File bsc1251958_CVE-2025-62229_0001-present-Fix-use-after-free-in-present_create_notifie.patch of Package xorg-x11-server.41317

@@ -, +, @@ 
 present_create_notifies()
 |  Invalid write of size 8
 |     at 0x5361D5: present_clear_window_notifies (present_notify.c:42)
 |     by 0x534A56: present_destroy_window (present_screen.c:107)
 |     by 0x41E441: xwl_destroy_window (xwayland-window.c:1959)
 |     by 0x4F9EC9: compDestroyWindow (compwindow.c:622)
 |     by 0x51EAC4: damageDestroyWindow (damage.c:1592)
 |     by 0x4FDC29: DbeDestroyWindow (dbe.c:1291)
 |     by 0x4EAC55: FreeWindowResources (window.c:1023)
 |     by 0x4EAF59: DeleteWindow (window.c:1091)
 |     by 0x4DE59A: doFreeResource (resource.c:890)
 |     by 0x4DEFB2: FreeClientResources (resource.c:1156)
 |     by 0x4A9AFB: CloseDownClient (dispatch.c:3567)
 |     by 0x5DCC78: ClientReady (connection.c:603)
 |   Address 0x16126200 is 16 bytes inside a block of size 2,048 free'd
 |     at 0x4841E43: free (vg_replace_malloc.c:989)
 |     by 0x5363DD: present_destroy_notifies (present_notify.c:111)
 |     by 0x53638D: present_create_notifies (present_notify.c:100)
 |     by 0x5368E9: proc_present_pixmap_common (present_request.c:164)
 |     by 0x536A7D: proc_present_pixmap (present_request.c:189)
 |     by 0x536FA9: proc_present_dispatch (present_request.c:337)
 |     by 0x4A1E4E: Dispatch (dispatch.c:561)
 |     by 0x4B00F1: dix_main (main.c:284)
 |     by 0x42879D: main (stubmain.c:34)
 |   Block was alloc'd at
 |     at 0x48463F3: calloc (vg_replace_malloc.c:1675)
 |     by 0x5362A1: present_create_notifies (present_notify.c:81)
 |     by 0x5368E9: proc_present_pixmap_common (present_request.c:164)
 |     by 0x536A7D: proc_present_pixmap (present_request.c:189)
 |     by 0x536FA9: proc_present_dispatch (present_request.c:337)
 |     by 0x4A1E4E: Dispatch (dispatch.c:561)
 |     by 0x4B00F1: dix_main (main.c:284)
 |     by 0x42879D: main (stubmain.c:34)
---
 present/present_notify.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/present/present_notify.c	
+++ a/present/present_notify.c	
@@ -92,7 +92,7 @@ present_create_notifies(ClientPtr client, int num_notifies, xPresentNotify *x_no
         if (status != Success)
             goto bail;
 
-        added = i;
+        added++;
     }
     return Success;
 
--