From c409946eab1e191b0f4dc5c6ae22892c3d657922 Mon Sep 17 00:00:00 2001
From: pkgagent <pkgagent@tencent.com>
Date: Wed, 23 Sep 2026 22:35:20 +0800
Subject: [PATCH] Fix CVE-2026-88807: OOB write in XRenderQueryFormats when
 server reports numSubpixel > numScreens

---
 libXrender-0.9.11-CVE-2026-88807.patch | 33 ++++++++++++++++++++++++++
 libXrender.spec                        |  9 +++++--
 2 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 libXrender-0.9.11-CVE-2026-88807.patch

diff --git a/libXrender-0.9.11-CVE-2026-88807.patch b/libXrender-0.9.11-CVE-2026-88807.patch
new file mode 100644
index 0000000..9554202
--- /dev/null
+++ b/libXrender-0.9.11-CVE-2026-88807.patch
@@ -0,0 +1,33 @@
+From 4bbe38dc59733ea23534b909814f7a062531ebbb Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 16 Sep 2026 16:07:39 +1000
+Subject: [PATCH] Check numSubpixel against numScreens to avoid OOB writes
+ (CVE-2026-88807)
+
+A malicious server could reply to XRenderQueryFormat with a numSubpixels
+count greater than the number of screens, causing an OOB write into
+screen->subpixel which was allocated using numScreens.
+
+This vulnerability was discovered by:
+Adam Bedard working with TrendAI Zero Day Initiative
+
+ZDI-CAN-32093
+
+CVE-2026-88807
+
+Assisted-by: Claude:claude-opus-4-6
+---
+ src/Xrender.c | 1 +
+ 1 file changed, 1 insertion(+)
+diff --git a/src/Xrender.c b/src/Xrender.c
+index 61a1139..9ed262f 100644
+--- a/src/Xrender.c
++++ b/src/Xrender.c
+@@ -468,6 +468,7 @@ XRenderQueryFormats (Display *dpy)
+ 	(rep.numDepths  < ((INT_MAX / 4) / sizeof (XRenderDepth))) &&
+ 	(rep.numVisuals < ((INT_MAX / 4) / sizeof (XRenderVisual))) &&
+ 	(rep.numSubpixel < ((INT_MAX / 4) / 4)) &&
++	(rep.numSubpixel <= rep.numScreens) &&
+ 	(rep.length < (INT_MAX >> 2)) ) {
+ 	xri = Xmalloc (sizeof (XRenderInfo) +
+ 		       (rep.numFormats * sizeof (XRenderPictFormat)) +
diff --git a/libXrender.spec b/libXrender.spec
index 3b11efb..2d85b92 100644
--- a/libXrender.spec
+++ b/libXrender.spec
@@ -1,10 +1,11 @@
 Summary: X.Org X11 libXrender runtime library
 Name: libXrender
 Version: 0.9.11
-Release: 4%{?dist}
+Release: 5%{?dist}
 License: MIT
 URL: http://www.x.org
 Source0: http://xorg.freedesktop.org/archive/individual/lib/%{name}-%{version}.tar.xz
+Patch0001: libXrender-0.9.11-CVE-2026-88807.patch
 BuildRequires: xorg-x11-util-macros
 BuildRequires: make autoconf automake libtool
 BuildRequires: pkgconfig
@@ -22,7 +23,7 @@ Requires: libXrender = %{version}-%{release}
 X.Org X11 libXrender development package
 
 %prep
-%autosetup
+%autosetup -p1
 
 %build
 autoreconf -fiv
@@ -50,6 +51,10 @@ rm -f %{buildroot}%{_libdir}/*.la
 %{_libdir}/pkgconfig/xrender.pc
 
 %changelog
+* Wed Sep 23 2026 PkgAgent Robot <pkgagent@opencloudos.tech> - 0.9.11-5
+- [Type] security
+- [DESC] Fix CVE-2026-88807: OOB write in XRenderQueryFormats when server reports numSubpixel > numScreens
+
 * Thu Sep 26 2024 OpenCloudOS Release Engineering <releng@opencloudos.tech> - 0.9.11-4
 - Rebuilt for clarifying the packages requirement in BaseOS and AppStream
 
-- 
Gitee