Commit Graph

2065 Commits

Author SHA1 Message Date
Adam Jackson
d138d9ccc6 dix: Remove some pointless casting of NULL
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:53 +02:00
Adam Jackson
277330075b dix: Remove an empty if
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:53 +02:00
Adam Jackson
81d76a835b dix: Lower backStorage to a bit instead of a pointer
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:53 +02:00
Adam Jackson
322ba42c23 dix: Remove DIXsaveUnder bit from the Window
Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:53 +02:00
Adam Jackson
1e56b2dfc6 mi: Move pScreen->SendGraphicsExpose up to dix
No DDX is overriding this and it's fairly absurd to expose it as a
screen operation anyway.

Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:53 +02:00
Adam Jackson
0d30d44a8c dix: Drop the third argument from WindowExposuresProcPtr
A careful read shows that it was always NULL.  It hasn't always been; as
the DDX spec indicates, it was the "occluded region that has backing
store", but since that backing store code is long gone, we can nuke it.

mi{,Overlay}WindowExposures get slightly simpler here, and will get even
simpler in just a moment.

Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-10-09 11:14:44 +02:00
Daniel Martin
12c19bbff4 dix: Remove XpExtension leftovers from protocol.txt
There's no XPrint extension (anymore).

Signed-off-by: Daniel Martin <consume.noise@gmail.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-10-02 10:16:24 -07:00
Keith Packard
69d8572ae4 Build required portions of registry.c automatically [v2]
Instead of making the inclusion of the registry code a global
conditional, split the registry into two pieces; the bits required by
the X-Resource extension (the resource names) and the bits required by
the XCSECURITY extension (the protocol names). Build each set of code
if the related extension is being built.

v2: Check for both XCSECURITY and XSELINUX.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-09-18 15:29:29 -07:00
Keith Packard
a11fc2493e dix: Close protocol.txt after we're done loading extension names
Don't leave this file open during the whole server execution process;
close it once all of the extensions are initialized.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-09-18 15:29:27 -07:00
Dave Airlie
da4bad620a pixmap: fix reverse optimus support with multiple heads
For doing reverese optimus to multiple outputs on a secondary GPU
the GPU can store the blits into a large screen pixmap, unfortunately
this means we need a destination offset into the dirty code, so
add a new API that just adds this interface.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-09-11 18:14:44 -07:00
Peter Hutterer
1e30fc1b99 xkb: ignore floating slave devices when updating from master (#81885)
Introduced in 45fb3a934d. When a device is
enabled, the master's locked state is pushed to the slave. If the device is
floating, no master exists and we triggered a NULL-pointer dereference
in XkbPushLockedStateToSlaves.

X.Org Bug 81885 <http://bugs.freedesktop.org/show_bug.cgi?id=81885>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-08-12 15:53:51 -07:00
Egbert Eich
e6c8c7e46c BellProc: Send bell event on core protocol bell when requested
XKB allows to override the BellProc() ringing the 'keyboard bell':
instead an event is sent to an X client which can perform an
appropriate action.
In most cases this effectively prevents the core protocol bell
from ringing: if no BellProc() is set for the device, no attempt
is made to ring a bell.
This patch ensures that an XKB bell event is sent also when
the core protocol bell is rung end thus an appropriate action
can be taken by a client.

Signed-off-by: Egbert Eich <eich@freedesktop.org>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-08-04 22:02:26 -07:00
Adam Jackson
71ef49062e dix: Make some LBX-era code more obvious
isItTimeToYield in the conditional effectively didn't do anything here.
Take it out, and remove the comment since LBX proxies aren't a thing for
us anymore.

Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2014-07-29 09:48:17 -04:00
Peter Hutterer
9a19bf06b5 Revert "dix: fix up coordinate scaling when external monitors are present"
This reverts commit d90b5f8301.

Reverting for two reasons:
* the scaling does not work on devices that don't advertise resolution, and
  the default resolution used (100 units/mm) is higher than most devices,
  resulting in a significant slowdown of the touchpads.
* the scaling is still affected by resolution changing. The patch worked
  before acceleration but since it maps into resolution-dependent dx/dy
  coordinates the acceleration may distort the movement after the fact. So the
  same input data generates different movements depending on the resolution.
  This can't easily be fixed for all affected devices as synaptics has its own
  velocity calculation method whereas wacom doesn't. So anything in the server
  won't work for both at the same time.

Revert this for now, until a more integrated solution can be implemented.
2014-07-14 15:05:58 +10:00
Peter Hutterer
d90b5f8301 dix: fix up coordinate scaling when external monitors are present
The goal of all this is to get an x/y motion reflecting the motion
on the device, i.e. a circle on the device is a circle on the screen.

This is currently done by scaling the y coordinate depending on the screen
ratio vs device ratio. Depending on that ratio the movement on the y axis may
be accelerated (ratio < 1) or slowed (ratio > 1). This leads to the weird
effect that changing the screen ratio by plugging a new monitor changes the
speed of the touchpad.

Use a different algorithm: calculate the physical movement on the device, map
that to the same-ish distance on the screen, then convert that back into a
device-specific vector. This way we get the same mapping regardless of the
current screen dimensions.

Since the pointer accel code doesn't take device resolution into account, make
sure we apply our crazy mapping before we accelerate. This way we accelerate
resolution-independent.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2014-06-23 11:04:55 +10:00
Brendan King
b92d86a982 dix: fix pixmap leak on server reset
The server is leaking a pixmap (created by CreateDefaultStipple()) on
reset. The leak is caused by some X Server graphics contexts not being
freed on reset by the machine independent cursor code in the server,
which in turn is caused by the cursor cleanup code
(miSpriteDeviceCursorCleanup()) not being called.

Ensures the DeviceCursorCleanup() function is called when the associated
input device is closed on server reset.

Signed-off-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-06-04 21:32:30 -07:00
Brendan King
a99c061aaf dix: reference the cursor just once in InitializeSprite()
The new current cursor was being referenced twice, resulting in a
memory leak when the current server generation ended.

Signed-off-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-06-04 21:32:14 -07:00
Peter Hutterer
e06fbe4dc8 dix: remove a now-superfluous comment
Obsolete since 93945b0a74

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-04-29 10:06:25 +10:00
Michal Srb
6a848122de input: Remove invalid bug checks.
Commit 2f1aedcaed added several bug checks. Some
of them are not correct.

Checks in Init(Ptr|String|Bell|Led|Integer)FeedbackClassDeviceStruct verify
that no feedback struct was set yet, but that is not required. If any feedback
structs are already present, the function will chain them behind the new one.

Signed-off-by: Michal Srb <msrb@suse.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-04-29 10:06:25 +10:00
Eric Anholt
abf1202706 glx: Move the GLX variable caching what GL context is current to dix.
GLX is trying to track whether the context it wants is current, to
avoid the glFlush() (and the rest of the overhead) that occurs on all
MakeCurrent calls.  However, its cache can be incorrect now that
glamor exists.  This is a step toward getting glamor to coordinate
with GLX.

Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-04-23 10:32:02 -07:00
Jasper St. Pierre
ea15f8b4c9 dixfonts: Turn a missing directory ErrorF into a DebugF
On systems without these directories, we don't need to be complaining
loudly.

Reviewed-by: Kristian Hoegsberg <krh@bitplanet.net>

Signed-off-by: Keith Packard <keithp@keithp.com>
2014-04-21 15:01:02 -07:00
Keith Packard
73698d41e4 Make XYToWindow a screen function
This allows DDXen to override the window picking to account for
native windows not seen by the X server.  The bulk of the picking logic
is exposed as a new helper function, miSpriteTrace().  This function
completes the sprite trace filled out by the caller, and can be set up
to start the search from a given toplevel window.

v2: Leave existing XYToWindow API in place for API compatibility

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
2014-04-01 10:30:42 -07:00
Jon TURNEY
bc348bd2c4 Handle -displayfd and an explicit display number sensibly
Handle -displayfd and an explicit display number sensibly, e.g. use the
explicitly specified display number, and write it to the displayfd

v2: displayfd might be 0, so use -1 as invalid value
v3: Rebase for addition of NoListenAll flag

Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
2014-03-27 14:34:34 +00:00
Keith Packard
ae87b53615 dix: Allow NULL stipple in ChangeGC
miOpqStipDrawable resets the stipple after painting. When that stipple
was NULL, ChangeGC needs to handle that and not crash.

Signed-off-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-off-by: Eric Anholt <eric@anholt.net>
2014-03-26 12:58:40 -07:00
Peter Hutterer
45fb3a934d xkb: push locked modifier state down to attached slave devices
Whenever the master changes, push the locked modifier state to the attached
slave devices, then update the indicators. This way, when NumLock or CapsLock
are hit on any device, the LED will light up on all devices. Likewise, a new
keyboard attached to a master device will light up with the correct
indicators.

The indicators are handled per-keyboard, depending on the layout, i.e. if one
keyboard has grp_led:num set, the NumLock LED won't light up on that keyboard.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2014-03-11 17:43:34 +10:00
Andrew Eikum
78e508c937 dix: Clear any existing selections before initializing privates
If there is a selection left over from a previous execution of the
main loop, and that selection has privates allocated for it, the X
server will crash. This is because dixResetPrivates() resets the
privates refcounts to zero without accounting for the reference held
by the selection object. When the selection is then deleted in
InitSelections() after the call to dixResetPrivates(), the refcount
for its privates type goes negative and bad things happen.

To fix this, we should delete any existing selections before calling
dixResetPrivates(). This will properly release the selection's
privates and avoid the crash.

A more thorough description of the problem and a test case to
reproduce the crash is available at a previous mail:
  "Negative Selection devPrivates refcount?"
  By Andrew Eikum to xorg-devel on 10 Dec 2013
  http://lists.freedesktop.org/archives/xorg-devel/2013-December/039492.html

Signed-off-by: Andrew Eikum <aeikum@codeweavers.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-03-06 17:15:11 -08:00
Peter Hutterer
c64130c13b dix: fix a -Wshadow warning
dispatch.c: In function 'SetVendorString':
dispatch.c:481:29: warning: declaration of 'string' shadows a global declaration [-Wshadow]
 SetVendorString(const char *string)
                             ^
dispatch.c:135:21: warning: shadowed declaration is here [-Wshadow]
 typedef const char *string;

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2014-02-05 15:10:27 +10:00
Peter Hutterer
25d10464f4 dix: fix button state check before changing a button mapping
dev->button->down is a bitmask, not a normal array. Use the helper function to
check, we technically allow the mapping to change after the physical button
has been pressed (but not yet processed yet), so only check BUTTON_PROCESSED.

From XSetPointerMapping(3):
"If any of the buttons to be altered are logically in the down state,
XSetPointerMapping returns MappingBusy, and the mapping is not changed."

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2014-02-05 07:50:16 +10:00
Peter Hutterer
87ca80a719 dix: prevent a driver from initializing or submitting buttons > MAX_BUTTONS
The server internally relies on arrays with a MAX_BUTTONS maximum size (which
is the max the core protocol can transport). Make sure a driver adheres to
that.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
2014-02-04 11:38:00 +10:00
Peter Hutterer
45f1d527f3 input: un-constify dev->name
Fallout from fecc7eb1cf, and reverts most of the
rest of that patch.

The device name is allocated and may even change during PreInit. The const
warnings came from the test codes, the correct fix here is to fix the test
code.

touch.c: In function ‘touch_init’:
touch.c:254:14: warning: assignment discards ‘const’ qualifier from pointer target type [enabled by default]
     dev.name = "test device";

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2014-02-04 11:27:48 +10:00
Peter Hutterer
ce3df579e3 input: un-constify InputAttributes
Introduced in fecc7eb1cf and reverts most of
that but it's helpfully mixed with other stuff.

InputAttributes are not const, they're strdup'd everywhere but the test code
and freed properly. Revert the const char changes and fix the test up instead.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
2014-02-04 11:27:48 +10:00
Alan Coopersmith
435098a0dc Add RANDR 1.4 requests & events to dix/protocol.txt
Checked against randrproto.txt & randr.h

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-01-29 15:22:44 -08:00
Alan Coopersmith
e6733ae91b On realloc failure, free font_path_string instead of leaking it
Flagged by cppcheck 1.62:
[dix/dixfonts.c:1792]: (error) Common realloc mistake:
 'font_path_string' nulled but not freed upon failure

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
2014-01-29 15:22:19 -08:00
Keith Packard
c1ce807d9f dix: Praise clients which haven't run for a while, rather than idle clients
A client which is ready, but hasn't run for a while, should receive
the same benefit as one which has simply been idle for a while. Use
the smart_stop_tick to see how long it has been since a client has
run instead of smart_check_tick, which got reset each time a client
was ready, even if it didn't get to run.

Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Keith Packard <keithp@keithp.com>
Tested-by: Chris Wilson <chris@chris-wilson.co.uk>
2014-01-23 10:10:28 -08:00
Keith Packard
25ebb9dbc9 Merge remote-tracking branch 'whot/for-keith' 2014-01-22 11:33:53 -08:00
Keith Packard
2d2d49dab5 Clean up a few function prototypes to not place formals in /**/
This just removes the comment markers from around the formals in
several function prototypes near where pointer -> void * changes were
made. There are plenty more of these to fix.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
2014-01-12 10:24:12 -08:00
Keith Packard
60014a4a98 Replace 'pointer' type with 'void *'
This lets us stop using the 'pointer' typedef in Xdefs.h as 'pointer'
is used throughout the X server for other things, and having duplicate
names generates compiler warnings.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Eric Anholt <eric@anholt.net>
2014-01-12 10:24:11 -08:00
Keith Packard
fecc7eb1cf xi: More warning cleanup for input
Lots more const char stuff.

Remove duplicate defs of CoreKeyboardProc and CorePointerProc from
test/xi2/protocol-common.c

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12 10:14:50 -08:00
Keith Packard
d89b42bda4 Clean up warnings in DIX
As usual, mostly const char changes. However, filter_device_events had
a potentially uninitialized value, 'raw', which I added a bunch of
checks for. I suspect most of those are 'can't happen', but it's hard
to see that inside the function.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2014-01-12 10:14:49 -08:00
Alan Coopersmith
863d2ad5c0 CheckPassiveGrabsOnWindow() needs to handle NULL return value from AllocGrab()
CheckPassiveGrabsOnWindow() calls AllocGrab() which can fail and return NULL.
This return value is not checked, and can cause NULL pointer dereferences.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-01-09 13:36:29 +10:00
Alan Coopersmith
5493a67ec2 GrabDevice() needs to handle NULL return value from AllocGrab()
GrabDevice() calls AllocGrab() which can fail and return NULL.
This return value is not checked, and can cause NULL pointer dereferences.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-01-09 13:36:29 +10:00
Alan Coopersmith
3a113815a0 If AllocGrab() fails to set up grab, don't copy to a NULL grab
If either the initial calloc or the xi2mask_new fails, grab is NULL,
but if a src grab is passed in, it was always being written to by
CopyGrab (and if that failed, dereferenced again in teardown).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
2014-01-09 13:36:29 +10:00
Peter Hutterer
929795d50d dix: fix check for grab type
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
2013-12-11 14:00:50 +10:00
Adam Jackson
e0cac00560 bs: Set the screen's bs support level to WhenMapped
Since we're using RedirectAutomatic to do this, we don't actually
preserve contents when unmapped.

v2: Don't say WhenMapped if Composite didn't initialize [vsyrjala]

Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-12-09 13:20:36 -05:00
Adam Jackson
b61ccd5d9d smartsched: Tweak the default scheduler intervals
A default timeslice of 20ms means a pathological client can ruin up to
two frames per scheduler tick.  And a fifth of a second is just insane.

Pick two different numbers out of the hat.  A 5ms slice means you can
probably keep up with two or three abusive clients, and letting it burst
to 15ms should give you about all the timeslice you need for a
fullscreen game (that's doing server-side rendering for some reason).

If you're running on a system with a 10ms granularity on SIGALRM, then
this effectively changes the intervals to 10ms and 30ms.  Which is still
better, just not as better.

I suspect this is about as good as we can do without actually going
preemptive, which is an entire other nightmare.

Reviewed-by: Julien Cristau <jcristau@debian.org>
Signed-off-by: Adam Jackson <ajax@redhat.com>
2013-12-09 13:20:36 -05:00
Keith Packard
26f013ba45 Add a RegionDuplicate function
This allocates a new region structure and copies a source region into
it in a single API rather than forcing the caller to do both steps themselves.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
2013-10-31 16:58:16 -07:00
Keith Packard
e3220d7bae Merge commit '2523a445a09a75a8baf642608d099a5e12d5437f'
This is merging the commits along Peter's for-keith branch, without
also merging in the spurious merge at the top of that branch.
2013-10-18 17:22:52 -07:00
Peter Hutterer
06b87aa528 sync: if the idle time was reset, force alarms to trigger (#70476)
The time between the idle reset and the IdleTimeWakeupHandler to be called is
indeterminate. Clients with an PositiveTransition or NegativeTransition alarm
on a low threshold may miss an alarm.

Work around this by keeping a reset flag for each device. When the
WakeupHandler triggers and the reset flag is set, we force a re-calculation of
everything and pretend the current idle time is zero. Immediately after is the
next calculation with the real idle time.

Relatively reproducible test case: Set up a XSyncNegativeTransition alarm for
a threshold of 1 ms. May trigger, may not.

X.Org Bug 70476 <http://bugs.freedesktop.org/show_bug.cgi?id=70476>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:44:32 +10:00
Peter Hutterer
efc1035ca9 dix: provide accessor methods for the last device event time
And now that we have the accessors, localize it. No functional changes, just
preparing for a future change.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
2013-10-18 16:44:32 +10:00
Alan Coopersmith
73b2660d72 Avoid use-after-free in dix/dixfonts.c: doImageText() [CVE-2013-4396]
Save a pointer to the passed in closure structure before copying it
and overwriting the *c pointer to point to our copy instead of the
original.  If we hit an error, once we free(c), reset c to point to
the original structure before jumping to the cleanup code that
references *c.

Since one of the errors being checked for is whether the server was
able to malloc(c->nChars * itemSize), the client can potentially pass
a number of characters chosen to cause the malloc to fail and the
error path to be taken, resulting in the read from freed memory.

Since the memory is accessed almost immediately afterwards, and the
X server is mostly single threaded, the odds of the free memory having
invalid contents are low with most malloc implementations when not using
memory debugging features, but some allocators will definitely overwrite
the memory there, leading to a likely crash.

Reported-by: Pedro Ribeiro <pedrib@gmail.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
2013-10-14 17:56:44 -07:00