{"base_revision":"git-v1:f777a9ccac3abc1a8f98dbd272b7ee50632baf32","content":"diff --git a/README.md b/README.md\nindex 950ad8d2..03233157 100644\n--- a/README.md\n+++ b/README.md\n@@ -31,23 +31,6 @@ For patch submission instructions, see:\n \n   https://www.x.org/wiki/Development/Documentation/SubmittingPatches\n \n-## Release 1.8.14\n-\n- * ximcp: bound XIM_OPEN_REPLY attribute lengths (CVE-2026-94283) (!310)\n- * ximcp: bound XIM_REGISTER_TRIGGERKEYS keylist lengths (CVE-2026-94284) (!310)\n- * lcGenConv: bound byteM_parse_codeset() reads (CVE-2026-94285) (!310)\n- * xkb: Check the keysym range in _XkbReadKeyActions (CVE-2026-88806) (!309)\n- * OpenDisplay: avoid NULL dereference in out-of-memory error path (!307)\n- * XSetFontPath: zero-initialize packed font path buffer (#248, !306)\n- * _XSend: treat xcb_writev returning 0 as failure (!305)\n- * _XSend: discard the output buffer after an I/O error (!305)\n- * XkbSetIndicatorMap: avoid undefined behavior due to left shift (#246, !304)\n- * nls: Add ca_ES.UTF-8@valencia locale (#234, !303)\n- * Xutil.h: add include of Xresource.h (#242, !302)\n- * xkb: fix incorrect size check when growing doodads in a section (!300)\n- * XlibInt.c: use correct type for Win32 in SocketBytesReadable() (!299)\n- * XlibInt.h: prevent Win32 CreateWindow macro from leaking into our code (!299)\n-\n ## Release 1.8.13\n \n  * Ignore XkbMapNotify events that don't belong to the core keyboard (!293)\ndiff --git a/configure.ac b/configure.ac\nindex 8231a2f8..676aca92 100644\n--- a/configure.ac\n+++ b/configure.ac\n@@ -1,7 +1,7 @@\n \n # Initialize Autoconf\n AC_PREREQ([2.70])\n-AC_INIT([libX11], [1.8.14],\n+AC_INIT([libX11], [1.8.13],\n         [https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues], [libX11])\n AC_CONFIG_SRCDIR([Makefile.am])\n AC_CONFIG_HEADERS([src/config.h include/X11/XlibConf.h])\ndiff --git a/debian/changelog b/debian/changelog\nindex d43f4a8d..4a82daaf 100644\n--- a/debian/changelog\n+++ b/debian/changelog\n@@ -1,17 +1,3 @@\n-libx11 (2:1.8.14-1) unstable; urgency=medium\n-\n-  * New upstream release (closes: #1148733, #1149668)\n-    - CVE-2026-88806: out-of-bounds write vulnerability in XKB action\n-      parser.\n-    - CVE-2026-94283: out-of-bounds read vulnerability in XIM attribute\n-      parser.\n-    - CVE-2026-94284: out-of-bounds read vulnerability in XIM trigger-key\n-      registration parser.\n-    - CVE-2026-94285: out-of-bounds read in byte-oriented codeset parser.\n-  * debian/control: build-depend on pkgconf instead of pkg-config.\n-\n- -- Emilio Pozuelo Monfort <pochu@debian.org>  Mon, 26 Oct 2026 19:51:55 +0100\n-\n libx11 (2:1.8.13-1) unstable; urgency=medium\n \n   * New upstream release.\ndiff --git a/debian/control b/debian/control\nindex 9c700094..93a87949 100644\n--- a/debian/control\n+++ b/debian/control\n@@ -4,7 +4,7 @@ Priority: optional\n Maintainer: Debian X Strike Force <debian-x@lists.debian.org>\n Build-Depends:\n  debhelper-compat (= 12),\n- pkgconf,\n+ pkg-config,\n  xtrans-dev,\n  x11proto-dev,\n  libxcb1-dev,\ndiff --git a/include/X11/Xlibint.h b/include/X11/Xlibint.h\nindex d63d7b74..fb87793b 100644\n--- a/include/X11/Xlibint.h\n+++ b/include/X11/Xlibint.h\n@@ -45,9 +45,6 @@ from The Open Group.\n \n #ifdef XTHREADS\n #include <X11/Xthreads.h>\n-#ifdef _WIN32\n-#undef CreateWindow\n-#endif\n #endif\n \n /* The Xlib structs are full of implicit padding to properly align members.\ndiff --git a/include/X11/Xutil.h b/include/X11/Xutil.h\nindex f8d4316c..6de64ed4 100644\n--- a/include/X11/Xutil.h\n+++ b/include/X11/Xutil.h\n@@ -49,8 +49,8 @@ SOFTWARE.\n #ifndef _X11_XUTIL_H_\n #define _X11_XUTIL_H_\n \n+/* You must include <X11/Xlib.h> before including this file */\n #include <X11/Xlib.h>\n-#include <X11/Xresource.h>\n #include <X11/keysym.h>\n \n /* The Xlib structs are full of implicit padding to properly align members.\ndiff --git a/modules/im/ximcp/imDefIm.c b/modules/im/ximcp/imDefIm.c\nindex 38d2d994..b27f80c5 100644\n--- a/modules/im/ximcp/imDefIm.c\n+++ b/modules/im/ximcp/imDefIm.c\n@@ -867,15 +867,6 @@ _XimOpen(\n \n     im->private.proto.imid = buf_s[0];\t\t/* imid */\n \n-    if (len < (INT16)(XIM_HEADER_SIZE + sizeof(CARD16))) {\n-\tif (reply != preply)\n-\t    Xfree(preply);\n-\treturn False;\n-    }\n-    /* remaining OPEN_REPLY bytes after imid; read by _XimGetAttributeID */\n-    im->private.proto.open_attr_length =\n-\t(CARD16)((size_t)len - XIM_HEADER_SIZE - sizeof(CARD16));\n-\n     if (!(_XimGetAttributeID(im, &buf_s[1]))) {\n \tif(reply != preply)\n \t    Xfree(preply);\ndiff --git a/modules/im/ximcp/imDefLkup.c b/modules/im/ximcp/imDefLkup.c\nindex b2b9d784..f5ba3405 100644\n--- a/modules/im/ximcp/imDefLkup.c\n+++ b/modules/im/ximcp/imDefLkup.c\n@@ -498,12 +498,10 @@ _XimForwardEventCallback(\n static Bool\n _XimRegisterTriggerkey(\n     Xim\t\t\t im,\n-    XPointer\t\t buf,\n-    size_t\t\t buf_len)\n+    XPointer\t\t buf)\n {\n     CARD32\t\t*buf_l = (CARD32 *)buf;\n-    size_t\t\t len;\n-    size_t\t\t remaining;\n+    CARD32\t\t len;\n     CARD32 \t\t*key;\n \n     if (IS_DYNAMIC_EVENT_FLOW(im))\t/* already Dynamic event flow mode */\n@@ -512,11 +510,9 @@ _XimRegisterTriggerkey(\n     /*\n      *  register onkeylist\n      */\n-    if (buf_len < sizeof(CARD32))\n-\treturn False;\n-    if ((size_t)buf_l[0] > buf_len - sizeof(CARD32))\n-\treturn False;\n-    len = (size_t)buf_l[0] + sizeof(CARD32);\n+\n+    len = buf_l[0];\t\t\t\t/* length of on-keys */\n+    len += sizeof(INT32);\t\t\t/* sizeof length of on-keys */\n \n     if (!(key = Xmalloc(len))) {\n \t_XimError(im, 0, XIM_BadAlloc, (INT16)0, (CARD16)0, (char *)NULL);\n@@ -530,13 +526,10 @@ _XimRegisterTriggerkey(\n     /*\n      *  register offkeylist\n      */\n-    remaining = buf_len - len;\n-    if (remaining < sizeof(CARD32))\n-\treturn False;\n+\n     buf_l = (CARD32 *)((char *)buf + len);\n-    if ((size_t)buf_l[0] > remaining - sizeof(CARD32))\n-\treturn False;\n-    len = (size_t)buf_l[0] + sizeof(CARD32);\n+    len = buf_l[0];\t\t\t\t/* length of off-keys */\n+    len += sizeof(INT32);\t\t\t/* sizeof length of off-keys */\n \n     if (!(key = Xmalloc(len))) {\n \t_XimError(im, 0, XIM_BadAlloc, (INT16)0, (CARD16)0, (char *)NULL);\n@@ -558,12 +551,8 @@ _XimRegisterTriggerKeysCallback(\n {\n     CARD16\t*buf_s = (CARD16 *)((CARD8 *)data + XIM_HEADER_SIZE);\n     Xim\t\t im = (Xim)call_data;\n-    size_t\t payload_len;\n \n-    if (len < (INT16)(XIM_HEADER_SIZE + 2 * sizeof(CARD16)))\n-\treturn True;\n-    payload_len = (size_t)len - XIM_HEADER_SIZE - 2 * sizeof(CARD16);\n-    (void)_XimRegisterTriggerkey(im, (XPointer)&buf_s[2], payload_len);\n+    (void )_XimRegisterTriggerkey(im, (XPointer)&buf_s[2]);\n     return True;\n }\n \ndiff --git a/modules/im/ximcp/imRmAttr.c b/modules/im/ximcp/imRmAttr.c\nindex e94421d9..c56bd62e 100644\n--- a/modules/im/ximcp/imRmAttr.c\n+++ b/modules/im/ximcp/imRmAttr.c\n@@ -1399,7 +1399,6 @@ _XimCountNumberOfAttr(\n     unsigned int *names_len)\n {\n     unsigned int n;\n-    unsigned int entry_size;\n     CARD16\t len;\n     CARD16\t min_len = sizeof(CARD16)\t/* sizeof attribute ID */\n \t\t\t + sizeof(CARD16)\t/* sizeof type of value */\n@@ -1412,15 +1411,10 @@ _XimCountNumberOfAttr(\n \tif (len > (total - min_len)) {\n \t    return 0;\n \t}\n-\tentry_size = (unsigned int)min_len + (unsigned int)len\n-\t\t   + (unsigned int)XIM_PAD(len + 2);\n-\n-\tif (entry_size > total)\n-\t    return 0;\n-\n \t*names_len += (len + 1);\n-\ttotal -= entry_size;\n-\tattr = (CARD16 *)((char *)attr + entry_size);\n+\tlen += (min_len + XIM_PAD(len + 2));\n+\ttotal -= len;\n+\tattr = (CARD16 *)((char *)attr + len);\n \tn++;\n     }\n     return n;\n@@ -1439,8 +1433,6 @@ _XimGetAttributeID(\n     char\t\t**values;\n     register int\t  i;\n     CARD16\t\t  len;\n-    CARD16\t\t *buf_s = buf;\n-    size_t\t\t  remain = (size_t)im->private.proto.open_attr_length;\n     CARD16\t\t  min_len = sizeof(CARD16) /* sizeof attribute ID */\n \t\t\t\t  + sizeof(CARD16) /* sizeof type of value */\n \t\t\t\t  + sizeof(INT16); /* sizeof length of attr */\n@@ -1448,10 +1440,6 @@ _XimGetAttributeID(\n      * IM attribute ID\n      */\n \n-    if (remain < sizeof(CARD16) ||\n-\t(size_t)buf[0] > remain - sizeof(CARD16))\n-\treturn False;\n-\n     if (!(n = _XimCountNumberOfAttr(buf[0], &buf[1], &names_len)))\n \treturn False;\n \n@@ -1496,14 +1484,6 @@ _XimGetAttributeID(\n     /*\n      * IC attribute ID\n      */\n-    remain -= sizeof(CARD16) + (size_t)buf_s[0];\n-    buf = (CARD16 *)((char *)(buf_s + 1) + buf_s[0]);\n-\n-    if (remain < (2 * sizeof(CARD16)))\n-\treturn False;\n-\n-    if ((size_t)buf[0] > remain - (2 * sizeof(CARD16)))\n-\treturn False;\n \n     if (!(n = _XimCountNumberOfAttr(buf[0], &buf[2], &names_len)))\n \treturn False;\ndiff --git a/modules/lc/gen/lcGenConv.c b/modules/lc/gen/lcGenConv.c\nindex 7ba75946..e1a13a28 100644\n--- a/modules/lc/gen/lcGenConv.c\n+++ b/modules/lc/gen/lcGenConv.c\n@@ -321,8 +321,7 @@ mb_parse_codeset(\n static CodeSet\n byteM_parse_codeset(\n     XLCd lcd,\n-    const char *inbufptr,\n-    int remaining_bytes)\n+    const char *inbufptr)\n {\n     unsigned char ch;\n     CodeSet codeset;\n@@ -341,8 +340,6 @@ byteM_parse_codeset(\n         byteM = codeset->byteM;\n         if (codeset->side != XlcNONE || byteM == NULL)\n \t    continue;\n-        if (codeset->length > remaining_bytes)\n-\t    continue;\n \n         for (j = 0; j < codeset->length; j++) {\n \t    ch = *((const unsigned char *)(inbufptr + j));\n@@ -803,7 +800,7 @@ mbstowcs_org(\n         }\n \n \t/* next mb char data for byteM ? */\n-\tif ((codeset = byteM_parse_codeset(lcd, (inbufptr - 1), (*from_left) + 1)))\n+\tif ((codeset = byteM_parse_codeset(lcd, (inbufptr - 1))))\n \t    goto next_mb_char;\n \n \t/* next mb char data for GL or GR side ? */\n@@ -1694,7 +1691,7 @@ mbstostr(\n         }\n \n \t/* next char data : byteM ? */\n-\tif ((codeset = byteM_parse_codeset(lcd, (inbufptr - 1), (*from_left) + 1)))\n+\tif ((codeset = byteM_parse_codeset(lcd, (inbufptr - 1))))\n \t    goto next_mb_char;\n \n \t/* next char data : GL or GR side ? */\n@@ -1805,7 +1802,7 @@ mbtocs(\n         }\n \n \t/* next mb char data for byteM ? */\n-\tif ((codeset = byteM_parse_codeset(lcd, (inbufptr - 1), (*from_left) + 1)))\n+\tif ((codeset = byteM_parse_codeset(lcd, (inbufptr - 1))))\n \t    goto next_mb_char;\n \n \t/* next mb char data for GL or GR side ? */\ndiff --git a/nls/compose.dir.pre b/nls/compose.dir.pre\nindex 0886b403..89239453 100644\n--- a/nls/compose.dir.pre\n+++ b/nls/compose.dir.pre\n@@ -292,7 +292,6 @@ en_US.UTF-8/Compose:\t\tbr_FR.UTF-8\n en_US.UTF-8/Compose:\t\tbs_BA.UTF-8\n en_US.UTF-8/Compose:\t\tca_AD.UTF-8\n en_US.UTF-8/Compose:\t\tca_ES.UTF-8\n-en_US.UTF-8/Compose:\t\tca_ES.UTF-8@valencia\n en_US.UTF-8/Compose:\t\tca_FR.UTF-8\n en_US.UTF-8/Compose:\t\tca_IT.UTF-8\n cs_CZ.UTF-8/Compose:\t\tcs_CZ.UTF-8\ndiff --git a/nls/locale.alias.pre b/nls/locale.alias.pre\nindex 066e8b59..d9f77d7c 100644\n--- a/nls/locale.alias.pre\n+++ b/nls/locale.alias.pre\n@@ -169,7 +169,6 @@ ca_ES.utf8:\t\t\t\t\tca_ES.UTF-8\n ca_ES.ISO-8859-15:\t\t\t\tca_ES.ISO8859-15\n ca_ES.ISO-8859-15@euro:\t\t\t\tca_ES.ISO8859-15\n ca_ES.UTF-8@euro:\t\t\t\tca_ES.UTF-8\n-ca_ES.UTF-8@valencia:\t\t\t\tca_ES.UTF-8\n ca_FR:\t\t\t\t\t\tca_FR.ISO8859-1\n ca_FR@euro:\t\t\t\t\tca_FR.ISO8859-15\n ca_FR.iso88591:\t\t\t\t\tca_FR.ISO8859-1\ndiff --git a/src/OpenDis.c b/src/OpenDis.c\nindex 2176af61..9c06d388 100644\n--- a/src/OpenDis.c\n+++ b/src/OpenDis.c\n@@ -709,7 +709,7 @@ void _XFreeDisplayStructure(Display *dpy)\n \n static void OutOfMemory(Display *dpy)\n {\n-\txcb_connection_t *connection = dpy->xcb ? dpy->xcb->connection : NULL;\n+\txcb_connection_t *connection = dpy->xcb->connection;\n \n \t_XFreeDisplayStructure (dpy);\n \ndiff --git a/src/SetFPath.c b/src/SetFPath.c\nindex 5a0aa44c..e1b54b6c 100644\n--- a/src/SetFPath.c\n+++ b/src/SetFPath.c\n@@ -59,7 +59,7 @@ XSetFontPath (\n \t\t}\n \t\tnbytes = (n + 3) & ~3;\n \t\treq->length += nbytes >> 2;\n-\t\tif ((p = Xcalloc (nbytes, 1))) {\n+\t\tif ((p = Xmalloc (nbytes))) {\n \t\t\t/*\n \t\t\t * pack into counted strings.\n \t\t\t */\ndiff --git a/src/XlibInt.c b/src/XlibInt.c\nindex 8594d2ef..1949111b 100644\n--- a/src/XlibInt.c\n+++ b/src/XlibInt.c\n@@ -1248,19 +1248,17 @@ _XWireToEvent(\n static int\n SocketBytesReadable(Display *dpy)\n {\n+    int bytes = 0, last_error;\n #ifdef WIN32\n-    u_long bytes = 0;\n-    int last_error = WSAGetLastError();\n+    last_error = WSAGetLastError();\n     ioctlsocket(ConnectionNumber(dpy), FIONREAD, &bytes);\n     WSASetLastError(last_error);\n-    return (int) bytes;\n #else\n-    int bytes = 0;\n-    int last_error = errno;\n+    last_error = errno;\n     ioctl(ConnectionNumber(dpy), FIONREAD, &bytes);\n     errno = last_error;\n-    return bytes;\n #endif\n+    return bytes;\n }\n \n _X_NORETURN void _XDefaultIOErrorExit(\ndiff --git a/src/xcb_io.c b/src/xcb_io.c\nindex 521214ce..17ac8005 100644\n--- a/src/xcb_io.c\n+++ b/src/xcb_io.c\n@@ -555,16 +555,8 @@ void _XSend(Display *dpy, const char *data, long size)\n \tuint64_t dpy_request;\n \t_XExtension *ext;\n \txcb_connection_t *c = dpy->xcb->connection;\n-\tif(dpy->flags & XlibDisplayIOError) {\n-\t\t/* The connection is dead; buffered data can never be\n-\t\t * written.  Discard it rather than leave the buffer full:\n-\t\t * writers that loop until space appears (_XData32,\n-\t\t * _XData16) otherwise spin forever, and _XGetRequest\n-\t\t * returns NULL to its callers once bufptr reaches\n-\t\t * bufmax. */\n-\t\tdpy->bufptr = dpy->buffer;\n+\tif(dpy->flags & XlibDisplayIOError)\n \t\treturn;\n-\t}\n \n \tif(dpy->bufptr == dpy->buffer && !size)\n \t\treturn;\n@@ -601,11 +593,8 @@ void _XSend(Display *dpy, const char *data, long size)\n \t\t\t\text->before_flush(dpy, &ext->codes, vec[i].iov_base, vec[i].iov_len);\n \t}\n \n-\tif(xcb_writev(c, vec, 3, requests) <= 0) {\n+\tif(xcb_writev(c, vec, 3, requests) < 0) {\n \t\t_XIOError(dpy);\n-\t\t/* If the exit handler returned, discard the buffer now:\n-\t\t * the flag check above only protects later calls. */\n-\t\tdpy->bufptr = dpy->buffer;\n \t\treturn;\n \t}\n \tdpy->bufptr = dpy->buffer;\ndiff --git a/src/xkb/XKBGAlloc.c b/src/xkb/XKBGAlloc.c\nindex cb3904a8..5b02f34c 100644\n--- a/src/xkb/XKBGAlloc.c\n+++ b/src/xkb/XKBGAlloc.c\n@@ -879,7 +879,7 @@ XkbAddGeomDoodad(XkbGeometryPtr geom, XkbSectionPtr section, Atom name)\n             return doodad;\n     }\n     if (section) {\n-        if ((section->num_doodads >= section->sz_doodads) &&\n+        if ((section->num_doodads >= geom->sz_doodads) &&\n             (_XkbAllocDoodads(section, 1) != Success)) {\n             return NULL;\n         }\ndiff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c\nindex eaa0d6d5..31199e4a 100644\n--- a/src/xkb/XKBGetMap.c\n+++ b/src/xkb/XKBGetMap.c\n@@ -253,9 +253,6 @@ _XkbReadKeyActions(XkbReadBufferPtr buf, XkbDescPtr info, xkbGetMapReply *rep)\n     if ((nKeyActs = rep->nKeyActs) > 0) {\n         XkbSymMapPtr symMap;\n \n-        if (((int) rep->firstKeyAct + rep->nKeyActs) > (info->max_key_code + 1))\n-            return BadLength;\n-\n         if (nKeyActs < sizeof numDescBuf)\n             numDesc = numDescBuf;\n         else\ndiff --git a/src/xkb/XKBleds.c b/src/xkb/XKBleds.c\nindex 698454ca..8e75ea54 100644\n--- a/src/xkb/XKBleds.c\n+++ b/src/xkb/XKBleds.c\n@@ -153,7 +153,7 @@ Bool\n XkbSetIndicatorMap(Display *dpy, unsigned long which, XkbDescPtr xkb)\n {\n     register xkbSetIndicatorMapReq *req;\n-    unsigned int i, bit;\n+    register int i, bit;\n     int nMaps;\n     xkbIndicatorMapWireDesc *wire;\n     XkbInfoPtr xkbi;\ndiff --git a/src/xlibi18n/XimintP.h b/src/xlibi18n/XimintP.h\nindex efe8bb8c..2957e3a0 100644\n--- a/src/xlibi18n/XimintP.h\n+++ b/src/xlibi18n/XimintP.h\n@@ -115,7 +115,7 @@ typedef struct _XimProtoPrivateRec {\n \n     Window\t\t\t im_window;\n     XIMID\t\t\t imid;\n-    CARD16\t\t\t open_attr_length;\n+    CARD16\t\t\t unused;\n     XIMStyles\t\t\t*default_styles;\n     CARD32\t\t\t*im_onkeylist;\n     CARD32\t\t\t*im_offkeylist;\n","content_type":"text/plain","diff_type":"vcs","new_revision":"git-v1:67824b45f3bdb4d62249d1b17580ff950a90f052"}