Xevie: always initialize rep.length (bug#17394)
The XEvIE extension doesn't clear the rep.length field for any reply but the version check. Hence, if there is junk data in it and that is sent to the client, it hangs. X.Org bug#17394 (http://bugs.freedesktop.org/show_bug.cgi?id=17394)
This commit is contained in:
parent
0466b8811c
commit
d3ae193f4a
|
@ -197,6 +197,7 @@ int ProcXevieStart (ClientPtr client)
|
||||||
|
|
||||||
xevieModifiersOn = FALSE;
|
xevieModifiersOn = FALSE;
|
||||||
|
|
||||||
|
rep.length = 0;
|
||||||
rep.type = X_Reply;
|
rep.type = X_Reply;
|
||||||
rep.sequence_number = client->sequence;
|
rep.sequence_number = client->sequence;
|
||||||
WriteToClient (client, sizeof (xXevieStartReply), (char *)&rep);
|
WriteToClient (client, sizeof (xXevieStartReply), (char *)&rep);
|
||||||
|
@ -218,6 +219,7 @@ int ProcXevieEnd (ClientPtr client)
|
||||||
XevieEnd(xevieClientIndex);
|
XevieEnd(xevieClientIndex);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
rep.length = 0;
|
||||||
rep.type = X_Reply;
|
rep.type = X_Reply;
|
||||||
rep.sequence_number = client->sequence;
|
rep.sequence_number = client->sequence;
|
||||||
WriteToClient (client, sizeof (xXevieEndReply), (char *)&rep);
|
WriteToClient (client, sizeof (xXevieEndReply), (char *)&rep);
|
||||||
|
@ -238,6 +240,7 @@ int ProcXevieSend (ClientPtr client)
|
||||||
return BadAccess;
|
return BadAccess;
|
||||||
|
|
||||||
xE = (xEvent *)&stuff->event;
|
xE = (xEvent *)&stuff->event;
|
||||||
|
rep.length = 0;
|
||||||
rep.type = X_Reply;
|
rep.type = X_Reply;
|
||||||
rep.sequence_number = client->sequence;
|
rep.sequence_number = client->sequence;
|
||||||
WriteToClient (client, sizeof (xXevieSendReply), (char *)&rep);
|
WriteToClient (client, sizeof (xXevieSendReply), (char *)&rep);
|
||||||
|
@ -284,6 +287,7 @@ int ProcXevieSelectInput (ClientPtr client)
|
||||||
return BadAccess;
|
return BadAccess;
|
||||||
|
|
||||||
xevieMask = stuff->event_mask;
|
xevieMask = stuff->event_mask;
|
||||||
|
rep.length = 0;
|
||||||
rep.type = X_Reply;
|
rep.type = X_Reply;
|
||||||
rep.sequence_number = client->sequence;
|
rep.sequence_number = client->sequence;
|
||||||
WriteToClient (client, sizeof (xXevieSelectInputReply), (char *)&rep);
|
WriteToClient (client, sizeof (xXevieSelectInputReply), (char *)&rep);
|
||||||
|
|
Loading…
Reference in New Issue
Block a user