Created attachment 116298 [details] Patch file for the bug fix submitted. Insufficient memory for terminating null character of string is a bug. Fix does one byte of memory allocation for null termination of string. This patch is based on version 1.1.14 of libXcursor.
Thanks for the fix, pushed to git master: http://cgit.freedesktop.org/xorg/lib/libXcursor/commit/?id=897213f36baf6926daf6d192c709cf627aa5fd05
This was retroactively assigned CVE-2015-9262: https://lists.x.org/archives/xorg-announce/2018-August/002917.html
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.