From 47da6b6b2c2e9245422655f94770146fb8cd430b Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Mon, 19 Dec 2011 14:52:41 +1000
Subject: [PATCH] dix: don't retrieve the syncEvents tail on an empty list

An empty list points to itself but syncEvents has the list head only and is
of a different format than the elements. Thus, casting it to a QdEventPtr
gives us garbage.

Segfaults with XTS test case Xlib13/XGrabKeyboard

Introduced in 7af23259d88f4c28ed21140f82cc03b3724c06bb.

Reported-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
---
 dix/events.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dix/events.c b/dix/events.c
index 8dff29973..eb7bd9296 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -1115,13 +1115,14 @@ NoticeEventTime(InternalEvent *ev)
 void
 EnqueueEvent(InternalEvent *ev, DeviceIntPtr device)
 {
-    QdEventPtr	tail;
+    QdEventPtr	tail = NULL;
     QdEventPtr	qe;
     SpritePtr	pSprite = device->spriteInfo->sprite;
     int		eventlen;
     DeviceEvent *event = &ev->device_event;
 
-    tail = list_last_entry(&syncEvents.pending, QdEventRec, next);
+    if (!list_is_empty(&syncEvents.pending))
+        tail = list_last_entry(&syncEvents.pending, QdEventRec, next);
 
     NoticeTime((InternalEvent*)event);