In RRChangeProviderProperty() with PrependMode, new_value.size is set to len instead of total_len. Additionally, the old_data offset calculation uses prop_value->size instead of len for the memcpy of existing data. This causes a heap buffer overflow when prepending property data, as the buffer is undersized and the copy offset is incorrect.

This mirrors a bug pattern that was previously fixed in RRChangeOutputProperty but was not applied to the provider property path.

An authenticated X client can trigger this by sending RandR ChangeProviderProperty requests with PrependMode on a system with RandR providers (standard on modern GPUs).
The heap buffer overflow can lead to arbitrary code execution or denial of service.
Fixed in: xorg-server-21.1.25 and xwayland-24.1.14
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5dc9efd5a199