From ce1a2a2b705c400bbf1f5cacbe43311e82d829a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Fabian=20Silva=20Delgado?= Date: Sat, 18 Jul 2015 11:22:09 -0300 Subject: xorg-server-1.17.2-4.parabola1: add another patch to fix segfault introduced with previous release, related to latest xproto package --- ...e-the-clientsWritable-fd_set-is-initializ.patch | 63 ++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 libre/xorg-server/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch (limited to 'libre/xorg-server/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch') diff --git a/libre/xorg-server/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch b/libre/xorg-server/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch new file mode 100644 index 000000000..b3a7d2ed5 --- /dev/null +++ b/libre/xorg-server/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch @@ -0,0 +1,63 @@ +From 7cc7ffd25d5e50b54cb942d07d4cb160f20ff9c5 Mon Sep 17 00:00:00 2001 +From: Martin Peres +Date: Fri, 17 Jul 2015 17:21:26 +0300 +Subject: [PATCH] os: make sure the clientsWritable fd_set is initialized + before use + +In WaitForSomething(), the fd_set clientsWritable may be used unitialized when +the boolean AnyClientsWriteBlocked is set in the WakeupHandler(). This leads to +a crash in FlushAllOutput() after x11proto's commit +2c94cdb453bc641246cc8b9a876da9799bee1ce7. + +The problem did not manifest before because both the XFD_SIZE and the maximum +number of clients were set to 256. As the connectionTranslation table was +initalized for the 256 clients to 0, the test on the index not being 0 was +aborting before dereferencing the client #0. + +As of commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7 in x11proto, the XFD_SIZE +got bumped to 512. This lead the OutputPending fd_set to have any fd above 256 +to be uninitialized which in turns lead to reading an index after the end of +the ConnectionTranslation table. This index would then be used to find the +client corresponding to the fd marked as pending writes and would also result +to an out-of-bound access which would usually be the fatal one. + +Fix this by zeroing the clientsWritable fd_set at the beginning of +WaitForSomething(). In this case, the bottom part of the loop, which would +indirectly call FlushAllOutput, will not do any work but the next call to +select will result in the execution of the right codepath. This is exactly what +we want because we need to know the writable clients before handling them. In +the end, it also makes sure that the fds above MaxClient are initialized, +preventing the crash in FlushAllOutput(). + +Thanks to everyone involved in tracking this one down! + +Reported-by: Karol Herbst +Reported-by: Tobias Klausmann +Signed-off-by: Martin Peres +Tested-by: Martin Peres +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316 +Cc: Ilia Mirkin +Cc: Martin Peres +Cc: Olivier Fourdan +Cc: Alan Coopersmith +--- + os/WaitFor.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/os/WaitFor.c b/os/WaitFor.c +index 431f1a6..993c14e 100644 +--- a/os/WaitFor.c ++++ b/os/WaitFor.c +@@ -158,6 +158,7 @@ WaitForSomething(int *pClientsReady) + Bool someReady = FALSE; + + FD_ZERO(&clientsReadable); ++ FD_ZERO(&clientsWritable); + + if (nready) + SmartScheduleStopTimer(); +-- +2.4.5 + -- cgit v1.2.3-2-g168b