper-software/jasper.git;protocol=https;branch=master"
SRCREV = "fe00207dc10db1d7cc6f2757961c5c6bdfd10973"
+CVE_CHECK_IGNORE += "\
+ CVE-2015-8751 \
+"
+
S = "${WORKDIR}/git"
inherit cmake
diff --git a/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb b/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb
index 9085c6d2fe..4ec0dc6ca3 100644
--- a/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb
+++ b/meta-oe/recipes-graphics/libsdl/libsdl_1.2.15.bb
@@ -82,3 +82,6 @@ do_configure:prepend() {
}
BBCLASSEXTEND = "native nativesdk"
+
+#CVE-2019-14906 is a RHEL specific vulnerability.
+CVE_CHECK_IGNORE += "CVE-2019-14906"
diff --git a/meta-oe/recipes-graphics/lvgl/lv-drivers_7.11.0.bb b/meta-oe/recipes-graphics/lvgl/lv-drivers_7.11.0.bb
index 1a94215839..7f93f704e0 100644
--- a/meta-oe/recipes-graphics/lvgl/lv-drivers_7.11.0.bb
+++ b/meta-oe/recipes-graphics/lvgl/lv-drivers_7.11.0.bb
@@ -9,7 +9,7 @@ LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE;md5=d6fc0df890c5270ef045981b516bb8f2"
# TODO: Pin upstream release (current v7.11.0-80-g419a757)
-SRC_URI = "git://github.com/lvgl/lv_drivers;destsuffix=${S};protocol=https;nobranch=1"
+SRC_URI = "git://github.com/lvgl/lv_drivers;protocol=https;branch=master"
SRCREV = "419a757c23aaa67c676fe3a2196d64808fcf2254"
DEPENDS = "libxkbcommon lvgl wayland"
@@ -19,15 +19,15 @@ REQUIRED_DISTRO_FEATURES = "wayland"
inherit cmake
inherit features_check
-S = "${WORKDIR}/${PN}-${PV}"
+S = "${WORKDIR}/git"
LVGL_CONFIG_WAYLAND_HOR_RES ?= "480"
LVGL_CONFIG_WAYLAND_VER_RES ?= "320"
-EXTRA_OECMAKE += "-Dinstall:BOOL=ON -DLIB_INSTALL_DIR=${BASELIB}"
+EXTRA_OECMAKE += "-Dinstall:BOOL=ON -DLIB_INSTALL_DIR=${baselib}"
TARGET_CFLAGS += "-DLV_CONF_INCLUDE_SIMPLE=1"
-TARGET_CFLAGS += "-I${RECIPE_SYSROOT}/${includedir}/lvgl"
+TARGET_CFLAGS += "-I${STAGING_INCDIR}/lvgl"
# Upstream does not support a default configuration
# but propose a default "disabled" template, which is used as reference
diff --git a/meta-oe/recipes-graphics/lvgl/lv-lib-png_8.0.2.bb b/meta-oe/recipes-graphics/lvgl/lv-lib-png_8.0.2.bb
index 032e85f522..0049bbe237 100644
--- a/meta-oe/recipes-graphics/lvgl/lv-lib-png_8.0.2.bb
+++ b/meta-oe/recipes-graphics/lvgl/lv-lib-png_8.0.2.bb
@@ -8,21 +8,23 @@ DESCRIPTION = "Allow the use of PNG images in LVGL. This implementation uses lod
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE;md5=d6fc0df890c5270ef045981b516bb8f2"
-SRC_URI = "git://github.com/lvgl/lv_lib_png;destsuffix=${S};protocol=https;nobranch=1"
+SRC_URI = "git://github.com/lvgl/lv_lib_png;;protocol=https;branch=master"
SRCREV = "bf1531afe07c9f861107559e29ab8a2d83e4715a"
+S = "${WORKDIR}/git"
+
# because of lvgl dependency
REQUIRED_DISTRO_FEATURES = "wayland"
DEPENDS += "lvgl"
-EXTRA_OECMAKE += "-DLIB_INSTALL_DIR=${BASELIB}"
+EXTRA_OECMAKE += "-DLIB_INSTALL_DIR=${baselib}"
inherit cmake
inherit features_check
TARGET_CFLAGS += "-DLV_CONF_INCLUDE_SIMPLE=1"
-TARGET_CFLAGS += "-I${RECIPE_SYSROOT}/${includedir}/lvgl"
+TARGET_CFLAGS += "-I${STAGING_INCDIR}/lvgl"
FILES:${PN}-dev = "\
${includedir}/lvgl/lv_lib_png/ \
diff --git a/meta-oe/recipes-graphics/lvgl/lvgl_8.1.0.bb b/meta-oe/recipes-graphics/lvgl/lvgl_8.1.0.bb
index 2005afa2fd..0021da01fb 100644
--- a/meta-oe/recipes-graphics/lvgl/lvgl_8.1.0.bb
+++ b/meta-oe/recipes-graphics/lvgl/lvgl_8.1.0.bb
@@ -8,7 +8,7 @@ SUMMARY = "Light and Versatile Graphics Library"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENCE.txt;md5=bf1198c89ae87f043108cea62460b03a"
-SRC_URI = "gitsm://github.com/lvgl/lvgl;destsuffix=${S};protocol=https;nobranch=1"
+SRC_URI = "gitsm://github.com/lvgl/lvgl;protocol=https;branch=master"
SRCREV = "d38eb1e689fa5a64c25e677275172d9c8a4ab2f0"
REQUIRED_DISTRO_FEATURES = "wayland"
@@ -16,8 +16,8 @@ REQUIRED_DISTRO_FEATURES = "wayland"
inherit cmake
inherit features_check
-EXTRA_OECMAKE = "-DLIB_INSTALL_DIR=${BASELIB}"
-S = "${WORKDIR}/${PN}-${PV}"
+EXTRA_OECMAKE = "-DLIB_INSTALL_DIR=${baselib}"
+S = "${WORKDIR}/git"
LVGL_CONFIG_LV_MEM_CUSTOM ?= "0"
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2021-3575.patch b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2021-3575.patch
new file mode 100644
index 0000000000..0322f55cc7
--- /dev/null
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg/CVE-2021-3575.patch
@@ -0,0 +1,45 @@
+From 7bd884f8750892de4f50bf4642fcfbe7011c6bdf Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sun, 18 Feb 2024 17:02:25 +0100
+Subject: [PATCH] opj_decompress: fix off-by-one read heap-buffer-overflow in
+ sycc420_to_rgb() when x0 and y0 are odd (CVE-2021-3575, fixes #1347)
+
+Upstream-Status: Backport [https://github.com/uclouvain/openjpeg/commit/7bd884f8750892de4f50bf4642fcfbe7011c6bdf]
+CVE: CVE-2021-3575
+Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
+---
+ src/bin/common/color.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/src/bin/common/color.c b/src/bin/common/color.c
+index 27f15f13..ae5d648d 100644
+--- a/src/bin/common/color.c
++++ b/src/bin/common/color.c
+@@ -358,7 +358,15 @@ static void sycc420_to_rgb(opj_image_t *img)
+ if (i < loopmaxh) {
+ size_t j;
+
+- for (j = 0U; j < (maxw & ~(size_t)1U); j += 2U) {
++ if (offx > 0U) {
++ sycc_to_rgb(offset, upb, *y, 0, 0, r, g, b);
++ ++y;
++ ++r;
++ ++g;
++ ++b;
++ }
++
++ for (j = 0U; j < (loopmaxw & ~(size_t)1U); j += 2U) {
+ sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
+
+ ++y;
+@@ -375,7 +383,7 @@ static void sycc420_to_rgb(opj_image_t *img)
+ ++cb;
+ ++cr;
+ }
+- if (j < maxw) {
++ if (j < loopmaxw) {
+ sycc_to_rgb(offset, upb, *y, *cb, *cr, r, g, b);
+ }
+ }
+--
+2.39.3
diff --git a/meta-oe/recipes-graphics/openjpeg/openjpeg_2.4.0.bb b/meta-oe/recipes-graphics/openjpeg/openjpeg_2.4.0.bb
index f248619ec8..a619c07aa4 100644
--- a/meta-oe/recipes-graphics/openjpeg/openjpeg_2.4.0.bb
+++ b/meta-oe/recipes-graphics/openjpeg/openjpeg_2.4.0.bb
@@ -11,10 +11,15 @@ SRC_URI = " \
file://0001-This-patch-fixed-include-dir-to-usr-include-.-Obviou.patch \
file://CVE-2021-29338.patch \
file://CVE-2022-1122.patch \
+ file://CVE-2021-3575.patch \
"
SRCREV = "37ac30ceff6640bbab502388c5e0fa0bff23f505"
S = "${WORKDIR}/git"
+CVE_CHECK_IGNORE += "\
+ CVE-2015-1239 \
+"
+
inherit cmake
# for multilib
@@ -22,4 +27,4 @@ EXTRA_OECMAKE += "-DOPENJPEG_INSTALL_LIB_DIR=${@d.getVar('baselib').replace('/',
FILES:${PN} += "${libdir}/openjpeg*"
-BBCLASSEXTEND = "native nativesdk"
+BBCLASSEXTEND = "native"
diff --git a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
index 5f404f2aa2..5cde7c9fb4 100644
--- a/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
+++ b/meta-oe/recipes-graphics/tigervnc/tigervnc_1.11.0.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "http://www.tigervnc.com/"
LICENSE = "GPL-2.0-or-later"
SECTION = "x11/utils"
DEPENDS = "xserver-xorg gnutls jpeg libxtst gettext-native fltk libpam"
-RDEPENDS:${PN} = "coreutils hicolor-icon-theme perl bash"
+RDEPENDS:${PN} = "coreutils hicolor-icon-theme perl bash xkbcomp"
LIC_FILES_CHKSUM = "file://LICENCE.TXT;md5=75b02c2872421380bbd47781d2bd75d3"
diff --git a/meta-oe/recipes-graphics/tslib/tslib_1.22.bb b/meta-oe/recipes-graphics/tslib/tslib_1.22.bb
index c2000b264b..cb2563225f 100644
--- a/meta-oe/recipes-graphics/tslib/tslib_1.22.bb
+++ b/meta-oe/recipes-graphics/tslib/tslib_1.22.bb
@@ -81,3 +81,5 @@ FILES:tslib-uinput += "${bindir}/ts_uinput"
FILES:tslib-tests = "${bindir}/ts_harvest ${bindir}/ts_print ${bindir}/ts_print_raw ${bindir}/ts_print_mt \
${bindir}/ts_test ${bindir}/ts_test_mt ${bindir}/ts_verify ${bindir}/ts_finddev ${bindir}/ts_conf"
+
+BBCLASSEXTEND = "native nativesdk"
diff --git a/meta-oe/recipes-graphics/xorg-app/xkbutils_1.0.4.bb b/meta-oe/recipes-graphics/xorg-app/xkbutils_1.0.4.bb
index 6a05e98e32..d394b33de2 100644
--- a/meta-oe/recipes-graphics/xorg-app/xkbutils_1.0.4.bb
+++ b/meta-oe/recipes-graphics/xorg-app/xkbutils_1.0.4.bb
@@ -13,7 +13,5 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=64322fab5239f5c8d97cf6e0e14f1c62"
DEPENDS += "libxaw libxkbfile"
-BBCLASSEXTEND = "native"
-
SRC_URI[md5sum] = "502b14843f610af977dffc6cbf2102d5"
SRC_URI[sha256sum] = "d2a18ab90275e8bca028773c44264d2266dab70853db4321bdbc18da75148130"
diff --git a/meta-oe/recipes-graphics/xorg-app/xsetroot_1.1.2.bb b/meta-oe/recipes-graphics/xorg-app/xsetroot_1.1.2.bb
index 30a1e089e3..a9a8acf05c 100644
--- a/meta-oe/recipes-graphics/xorg-app/xsetroot_1.1.2.bb
+++ b/meta-oe/recipes-graphics/xorg-app/xsetroot_1.1.2.bb
@@ -8,7 +8,6 @@ LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=6ea29dbee22324787c061f039e0529de"
DEPENDS += "xbitmaps libxcursor"
-BBCLASSEXTEND = "native"
SRC_URI[md5sum] = "5fe769c8777a6e873ed1305e4ce2c353"
SRC_URI[sha256sum] = "10c442ba23591fb5470cea477a0aa5f679371f4f879c8387a1d9d05637ae417c"
diff --git a/meta-oe/recipes-graphics/xorg-app/xterm/CVE-2022-45063.patch b/meta-oe/recipes-graphics/xorg-app/xterm/CVE-2022-45063.patch
new file mode 100644
index 0000000000..167c326822
--- /dev/null
+++ b/meta-oe/recipes-graphics/xorg-app/xterm/CVE-2022-45063.patch
@@ -0,0 +1,782 @@
+From 787636674918873a091e7a4ef5977263ba982322 Mon Sep 17 00:00:00 2001
+From: "Thomas E. Dickey" <dickey@invisible-island.net>
+Date: Sun, 23 Oct 2022 22:59:52 +0000
+Subject: [PATCH] snapshot of project "xterm", label xterm-374c
+
+Upstream-Status: https://github.com/ThomasDickey/xterm-snapshots/commit/787636674918873a091e7a4ef5977263ba982322
+CVE: CVE-2022-45063
+
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ button.c | 14 +--
+ charproc.c | 9 +-
+ doublechr.c | 4 +-
+ fontutils.c | 266 ++++++++++++++++++++++++++-----------------------
+ fontutils.h | 4 +-
+ misc.c | 7 +-
+ screen.c | 2 +-
+ xterm.h | 2 +-
+ xterm.log.html | 6 ++
+ 9 files changed, 163 insertions(+), 151 deletions(-)
+
+diff --git a/button.c b/button.c
+index f10092a..0bbf76e 100644
+--- a/button.c
++++ b/button.c
+@@ -2051,13 +2051,8 @@ void
+ UnmapSelections(XtermWidget xw)
+ {
+ TScreen *screen = TScreenOf(xw);
+- Cardinal n;
+
+- if (screen->mappedSelect) {
+- for (n = 0; screen->mappedSelect[n] != 0; ++n)
+- free((void *) screen->mappedSelect[n]);
+- FreeAndNull(screen->mappedSelect);
+- }
++ FreeAndNull(screen->mappedSelect);
+ }
+
+ /*
+@@ -2093,14 +2088,11 @@ MapSelections(XtermWidget xw, String *params, Cardinal num_params)
+ if ((result = TypeMallocN(String, num_params + 1)) != 0) {
+ result[num_params] = 0;
+ for (j = 0; j < num_params; ++j) {
+- result[j] = x_strdup((isSELECT(params[j])
++ result[j] = (String) (isSELECT(params[j])
+ ? mapTo
+- : params[j]));
++ : params[j]);
+ if (result[j] == 0) {
+ UnmapSelections(xw);
+- while (j != 0) {
+- free((void *) result[--j]);
+- }
+ FreeAndNull(result);
+ break;
+ }
+diff --git a/charproc.c b/charproc.c
+index 2a3c69a..91cbcea 100644
+--- a/charproc.c
++++ b/charproc.c
+@@ -13605,7 +13605,6 @@ DoSetSelectedFont(Widget w,
+ Bell(xw, XkbBI_MinorError, 0);
+ } else {
+ Boolean failed = False;
+- int oldFont = TScreenOf(xw)->menu_font_number;
+ char *save = TScreenOf(xw)->SelectFontName();
+ char *val;
+ char *test;
+@@ -13650,10 +13649,6 @@ DoSetSelectedFont(Widget w,
+ failed = True;
+ }
+ if (failed) {
+- (void) xtermLoadFont(xw,
+- xtermFontName(TScreenOf(xw)->MenuFontName(oldFont)),
+- True,
+- oldFont);
+ Bell(xw, XkbBI_MinorError, 0);
+ }
+ free(used);
+@@ -13662,7 +13657,7 @@ DoSetSelectedFont(Widget w,
+ }
+ }
+
+-void
++Bool
+ FindFontSelection(XtermWidget xw, const char *atom_name, Bool justprobe)
+ {
+ TScreen *screen = TScreenOf(xw);
+@@ -13702,7 +13697,7 @@ FindFontSelection(XtermWidget xw, const char *atom_name, Bool justprobe)
+ DoSetSelectedFont, NULL,
+ XtLastTimestampProcessed(XtDisplay(xw)));
+ }
+- return;
++ return (screen->SelectFontName() != NULL) ? True : False;
+ }
+
+ Bool
+diff --git a/doublechr.c b/doublechr.c
+index a802e32..6416849 100644
+--- a/doublechr.c
++++ b/doublechr.c
+@@ -295,7 +295,7 @@ xterm_DoubleGC(XTermDraw * params, GC old_gc, int *inxp)
+ temp.flags = (params->attr_flags & BOLD);
+ temp.warn = fwResource;
+
+- if (!xtermOpenFont(params->xw, name, &temp, False)) {
++ if (!xtermOpenFont(params->xw, name, &temp, NULL, False)) {
+ XTermDraw local = *params;
+ char *nname;
+
+@@ -304,7 +304,7 @@ xterm_DoubleGC(XTermDraw * params, GC old_gc, int *inxp)
+ nname = xtermSpecialFont(&local);
+ if (nname != 0) {
+ found = (Boolean) xtermOpenFont(params->xw, nname, &temp,
+- False);
++ NULL, False);
+ free(nname);
+ }
+ } else {
+diff --git a/fontutils.c b/fontutils.c
+index 1646b4b..71f4ec2 100644
+--- a/fontutils.c
++++ b/fontutils.c
+@@ -92,9 +92,9 @@
+ }
+
+ #define FREE_FNAME(field) \
+- if (fonts == 0 || myfonts.field != fonts->field) { \
+- FREE_STRING(myfonts.field); \
+- myfonts.field = 0; \
++ if (fonts == 0 || new_fnames.field != fonts->field) { \
++ FREE_STRING(new_fnames.field); \
++ new_fnames.field = 0; \
+ }
+
+ /*
+@@ -573,7 +573,7 @@ open_italic_font(XtermWidget xw, int n, FontNameProperties *fp, XTermFonts * dat
+ if ((name = italic_font_name(fp, slant[pass])) != 0) {
+ TRACE(("open_italic_font %s %s\n",
+ whichFontEnum((VTFontEnum) n), name));
+- if (xtermOpenFont(xw, name, data, False)) {
++ if (xtermOpenFont(xw, name, data, NULL, False)) {
+ result = (data->fs != 0);
+ #if OPT_REPORT_FONTS
+ if (resource.reportFonts) {
+@@ -1037,20 +1037,26 @@ xtermLoadQueryFont(XtermWidget xw, const char *name)
+ }
+
+ /*
+- * Open the given font and verify that it is non-empty. Return a null on
++ * Open the given font and verify that it is non-empty. Return false on
+ * failure.
+ */
+ Bool
+ xtermOpenFont(XtermWidget xw,
+ const char *name,
+ XTermFonts * result,
++ XTermFonts * current,
+ Bool force)
+ {
+ Bool code = False;
+
+ TRACE(("xtermOpenFont %d:%d '%s'\n",
+ result->warn, xw->misc.fontWarnings, NonNull(name)));
++
+ if (!IsEmpty(name)) {
++ Bool existing = (current != NULL
++ && current->fs != NULL
++ && current->fn != NULL);
++
+ if ((result->fs = xtermLoadQueryFont(xw, name)) != 0) {
+ code = True;
+ if (EmptyFont(result->fs)) {
+@@ -1069,9 +1075,13 @@ xtermOpenFont(XtermWidget xw,
+ } else {
+ TRACE(("xtermOpenFont: cannot load font '%s'\n", name));
+ }
+- if (force) {
++ if (existing) {
++ TRACE(("...continue using font '%s'\n", current->fn));
++ result->fn = x_strdup(current->fn);
++ result->fs = current->fs;
++ } else if (force) {
+ NoFontWarning(result);
+- code = xtermOpenFont(xw, DEFFONT, result, True);
++ code = xtermOpenFont(xw, DEFFONT, result, NULL, True);
+ }
+ }
+ }
+@@ -1321,6 +1331,7 @@ static Bool
+ loadNormFP(XtermWidget xw,
+ char **nameOutP,
+ XTermFonts * infoOut,
++ XTermFonts * current,
+ int fontnum)
+ {
+ Bool status = True;
+@@ -1330,7 +1341,7 @@ loadNormFP(XtermWidget xw,
+ if (!xtermOpenFont(xw,
+ *nameOutP,
+ infoOut,
+- (fontnum == fontMenu_default))) {
++ current, (fontnum == fontMenu_default))) {
+ /*
+ * If we are opening the default font, and it happens to be missing,
+ * force that to the compiled-in default font, e.g., "fixed". If we
+@@ -1365,10 +1376,10 @@ loadBoldFP(XtermWidget xw,
+ if (fp != 0) {
+ NoFontWarning(infoOut);
+ *nameOutP = bold_font_name(fp, fp->average_width);
+- if (!xtermOpenFont(xw, *nameOutP, infoOut, False)) {
++ if (!xtermOpenFont(xw, *nameOutP, infoOut, NULL, False)) {
+ free(*nameOutP);
+ *nameOutP = bold_font_name(fp, -1);
+- xtermOpenFont(xw, *nameOutP, infoOut, False);
++ xtermOpenFont(xw, *nameOutP, infoOut, NULL, False);
+ }
+ TRACE(("...derived bold '%s'\n", NonNull(*nameOutP)));
+ }
+@@ -1386,7 +1397,7 @@ loadBoldFP(XtermWidget xw,
+ TRACE(("...did not get a matching bold font\n"));
+ }
+ free(normal);
+- } else if (!xtermOpenFont(xw, *nameOutP, infoOut, False)) {
++ } else if (!xtermOpenFont(xw, *nameOutP, infoOut, NULL, False)) {
+ xtermCopyFontInfo(infoOut, infoRef);
+ TRACE(("...cannot load bold font '%s'\n", NonNull(*nameOutP)));
+ } else {
+@@ -1440,7 +1451,7 @@ loadWideFP(XtermWidget xw,
+ }
+
+ if (check_fontname(*nameOutP)) {
+- if (xtermOpenFont(xw, *nameOutP, infoOut, False)
++ if (xtermOpenFont(xw, *nameOutP, infoOut, NULL, False)
+ && is_derived_font_name(*nameOutP)
+ && EmptyFont(infoOut->fs)) {
+ xtermCloseFont2(xw, infoOut - fWide, fWide);
+@@ -1493,7 +1504,7 @@ loadWBoldFP(XtermWidget xw,
+
+ if (check_fontname(*nameOutP)) {
+
+- if (xtermOpenFont(xw, *nameOutP, infoOut, False)
++ if (xtermOpenFont(xw, *nameOutP, infoOut, NULL, False)
+ && is_derived_font_name(*nameOutP)
+ && !compatibleWideCounts(wideInfoRef->fs, infoOut->fs)) {
+ xtermCloseFont2(xw, infoOut - fWBold, fWBold);
+@@ -1546,6 +1557,10 @@ loadWBoldFP(XtermWidget xw,
+ }
+ #endif
+
++/*
++ * Load a given bitmap font, along with the bold/wide variants.
++ * Returns nonzero on success.
++ */
+ int
+ xtermLoadFont(XtermWidget xw,
+ const VTFontNames * fonts,
+@@ -1555,33 +1570,37 @@ xtermLoadFont(XtermWidget xw,
+ TScreen *screen = TScreenOf(xw);
+ VTwin *win = WhichVWin(screen);
+
+- VTFontNames myfonts;
+- XTermFonts fnts[fMAX];
++ VTFontNames new_fnames;
++ XTermFonts new_fonts[fMAX];
++ XTermFonts old_fonts[fMAX];
+ char *tmpname = NULL;
+ Boolean proportional = False;
++ Boolean recovered;
++ int code = 0;
+
+- memset(&myfonts, 0, sizeof(myfonts));
+- memset(fnts, 0, sizeof(fnts));
++ memset(&new_fnames, 0, sizeof(new_fnames));
++ memset(new_fonts, 0, sizeof(new_fonts));
++ memcpy(&old_fonts, screen->fnts, sizeof(old_fonts));
+
+ if (fonts != 0)
+- myfonts = *fonts;
+- if (!check_fontname(myfonts.f_n))
+- return 0;
++ new_fnames = *fonts;
++ if (!check_fontname(new_fnames.f_n))
++ return code;
+
+ if (fontnum == fontMenu_fontescape
+- && myfonts.f_n != screen->MenuFontName(fontnum)) {
+- if ((tmpname = x_strdup(myfonts.f_n)) == 0)
+- return 0;
++ && new_fnames.f_n != screen->MenuFontName(fontnum)) {
++ if ((tmpname = x_strdup(new_fnames.f_n)) == 0)
++ return code;
+ }
+
+- TRACE(("Begin Cgs - xtermLoadFont(%s)\n", myfonts.f_n));
++ TRACE(("Begin Cgs - xtermLoadFont(%s)\n", new_fnames.f_n));
+ releaseWindowGCs(xw, win);
+
+ #define DbgResource(name, field, index) \
+ TRACE(("xtermLoadFont #%d "name" %s%s\n", \
+ fontnum, \
+- (fnts[index].warn == fwResource) ? "*" : " ", \
+- NonNull(myfonts.field)))
++ (new_fonts[index].warn == fwResource) ? "*" : " ", \
++ NonNull(new_fnames.field)))
+ DbgResource("normal", f_n, fNorm);
+ DbgResource("bold ", f_b, fBold);
+ #if OPT_WIDE_CHARS
+@@ -1590,16 +1609,17 @@ xtermLoadFont(XtermWidget xw,
+ #endif
+
+ if (!loadNormFP(xw,
+- &myfonts.f_n,
+- &fnts[fNorm],
++ &new_fnames.f_n,
++ &new_fonts[fNorm],
++ &old_fonts[fNorm],
+ fontnum))
+ goto bad;
+
+ if (!loadBoldFP(xw,
+- &myfonts.f_b,
+- &fnts[fBold],
+- myfonts.f_n,
+- &fnts[fNorm],
++ &new_fnames.f_b,
++ &new_fonts[fBold],
++ new_fnames.f_n,
++ &new_fonts[fNorm],
+ fontnum))
+ goto bad;
+
+@@ -1611,20 +1631,20 @@ xtermLoadFont(XtermWidget xw,
+ if_OPT_WIDE_CHARS(screen, {
+
+ if (!loadWideFP(xw,
+- &myfonts.f_w,
+- &fnts[fWide],
+- myfonts.f_n,
+- &fnts[fNorm],
++ &new_fnames.f_w,
++ &new_fonts[fWide],
++ new_fnames.f_n,
++ &new_fonts[fNorm],
+ fontnum))
+ goto bad;
+
+ if (!loadWBoldFP(xw,
+- &myfonts.f_wb,
+- &fnts[fWBold],
+- myfonts.f_w,
+- &fnts[fWide],
+- myfonts.f_b,
+- &fnts[fBold],
++ &new_fnames.f_wb,
++ &new_fonts[fWBold],
++ new_fnames.f_w,
++ &new_fonts[fWide],
++ new_fnames.f_b,
++ &new_fonts[fBold],
+ fontnum))
+ goto bad;
+
+@@ -1634,30 +1654,30 @@ xtermLoadFont(XtermWidget xw,
+ * Normal/bold fonts should be the same width. Also, the min/max
+ * values should be the same.
+ */
+- if (fnts[fNorm].fs != 0
+- && fnts[fBold].fs != 0
+- && (!is_fixed_font(fnts[fNorm].fs)
+- || !is_fixed_font(fnts[fBold].fs)
+- || differing_widths(fnts[fNorm].fs, fnts[fBold].fs))) {
++ if (new_fonts[fNorm].fs != 0
++ && new_fonts[fBold].fs != 0
++ && (!is_fixed_font(new_fonts[fNorm].fs)
++ || !is_fixed_font(new_fonts[fBold].fs)
++ || differing_widths(new_fonts[fNorm].fs, new_fonts[fBold].fs))) {
+ TRACE(("Proportional font! normal %d/%d, bold %d/%d\n",
+- fnts[fNorm].fs->min_bounds.width,
+- fnts[fNorm].fs->max_bounds.width,
+- fnts[fBold].fs->min_bounds.width,
+- fnts[fBold].fs->max_bounds.width));
++ new_fonts[fNorm].fs->min_bounds.width,
++ new_fonts[fNorm].fs->max_bounds.width,
++ new_fonts[fBold].fs->min_bounds.width,
++ new_fonts[fBold].fs->max_bounds.width));
+ proportional = True;
+ }
+
+ if_OPT_WIDE_CHARS(screen, {
+- if (fnts[fWide].fs != 0
+- && fnts[fWBold].fs != 0
+- && (!is_fixed_font(fnts[fWide].fs)
+- || !is_fixed_font(fnts[fWBold].fs)
+- || differing_widths(fnts[fWide].fs, fnts[fWBold].fs))) {
++ if (new_fonts[fWide].fs != 0
++ && new_fonts[fWBold].fs != 0
++ && (!is_fixed_font(new_fonts[fWide].fs)
++ || !is_fixed_font(new_fonts[fWBold].fs)
++ || differing_widths(new_fonts[fWide].fs, new_fonts[fWBold].fs))) {
+ TRACE(("Proportional font! wide %d/%d, wide bold %d/%d\n",
+- fnts[fWide].fs->min_bounds.width,
+- fnts[fWide].fs->max_bounds.width,
+- fnts[fWBold].fs->min_bounds.width,
+- fnts[fWBold].fs->max_bounds.width));
++ new_fonts[fWide].fs->min_bounds.width,
++ new_fonts[fWide].fs->max_bounds.width,
++ new_fonts[fWBold].fs->min_bounds.width,
++ new_fonts[fWBold].fs->max_bounds.width));
+ proportional = True;
+ }
+ });
+@@ -1676,13 +1696,13 @@ xtermLoadFont(XtermWidget xw,
+ screen->ifnts_ok = False;
+ #endif
+
+- xtermCopyFontInfo(GetNormalFont(screen, fNorm), &fnts[fNorm]);
+- xtermCopyFontInfo(GetNormalFont(screen, fBold), &fnts[fBold]);
++ xtermCopyFontInfo(GetNormalFont(screen, fNorm), &new_fonts[fNorm]);
++ xtermCopyFontInfo(GetNormalFont(screen, fBold), &new_fonts[fBold]);
+ #if OPT_WIDE_CHARS
+- xtermCopyFontInfo(GetNormalFont(screen, fWide), &fnts[fWide]);
+- if (fnts[fWBold].fs == NULL)
+- xtermCopyFontInfo(GetNormalFont(screen, fWide), &fnts[fWide]);
+- xtermCopyFontInfo(GetNormalFont(screen, fWBold), &fnts[fWBold]);
++ xtermCopyFontInfo(GetNormalFont(screen, fWide), &new_fonts[fWide]);
++ if (new_fonts[fWBold].fs == NULL)
++ xtermCopyFontInfo(GetNormalFont(screen, fWide), &new_fonts[fWide]);
++ xtermCopyFontInfo(GetNormalFont(screen, fWBold), &new_fonts[fWBold]);
+ #endif
+
+ xtermUpdateFontGCs(xw, getNormalFont);
+@@ -1713,7 +1733,7 @@ xtermLoadFont(XtermWidget xw,
+ unsigned ch;
+
+ #if OPT_TRACE
+-#define TRACE_MISS(index) show_font_misses(#index, &fnts[index])
++#define TRACE_MISS(index) show_font_misses(#index, &new_fonts[index])
+ TRACE_MISS(fNorm);
+ TRACE_MISS(fBold);
+ #if OPT_WIDE_CHARS
+@@ -1730,8 +1750,8 @@ xtermLoadFont(XtermWidget xw,
+ if ((n != UCS_REPL)
+ && (n != ch)
+ && (screen->fnt_boxes & 2)) {
+- if (xtermMissingChar(n, &fnts[fNorm]) ||
+- xtermMissingChar(n, &fnts[fBold])) {
++ if (xtermMissingChar(n, &new_fonts[fNorm]) ||
++ xtermMissingChar(n, &new_fonts[fBold])) {
+ UIntClr(screen->fnt_boxes, 2);
+ TRACE(("missing graphics character #%d, U+%04X\n",
+ ch, n));
+@@ -1743,12 +1763,12 @@ xtermLoadFont(XtermWidget xw,
+ #endif
+
+ for (ch = 1; ch < 32; ch++) {
+- if (xtermMissingChar(ch, &fnts[fNorm])) {
++ if (xtermMissingChar(ch, &new_fonts[fNorm])) {
+ TRACE(("missing normal char #%d\n", ch));
+ UIntClr(screen->fnt_boxes, 1);
+ break;
+ }
+- if (xtermMissingChar(ch, &fnts[fBold])) {
++ if (xtermMissingChar(ch, &new_fonts[fBold])) {
+ TRACE(("missing bold char #%d\n", ch));
+ UIntClr(screen->fnt_boxes, 1);
+ break;
+@@ -1765,8 +1785,8 @@ xtermLoadFont(XtermWidget xw,
+ screen->enbolden = screen->bold_mode;
+ } else {
+ screen->enbolden = screen->bold_mode
+- && ((fnts[fNorm].fs == fnts[fBold].fs)
+- || same_font_name(myfonts.f_n, myfonts.f_b));
++ && ((new_fonts[fNorm].fs == new_fonts[fBold].fs)
++ || same_font_name(new_fnames.f_n, new_fnames.f_b));
+ }
+ TRACE(("Will %suse 1-pixel offset/overstrike to simulate bold\n",
+ screen->enbolden ? "" : "not "));
+@@ -1782,7 +1802,7 @@ xtermLoadFont(XtermWidget xw,
+ update_font_escape();
+ }
+ #if OPT_SHIFT_FONTS
+- screen->menu_font_sizes[fontnum] = FontSize(fnts[fNorm].fs);
++ screen->menu_font_sizes[fontnum] = FontSize(new_fonts[fNorm].fs);
+ #endif
+ }
+ set_cursor_gcs(xw);
+@@ -1797,20 +1817,21 @@ xtermLoadFont(XtermWidget xw,
+ FREE_FNAME(f_w);
+ FREE_FNAME(f_wb);
+ #endif
+- if (fnts[fNorm].fn == fnts[fBold].fn) {
+- free(fnts[fNorm].fn);
++ if (new_fonts[fNorm].fn == new_fonts[fBold].fn) {
++ free(new_fonts[fNorm].fn);
+ } else {
+- free(fnts[fNorm].fn);
+- free(fnts[fBold].fn);
++ free(new_fonts[fNorm].fn);
++ free(new_fonts[fBold].fn);
+ }
+ #if OPT_WIDE_CHARS
+- free(fnts[fWide].fn);
+- free(fnts[fWBold].fn);
++ free(new_fonts[fWide].fn);
++ free(new_fonts[fWBold].fn);
+ #endif
+ xtermSetWinSize(xw);
+ return 1;
+
+ bad:
++ recovered = False;
+ free(tmpname);
+
+ #if OPT_RENDERFONT
+@@ -1820,15 +1841,15 @@ xtermLoadFont(XtermWidget xw,
+ SetItemSensitivity(fontMenuEntries[fontnum].widget, True);
+ #endif
+ Bell(xw, XkbBI_MinorError, 0);
+- myfonts.f_n = screen->MenuFontName(old_fontnum);
+- return xtermLoadFont(xw, &myfonts, doresize, old_fontnum);
+- } else if (x_strcasecmp(myfonts.f_n, DEFFONT)) {
+- int code;
+-
+- myfonts.f_n = x_strdup(DEFFONT);
+- TRACE(("...recovering for TrueType fonts\n"));
+- code = xtermLoadFont(xw, &myfonts, doresize, fontnum);
+- if (code) {
++ new_fnames.f_n = screen->MenuFontName(old_fontnum);
++ if (xtermLoadFont(xw, &new_fnames, doresize, old_fontnum))
++ recovered = True;
++ } else if (x_strcasecmp(new_fnames.f_n, DEFFONT)
++ && x_strcasecmp(new_fnames.f_n, old_fonts[fNorm].fn)) {
++ new_fnames.f_n = x_strdup(old_fonts[fNorm].fn);
++ TRACE(("...recovering from failed font-load\n"));
++ if (xtermLoadFont(xw, &new_fnames, doresize, fontnum)) {
++ recovered = True;
+ if (fontnum != fontMenu_fontsel) {
+ SetItemSensitivity(fontMenuEntries[fontnum].widget,
+ UsingRenderFont(xw));
+@@ -1837,15 +1858,15 @@ xtermLoadFont(XtermWidget xw,
+ FontHeight(screen),
+ FontWidth(screen)));
+ }
+- return code;
+ }
+ #endif
+-
+- releaseWindowGCs(xw, win);
+-
+- xtermCloseFonts(xw, fnts);
+- TRACE(("Fail Cgs - xtermLoadFont\n"));
+- return 0;
++ if (!recovered) {
++ releaseWindowGCs(xw, win);
++ xtermCloseFonts(xw, new_fonts);
++ TRACE(("Fail Cgs - xtermLoadFont\n"));
++ code = 0;
++ }
++ return code;
+ }
+
+ #if OPT_WIDE_ATTRS
+@@ -1893,7 +1914,7 @@ xtermLoadItalics(XtermWidget xw)
+ } else {
+ xtermOpenFont(xw,
+ getNormalFont(screen, n)->fn,
+- data, False);
++ data, NULL, False);
+ }
+ }
+ }
+@@ -4250,6 +4271,8 @@ findXftGlyph(XtermWidget xw, XftFont *given, unsigned wc)
+ }
+ #endif
+ if (foundXftGlyph(xw, check, wc)) {
++ (void) added;
++ (void) actual;
+ markXftOpened(xw, which, n, wc);
+ reportXftFonts(xw, check, "fallback", tag, myReport);
+ result = check;
+@@ -4451,7 +4474,7 @@ lookupOneFontSize(XtermWidget xw, int fontnum)
+
+ memset(&fnt, 0, sizeof(fnt));
+ screen->menu_font_sizes[fontnum] = -1;
+- if (xtermOpenFont(xw, screen->MenuFontName(fontnum), &fnt, True)) {
++ if (xtermOpenFont(xw, screen->MenuFontName(fontnum), &fnt, NULL, True)) {
+ if (fontnum <= fontMenu_lastBuiltin
+ || strcmp(fnt.fn, DEFFONT)) {
+ screen->menu_font_sizes[fontnum] = FontSize(fnt.fs);
+@@ -4864,13 +4887,14 @@ HandleSetFont(Widget w,
+ }
+ }
+
+-void
++Bool
+ SetVTFont(XtermWidget xw,
+ int which,
+ Bool doresize,
+ const VTFontNames * fonts)
+ {
+ TScreen *screen = TScreenOf(xw);
++ Bool result = False;
+
+ TRACE(("SetVTFont(which=%d, f_n=%s, f_b=%s)\n", which,
+ (fonts && fonts->f_n) ? fonts->f_n : "<null>",
+@@ -4879,34 +4903,31 @@ SetVTFont(XtermWidget xw,
+ if (IsIcon(screen)) {
+ Bell(xw, XkbBI_MinorError, 0);
+ } else if (which >= 0 && which < NMENUFONTS) {
+- VTFontNames myfonts;
++ VTFontNames new_fnames;
+
+- memset(&myfonts, 0, sizeof(myfonts));
++ memset(&new_fnames, 0, sizeof(new_fnames));
+ if (fonts != 0)
+- myfonts = *fonts;
++ new_fnames = *fonts;
+
+ if (which == fontMenu_fontsel) { /* go get the selection */
+- FindFontSelection(xw, myfonts.f_n, False);
++ result = FindFontSelection(xw, new_fnames.f_n, False);
+ } else {
+- int oldFont = screen->menu_font_number;
+-
+ #define USE_CACHED(field, name) \
+- if (myfonts.field == 0) { \
+- myfonts.field = x_strdup(screen->menu_font_names[which][name]); \
+- TRACE(("set myfonts." #field " from menu_font_names[%d][" #name "] %s\n", \
+- which, NonNull(myfonts.field))); \
++ if (new_fnames.field == NULL) { \
++ new_fnames.field = x_strdup(screen->menu_font_names[which][name]); \
++ TRACE(("set new_fnames." #field " from menu_font_names[%d][" #name "] %s\n", \
++ which, NonNull(new_fnames.field))); \
+ } else { \
+- TRACE(("set myfonts." #field " reused\n")); \
++ TRACE(("set new_fnames." #field " reused\n")); \
+ }
+ #define SAVE_FNAME(field, name) \
+- if (myfonts.field != 0) { \
+- if (screen->menu_font_names[which][name] == 0 \
+- || strcmp(screen->menu_font_names[which][name], myfonts.field)) { \
+- TRACE(("updating menu_font_names[%d][" #name "] to \"%s\"\n", \
+- which, myfonts.field)); \
+- FREE_STRING(screen->menu_font_names[which][name]); \
+- screen->menu_font_names[which][name] = x_strdup(myfonts.field); \
+- } \
++ if (new_fnames.field != NULL \
++ && (screen->menu_font_names[which][name] == NULL \
++ || strcmp(screen->menu_font_names[which][name], new_fnames.field))) { \
++ TRACE(("updating menu_font_names[%d][" #name "] to \"%s\"\n", \
++ which, new_fnames.field)); \
++ FREE_STRING(screen->menu_font_names[which][name]); \
++ screen->menu_font_names[which][name] = x_strdup(new_fnames.field); \
+ }
+
+ USE_CACHED(f_n, fNorm);
+@@ -4916,7 +4937,7 @@ SetVTFont(XtermWidget xw,
+ USE_CACHED(f_wb, fWBold);
+ #endif
+ if (xtermLoadFont(xw,
+- &myfonts,
++ &new_fnames,
+ doresize, which)) {
+ /*
+ * If successful, save the data so that a subsequent query via
+@@ -4928,10 +4949,8 @@ SetVTFont(XtermWidget xw,
+ SAVE_FNAME(f_w, fWide);
+ SAVE_FNAME(f_wb, fWBold);
+ #endif
++ result = True;
+ } else {
+- (void) xtermLoadFont(xw,
+- xtermFontName(screen->MenuFontName(oldFont)),
+- doresize, oldFont);
+ Bell(xw, XkbBI_MinorError, 0);
+ }
+ FREE_FNAME(f_n);
+@@ -4944,7 +4963,8 @@ SetVTFont(XtermWidget xw,
+ } else {
+ Bell(xw, XkbBI_MinorError, 0);
+ }
+- return;
++ TRACE(("...SetVTFont: %d\n", result));
++ return result;
+ }
+
+ #if OPT_RENDERFONT
+diff --git a/fontutils.h b/fontutils.h
+index 2267f24..5b3afe0 100644
+--- a/fontutils.h
++++ b/fontutils.h
+@@ -37,7 +37,7 @@
+ /* *INDENT-OFF* */
+
+ extern Bool xtermLoadDefaultFonts (XtermWidget /* xw */);
+-extern Bool xtermOpenFont (XtermWidget /* xw */, const char */* name */, XTermFonts * /* result */, Bool /* force */);
++extern Bool xtermOpenFont (XtermWidget /* xw */, const char */* name */, XTermFonts * /* result */, XTermFonts * /* current */, Bool /* force */);
+ extern XFontStruct * xtermLoadQueryFont(XtermWidget /* xw */, const char * /*name */);
+ extern XTermFonts * getDoubleFont (TScreen * /* screen */, int /* which */);
+ extern XTermFonts * getItalicFont (TScreen * /* screen */, int /* which */);
+@@ -51,7 +51,7 @@ extern int lookupRelativeFontSize (XtermWidget /* xw */, int /* old */, int /* r
+ extern int xtermGetFont (const char * /* param */);
+ extern int xtermLoadFont (XtermWidget /* xw */, const VTFontNames */* fonts */, Bool /* doresize */, int /* fontnum */);
+ extern void HandleSetFont PROTO_XT_ACTIONS_ARGS;
+-extern void SetVTFont (XtermWidget /* xw */, int /* i */, Bool /* doresize */, const VTFontNames */* fonts */);
++extern Bool SetVTFont (XtermWidget /* xw */, int /* i */, Bool /* doresize */, const VTFontNames */* fonts */);
+ extern void allocFontList (XtermWidget /* xw */, const char * /* name */, XtermFontNames * /* target */, VTFontEnum /* which */, const char * /* source */, Bool /* ttf */);
+ extern void copyFontList (char *** /* targetp */, char ** /* source */);
+ extern void initFontLists (XtermWidget /* xw */);
+diff --git a/misc.c b/misc.c
+index cbb2679..aafbb08 100644
+--- a/misc.c
++++ b/misc.c
+@@ -3941,9 +3941,9 @@ ChangeFontRequest(XtermWidget xw, String buf)
+ {
+ memset(&fonts, 0, sizeof(fonts));
+ fonts.f_n = name;
+- SetVTFont(xw, num, True, &fonts);
+- if (num == screen->menu_font_number &&
+- num != fontMenu_fontescape) {
++ if (SetVTFont(xw, num, True, &fonts)
++ && num == screen->menu_font_number
++ && num != fontMenu_fontescape) {
+ screen->EscapeFontName() = x_strdup(name);
+ }
+ }
+@@ -6422,7 +6422,6 @@ xtermSetenv(const char *var, const char *value)
+
+ found = envindex;
+ environ[found + 1] = NULL;
+- environ = environ;
+ }
+
+ environ[found] = malloc(2 + len + strlen(value));
+diff --git a/screen.c b/screen.c
+index 93e36b3..f82ee44 100644
+--- a/screen.c
++++ b/screen.c
+@@ -1454,7 +1454,7 @@ ScrnRefresh(XtermWidget xw,
+ maxrow += StatusLineRows;
+ }
+ #endif
+-
++ (void) recurse;
+ ++recurse;
+
+ if (screen->cursorp.col >= leftcol
+diff --git a/xterm.h b/xterm.h
+index e6bd123..c4fe811 100644
+--- a/xterm.h
++++ b/xterm.h
+@@ -999,7 +999,7 @@ extern Bool CheckBufPtrs (TScreen * /* screen */);
+ extern Bool set_cursor_gcs (XtermWidget /* xw */);
+ extern char * vt100ResourceToString (XtermWidget /* xw */, const char * /* name */);
+ extern int VTInit (XtermWidget /* xw */);
+-extern void FindFontSelection (XtermWidget /* xw */, const char * /* atom_name */, Bool /* justprobe */);
++extern Bool FindFontSelection (XtermWidget /* xw */, const char * /* atom_name */, Bool /* justprobe */);
+ extern void HideCursor (XtermWidget /* xw */);
+ extern void RestartBlinking(XtermWidget /* xw */);
+ extern void ShowCursor (XtermWidget /* xw */);
+diff --git a/xterm.log.html b/xterm.log.html
+index 03324b1..0f28658 100644
+--- a/xterm.log.html
++++ b/xterm.log.html
+@@ -1026,6 +1026,12 @@
+ 2022/03/09</a></h1>
+
+ <ul>
++ <li>improve error-recovery when setting a bitmap font for the
++ VT100 window, e.g., in case <em>OSC&nbsp;50</em> failed,
++ restoring the most recent valid font so that a subsequent
++ <em>OSC&nbsp;50</em> reports this correctly (report by David
++ Leadbeater).</li>
++
+ <li>amend allocation/freeing of scrollback lines, eliminating
+ an adjustment for status-line added in <a href=
+ "#xterm_371">patch #371</a> (report/testcase by Rajeev V.
+--
+2.25.1
+
diff --git a/meta-oe/recipes-graphics/xorg-app/xterm/CVE-2023-40359.patch b/meta-oe/recipes-graphics/xorg-app/xterm/CVE-2023-40359.patch
new file mode 100644
index 0000000000..342a8d8725
--- /dev/null
+++ b/meta-oe/recipes-graphics/xorg-app/xterm/CVE-2023-40359.patch
@@ -0,0 +1,388 @@
+From 41ba5cf31da5e43477811b28009d64d3f643fd29 Mon Sep 17 00:00:00 2001
+From: "Thomas E. Dickey" <dickey@invisible-island.net>
+Date: Wed, 8 Mar 2023 01:06:03 +0000
+Subject: [PATCH] snapshot of project "xterm", label xterm-379c
+
+Upstream-Status: Backport from https://github.com/ThomasDickey/xterm-snapshots/commit/41ba5cf31da5e43477811b28009d64d3f643fd29
+CVE: CVE-2023-40359
+
+Signed-off-by: Rohini Sangam <rsangam@mvista.com>
+
+---
+ graphics_regis.c | 235 +++++++++++++++++++++++++++--------------------
+ 1 file changed, 133 insertions(+), 102 deletions(-)
+
+diff --git a/graphics_regis.c b/graphics_regis.c
+index 479bb79..cf14437 100644
+--- a/graphics_regis.c
++++ b/graphics_regis.c
+@@ -1,8 +1,8 @@
+-/* $XTermId: graphics_regis.c,v 1.129 2022/02/21 13:33:08 tom Exp $ */
++/* $XTermId: graphics_regis.c,v 1.139 2023/03/08 01:06:03 tom Exp $ */
+
+ /*
+- * Copyright 2014-2021,2022 by Ross Combs
+- * Copyright 2014-2021,2022 by Thomas E. Dickey
++ * Copyright 2014-2022,2023 by Ross Combs
++ * Copyright 2014-2022,2023 by Thomas E. Dickeiy
+ *
+ * All Rights Reserved
+ *
+@@ -119,6 +119,14 @@ typedef struct RegisTextControls {
+ int slant; /* for italic/oblique */
+ } RegisTextControls;
+
++#define S_QUOTE '\''
++#define D_QUOTE '"'
++
++#define isQuote(ch) ((ch) == S_QUOTE || (ch) == D_QUOTE)
++#define PickQuote(ch) ((ch) == S_QUOTE ? D_QUOTE : S_QUOTE)
++
++#define isName(c) ((c) == '_' || isalnum(CharOf(c)))
++
+ #define FixedCopy(dst, src, len) strncpy(dst, src, len - 1)[len - 1] = '\0'
+ #define CopyFontname(dst, src) FixedCopy(dst, src, (size_t) REGIS_FONTNAME_LEN)
+
+@@ -538,8 +546,8 @@ draw_or_save_patterned_pixel(RegisGraphicsContext *context, int x, int y)
+ static int
+ sort_points(void const *l, void const *r)
+ {
+- RegisPoint const *const lp = l;
+- RegisPoint const *const rp = r;
++ RegisPoint const *const lp = (RegisPoint const *) l;
++ RegisPoint const *const rp = (RegisPoint const *) r;
+
+ if (lp->y < rp->y)
+ return -1;
+@@ -3151,6 +3159,37 @@ extract_regis_command(RegisDataFragment *input, char *command)
+ return 1;
+ }
+
++/*
++ * * Check a ReGIS alphabet name before reporting it, to pick an appropriate
++ * * delimiter. If the string is empty, or contains nonreportable characters,
++ * * just return NUL.
++ * */
++static int
++pick_quote(const char *value)
++{
++ Bool s_quote = False;
++ Bool d_quote = False;
++
++ if (*value != '\0') {
++ while (*value != '\0') {
++ int ch = CharOf(*value++);
++ if (ch == D_QUOTE)
++ d_quote = True;
++ else if (ch == S_QUOTE)
++ s_quote = True;
++ else if (!isName(ch))
++ s_quote = d_quote = True;
++ }
++ } else {
++ s_quote = d_quote = True;
++ }
++ return ((s_quote && d_quote)
++ ? 0
++ : (s_quote
++ ? D_QUOTE
++ : S_QUOTE));
++}
++
+ static int
+ extract_regis_string(RegisDataFragment *input, char *out, unsigned maxlen)
+ {
+@@ -3166,7 +3205,7 @@ extract_regis_string(RegisDataFragment *input, char *out, unsigned maxlen)
+ return 0;
+
+ ch = peek_fragment(input);
+- if (ch != '\'' && ch != '"')
++ if (!isQuote(ch))
+ return 0;
+ open_quote_ch = ch;
+ outlen = 0U;
+@@ -3246,7 +3285,7 @@ extract_regis_parenthesized_data(RegisDataFragment *input,
+ for (; input->pos < input->len; input->pos++, output->len++) {
+ char prev_ch = ch;
+ ch = input->start[input->pos];
+- if (ch == '\'' || ch == '"') {
++ if (isQuote(ch)) {
+ if (open_quote_ch == '\0') {
+ open_quote_ch = ch;
+ } else {
+@@ -3314,7 +3353,7 @@ extract_regis_option(RegisDataFragment *input,
+ if (ch == ';' || ch == ',' ||
+ ch == '(' || ch == ')' ||
+ ch == '[' || ch == ']' ||
+- ch == '"' || ch == '\'' ||
++ isQuote(ch) ||
+ isdigit(CharOf(ch))) {
+ return 0;
+ }
+@@ -3330,7 +3369,7 @@ extract_regis_option(RegisDataFragment *input,
+ TRACE(("looking at char '%c' in option '%c'\n", ch, *option));
+ /* FIXME: any special rules for commas? */
+ /* FIXME: handle escaped quotes */
+- if (ch == '\'' || ch == '"') {
++ if (isQuote(ch)) {
+ if (open_quote_ch == ch) {
+ open_quote_ch = '\0';
+ } else {
+@@ -5008,6 +5047,7 @@ parse_regis_command(RegisParseState *state)
+ static int
+ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ {
++ XtermWidget xw = context->display_graphic->xw;
+ RegisDataFragment optionarg;
+
+ if (!extract_regis_option(&state->input, &state->option, &optionarg))
+@@ -5586,13 +5626,18 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ state->option, fragment_to_tempstr(&optionarg)));
+ break;
+ } {
+- char reply[64];
++ unsigned err_code = 0U;
++ unsigned err_char = 0U;
+
+ TRACE(("got report last error condition\n"));
+ /* FIXME: implement after adding error tracking */
+- sprintf(reply, "\"%u,%u\"\r", 0U, 0U);
+- unparseputs(context->display_graphic->xw, reply);
+- unparse_end(context->display_graphic->xw);
++ unparseputc(xw, D_QUOTE);
++ unparseputn(xw, err_code);
++ unparseputc(xw, ',');
++ unparseputn(xw, err_char);
++ unparseputc(xw, D_QUOTE);
++ unparseputc(xw, '\r');
++ unparse_end(xw);
+ }
+ break;
+ case 'I':
+@@ -5639,8 +5684,8 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ /* FIXME: implement arrow key movement */
+ /* FIXME: implement button/key collection */
+
+- unparseputs(context->display_graphic->xw, "\r");
+- unparse_end(context->display_graphic->xw);
++ unparseputc(xw, '\r');
++ unparse_end(xw);
+
+ skip_regis_whitespace(&optionarg);
+ if (!fragment_consumed(&optionarg)) {
+@@ -5657,25 +5702,22 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ if (!fragment_consumed(&optionarg)) {
+ TRACE(("DATA_ERROR: unexpected arguments to ReGIS report command option '%c' arg \"%s\"\n",
+ state->option, fragment_to_tempstr(&optionarg)));
+- break;
+- } {
+- char buffer[32];
+-
+- if (state->load_index == MAX_REGIS_ALPHABETS) {
+- /* If this happens something went wrong elsewhere. */
+- TRACE(("DATA_ERROR: unable to report current load alphabet\n"));
+- unparseputs(context->display_graphic->xw, "A0\"\"\r");
+- unparse_end(context->display_graphic->xw);
+- break;
++ } else if (state->load_index == MAX_REGIS_ALPHABETS) {
++ /* If this happens something went wrong elsewhere. */
++ TRACE(("DATA_ERROR: unable to report current load alphabet\n"));
++ unparseputs(xw, "A0\"\"\r");
++ unparse_end(xw);
++ } else {
++ int delim = pick_quote(state->load_name);
++ if (delim != '\0') {
++ unparseputs(xw, "A");
++ unparseputn(xw, state->load_alphabet);
++ unparseputc(xw, delim);
++ unparseputs(xw, state->load_name);
++ unparseputc(xw, delim);
+ }
+-
+- unparseputs(context->display_graphic->xw, "A");
+- sprintf(buffer, "%u", state->load_alphabet);
+- unparseputs(context->display_graphic->xw, buffer);
+- unparseputs(context->display_graphic->xw, "\"");
+- unparseputs(context->display_graphic->xw, state->load_name);
+- unparseputs(context->display_graphic->xw, "\"\r");
+- unparse_end(context->display_graphic->xw);
++ unparseputc(xw, '\r');
++ unparse_end(xw);
+ }
+ break;
+ case 'M':
+@@ -5717,13 +5759,18 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ }
+
+ if (name == '=') {
+- char reply[64];
++ unsigned max_available = 1000U;
++ unsigned cur_available = max_available;
+
+ TRACE(("got report macrograph storage request\n"));
+ /* FIXME: Implement when macrographs are supported. */
+- sprintf(reply, "\"%u,%u\"\r", 1000U, 1000U);
+- unparseputs(context->display_graphic->xw, reply);
+- unparse_end(context->display_graphic->xw);
++ unparseputc(xw, D_QUOTE);
++ unparseputn(xw, cur_available);
++ unparseputc(xw, ',');
++ unparseputn(xw, max_available);
++ unparseputc(xw, D_QUOTE);
++ unparseputc(xw, '\r');
++ unparse_end(xw);
+ } else if (name < 'A' || name > 'Z') {
+ TRACE(("DATA_ERROR: invalid macrograph name: \"%c\"\n", name));
+ /* FIXME: what should happen? */
+@@ -5732,12 +5779,13 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ char temp[8];
+
+ TRACE(("got report macrograph request for name '%c'\n", name));
+- sprintf(temp, "@=%c", name);
+- unparseputs(context->display_graphic->xw, temp);
++ unparseputs(xw, "@=");
++ unparseputc(xw, name);
+ /* FIXME: Allow this to be disabled for security reasons. */
+ /* FIXME: implement when macrographs are supported. */
+- unparseputs(context->display_graphic->xw, "@;\r");
+- unparse_end(context->display_graphic->xw);
++ unparseputs(xw, "@;");
++ unparseputc(xw, '\r');
++ unparse_end(xw);
+ }
+ }
+ break;
+@@ -5785,78 +5833,61 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+ TRACE(("got report cursor position (output=%d)\n", output));
+
+ /* FIXME: look into supporting ANSI locator reports (DECLRP) */
++ unparseputc(xw, L_BLOK);
+ if (output == 1) {
+- char reply[64];
++ /* FIXME: verify in absolute, not user, coordinates */
++ unparseputn(xw, (unsigned) context->graphics_output_cursor_x);
++ unparseputc(xw, ',');
++ unparseputn(xw, (unsigned) context->graphics_output_cursor_y);
++ } else if (context->multi_input_mode) {
++ /* FIXME: track input coordinates */
++ unsigned x = 0, y = 0; /* placeholders */
++
++ /* send CSI240~[x,y]\r with current input cursor location */
++
++ /* FIXME: verify no leading char or button sequence */
++ /* FIXME: should we ever send an eight-bit CSI? */
+
+ /* FIXME: verify in absolute, not user, coordinates */
+- sprintf(reply, "[%d,%d]\r",
+- context->graphics_output_cursor_x,
+- context->graphics_output_cursor_y);
+- unparseputs(context->display_graphic->xw, reply);
+- unparse_end(context->display_graphic->xw);
++ TRACE(("sending multi-mode input report at %u,%u\n", x, y));
++ unparseputn(xw, x);
++ unparseputc(xw, ',');
++ unparseputn(xw, y);
+ } else {
+- char reply[64];
+- int x, y;
+-
+- if (context->multi_input_mode) {
+- /* FIXME: track input coordinates */
+- x = y = 0; /* placeholders */
+-
+- /* send CSI240~[x,y]\r with current input cursor location */
+-
+- /* FIXME: verify no leading char or button sequence */
+- /* FIXME: should we ever send an eight-bit CSI? */
+- /* FIXME: verify in absolute, not user, coordinates */
+- TRACE(("sending multi-mode input report at %d,%d\n",
+- x, y));
+- sprintf(reply, "[%d,%d]\r", x, y);
+- unparseputs(context->display_graphic->xw, reply);
+- unparse_end(context->display_graphic->xw);
+- break;
+- } else {
+- char ch;
+-
+- /* FIXME: wait for first non-arrow keypress or mouse click, and don't update graphics while waiting */
+- ch = ' '; /* placeholder */
+- x = y = 0; /* placeholders */
+-
+- /* send <key or button>[x,y]\r to report input cursor location */
+-
+- /* null button: CSI240~ */
+- /* left button: CSI241~ */
+- /* middle button: CSI243~ */
+- /* right button: CSI245~ */
+- /* extra button: CSI247~ */
+- /* FIXME: support DECLBD to change button assignments */
+- /* FIXME: verify no leading char or button sequence */
+- TRACE(("sending one-shot input report with %c at %d,%d\n",
+- ch, x, y));
+-#if 0 /* FIXME - dead code */
+- if (ch == '\r') {
+- /* Return only reports the location. */
+- sprintf(reply, "[%d,%d]\r", x, y);
+- } else if (ch == '\177') {
+- /* DEL exits locator mode reporting nothing. */
+- sprintf(reply, "\r");
+- } else
+-#endif
+- {
+- sprintf(reply, "%c[%d,%d]\r", ch, x, y);
+- }
+- unparseputs(context->display_graphic->xw, reply);
+- unparse_end(context->display_graphic->xw);
+- /* FIXME: exit one-shot mode and disable input cursor */
+- break;
++
++ char ch = ' '; /* placeholder */
++ unsigned x = 0, y = 0; /* placeholders */
++
++ /* FIXME: wait for first non-arrow keypress or mouse click, and don't update graphics while waiting */
++ /* send <key or button>[x,y]\r to report input cursor location */
++
++ /* null button: CSI240~ */
++ /* left button: CSI241~ */
++ /* middle button: CSI243~ */
++ /* right button: CSI245~ */
++ /* extra button: CSI247~ */
++ /* FIXME: support DECLBD to change button assignments */
++ /* FIXME: verify no leading char or button sequence */
++ TRACE(("sending one-shot input report with %c at %u,%u\n",
++ ch, x, y));
++ if (ch != '\177') {
++ unparseputn(xw, x);
++ unparseputc(xw, ',');
++ unparseputn(xw, y);
+ }
++ /* FIXME: exit one-shot mode and disable input cursor */
+ }
++ unparseputc(xw, R_BLOK);
++ unparseputc(xw, '\r');
++ unparse_end(xw);
+ }
+ break;
+ default:
+ TRACE(("DATA_ERROR: sending empty report for unknown ReGIS report command option '%c' arg \"%s\"\n",
+ state->option, fragment_to_tempstr(&optionarg)));
+ /* Unknown report request types must receive empty reports. */
+- unparseputs(context->display_graphic->xw, "\r");
+- unparse_end(context->display_graphic->xw);
++ unparseputs(xw, "\r");
++ unparse_end(xw);
+ break;
+ }
+ break;
+@@ -6154,7 +6185,7 @@ parse_regis_option(RegisParseState *state, RegisGraphicsContext *context)
+
+ TRACE(("using display page number: %d\n", page));
+ context->display_page = (unsigned) page;
+- map_regis_graphics_pages(context->display_graphic->xw, context);
++ map_regis_graphics_pages(xw, context);
+ }
+ break;
+ case 'T':
+--
+2.35.7
+
diff --git a/meta-oe/recipes-graphics/xorg-app/xterm_372.bb b/meta-oe/recipes-graphics/xorg-app/xterm_372.bb
index 3e1e9d7042..84308b1848 100644
--- a/meta-oe/recipes-graphics/xorg-app/xterm_372.bb
+++ b/meta-oe/recipes-graphics/xorg-app/xterm_372.bb
@@ -6,6 +6,8 @@ LIC_FILES_CHKSUM = "file://xterm.h;beginline=3;endline=31;md5=5ec6748ed90e588caa
SRC_URI = "http://invisible-mirror.net/archives/${BPN}/${BP}.tgz \
file://0001-Add-configure-time-check-for-setsid.patch \
+ file://CVE-2022-45063.patch \
+ file://CVE-2023-40359.patch \
"
SRC_URI[sha256sum] = "c6d08127cb2409c3a04bcae559b7025196ed770bb7bf26630abcb45d95f60ab1"
diff --git a/meta-oe/recipes-graphics/xscreensaver/xscreensaver_6.01.bb b/meta-oe/recipes-graphics/xscreensaver/xscreensaver_6.01.bb
index 2ab5297949..a5271f08bd 100644
--- a/meta-oe/recipes-graphics/xscreensaver/xscreensaver_6.01.bb
+++ b/meta-oe/recipes-graphics/xscreensaver/xscreensaver_6.01.bb
@@ -6,6 +6,8 @@ LIC_FILES_CHKSUM = "file://driver/xscreensaver.h;endline=10;md5=c3ce41cdff745eb1
SRC_URI = "https://www.jwz.org/${BPN}/${BP}.tar.gz"
SRC_URI[sha256sum] = "085484665d91f60b4a1dedacd94bcf9b74b0fb096bcedc89ff1c245168e5473b"
+MIRRORS += "https://www.jwz.org/${BPN} https://ftp.osuosl.org/pub/blfs/conglomeration/${BPN}"
+
SRC_URI += " \
file://xscreensaver.service \
file://0001-build-Do-not-build-po-files.patch \