Hello community, here is the log from the commit of package xorg-x11-server for openSUSE:Factory checked in at 2015-07-21 13:25:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xorg-x11-server (Old) and /work/SRC/openSUSE:Factory/.xorg-x11-server.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xorg-x11-server" Changes: -------- --- /work/SRC/openSUSE:Factory/xorg-x11-server/xorg-x11-server.changes 2015-07-05 17:56:32.000000000 +0200 +++ /work/SRC/openSUSE:Factory/.xorg-x11-server.new/xorg-x11-server.changes 2015-07-21 13:25:51.000000000 +0200 @@ -1,0 +2,7 @@ +Fri Jul 17 13:01:12 UTC 2015 - [email protected] + +- Add patch u_0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch + Prevent segmentation faults with more than 256 clients (introduced + by xproto 7.0.28 increasing the max client count 256 -> 512) + Fdo Bug: https://bugs.freedesktop.org/show_bug.cgi?id=91316 +------------------------------------------------------------------- New: ---- u_0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xorg-x11-server.spec ++++++ --- /var/tmp/diff_new_pack.gPkf2S/_old 2015-07-21 13:25:52.000000000 +0200 +++ /var/tmp/diff_new_pack.gPkf2S/_new 2015-07-21 13:25:52.000000000 +0200 @@ -173,6 +173,8 @@ Patch1211: b_0001-Prevent-XSync-Alarms-from-senslessly-calling-CheckTr.patch Patch1222: b_sync-fix.patch +Patch1300: u_0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch + %description This package contains the X.Org Server. @@ -268,6 +270,8 @@ ### patch222 might not be applicable anymore #%patch1222 -p1 +%patch1300 -p1 + find . -type f \! -name '*.orig' \! -path ./source-file-list > source-file-list %build ++++++ u_0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch ++++++ >From 7cc7ffd25d5e50b54cb942d07d4cb160f20ff9c5 Mon Sep 17 00:00:00 2001 From: Martin Peres <[email protected]> Date: Fri, 17 Jul 2015 17:21:26 +0300 Subject: [PATCH] os: make sure the clientsWritable fd_set is initialized before use In WaitForSomething(), the fd_set clientsWritable may be used unitialized when the boolean AnyClientsWriteBlocked is set in the WakeupHandler(). This leads to a crash in FlushAllOutput() after x11proto's commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7. The problem did not manifest before because both the XFD_SIZE and the maximum number of clients were set to 256. As the connectionTranslation table was initalized for the 256 clients to 0, the test on the index not being 0 was aborting before dereferencing the client #0. As of commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7 in x11proto, the XFD_SIZE got bumped to 512. This lead the OutputPending fd_set to have any fd above 256 to be uninitialized which in turns lead to reading an index after the end of the ConnectionTranslation table. This index would then be used to find the client corresponding to the fd marked as pending writes and would also result to an out-of-bound access which would usually be the fatal one. Fix this by zeroing the clientsWritable fd_set at the beginning of WaitForSomething(). In this case, the bottom part of the loop, which would indirectly call FlushAllOutput, will not do any work but the next call to select will result in the execution of the right codepath. This is exactly what we want because we need to know the writable clients before handling them. In the end, it also makes sure that the fds above MaxClient are initialized, preventing the crash in FlushAllOutput(). Thanks to everyone involved in tracking this one down! Reported-by: Karol Herbst <[email protected]> Reported-by: Tobias Klausmann <[email protected]> Signed-off-by: Martin Peres <[email protected]> Tested-by: Martin Peres <[email protected]> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316 Cc: Ilia Mirkin <[email protected]> Cc: Martin Peres <[email protected]> Cc: Olivier Fourdan <[email protected] Cc: Adam Jackson <[email protected]> Cc: Alan Coopersmith <[email protected] Cc: Chris Wilson <[email protected]> --- os/WaitFor.c | 1 + 1 file changed, 1 insertion(+) diff --git a/os/WaitFor.c b/os/WaitFor.c index 431f1a6..993c14e 100644 --- a/os/WaitFor.c +++ b/os/WaitFor.c @@ -158,6 +158,7 @@ WaitForSomething(int *pClientsReady) Bool someReady = FALSE; FD_ZERO(&clientsReadable); + FD_ZERO(&clientsWritable); if (nready) SmartScheduleStopTimer(); -- 2.4.5
