commit b4aca4425a827cc471550768e075620d7f09c312
Author: Arkadiusz Miśkiewicz <[email protected]>
Date: Wed Oct 28 12:24:05 2015 +0100
- rel 2; fix segfaults if built with xproto 7.0.28+
xorg-xserver-server-xproto-crash.patch | 59 ++++++++++++++++++++++++++++++++++
xorg-xserver-server.spec | 6 ++--
2 files changed, 62 insertions(+), 3 deletions(-)
---
diff --git a/xorg-xserver-server.spec b/xorg-xserver-server.spec
index c4f4b37..b55f470 100644
--- a/xorg-xserver-server.spec
+++ b/xorg-xserver-server.spec
@@ -35,7 +35,7 @@ Summary: X.org server
Summary(pl.UTF-8): Serwer X.org
Name: xorg-xserver-server
Version: 1.17.3
-Release: 1
+Release: 2
License: MIT
Group: X11/Servers
Source0:
http://xorg.freedesktop.org/releases/individual/xserver/xorg-server-%{version}.tar.bz2
@@ -49,7 +49,7 @@ Source12: xvfb-run.sh
Patch0: %{name}-xwrapper.patch
Patch1: %{name}-pic-libxf86config.patch
Patch2: dtrace-link.patch
-
+Patch3: xorg-xserver-server-xproto-crash.patch
Patch4: %{name}-builtin-SHA1.patch
Patch6: 110_nvidia_slowdow_fix.patch
@@ -431,7 +431,7 @@ Biblioteka rozszerzenia GLX dla serwera X.org.
%patch0 -p0
%patch1 -p1
%patch2 -p1
-
+%patch3 -p1
%patch4 -p1
%patch6 -p1
diff --git a/xorg-xserver-server-xproto-crash.patch
b/xorg-xserver-server-xproto-crash.patch
new file mode 100644
index 0000000..6201c30
--- /dev/null
+++ b/xorg-xserver-server-xproto-crash.patch
@@ -0,0 +1,59 @@
+commit 50c167164700e8ead9b7ccf9f9eafc7541baac75
+Author: Martin Peres <[email protected]>
+Date: Mon Jul 20 10:37:30 2015 +0300
+
+ os: make sure the clientsWritable fd_set is initialized before use
+
+ In WaitForSomething(), the fd_set clientsWritable may be used
+ unitialized when the boolean AnyClientsWriteBlocked is set in the
+ WakeupHandler(). This leads to a crash in FlushAllOutput() after
+ x11proto's commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7.
+
+ The problem did not manifest before because both the XFD_SIZE and the
+ maximum number of clients were set to 256. As the connectionTranslation
+ table was initalized for the 256 clients to 0, the test on the index not
+ being 0 was aborting before dereferencing the client #0.
+
+ As of commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7 in x11proto, the
+ XFD_SIZE got bumped to 512. This lead the OutputPending fd_set to have
+ any fd above 256 to be uninitialized which in turns lead to reading an
+ index after the end of the ConnectionTranslation table. This index would
+ then be used to find the client corresponding to the fd marked as
+ pending writes and would also result to an out-of-bound access which
+ would usually be the fatal one.
+
+ Fix this by zeroing the clientsWritable fd_set at the beginning of
+ WaitForSomething(). In this case, the bottom part of the loop, which
+ would indirectly call FlushAllOutput, will not do any work but the next
+ call to select will result in the execution of the right codepath. This
+ is exactly what we want because we need to know the writable clients
+ before handling them. In the end, it also makes sure that the fds above
+ MaxClient are initialized, preventing the crash in FlushAllOutput().
+
+ Thanks to everyone involved in tracking this one down!
+
+ Reported-by: Karol Herbst <[email protected]>
+ Reported-by: Tobias Klausmann <[email protected]>
+ Signed-off-by: Martin Peres <[email protected]>
+ Tested-by: Tobias Klausmann <[email protected]>
+ Tested-by: Martin Peres <[email protected]>
+ Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316
+ Cc: Ilia Mirkin <[email protected]>
+ Cc: Olivier Fourdan <[email protected]
+ Cc: Adam Jackson <[email protected]>
+ Cc: Alan Coopersmith <[email protected]
+ Cc: Chris Wilson <[email protected]>
+ Reviewed-by: Alan Coopersmith <[email protected]>
+
+diff --git a/os/WaitFor.c b/os/WaitFor.c
+index 431f1a6..993c14e 100644
+--- a/os/WaitFor.c
++++ b/os/WaitFor.c
+@@ -158,6 +158,7 @@ WaitForSomething(int *pClientsReady)
+ Bool someReady = FALSE;
+
+ FD_ZERO(&clientsReadable);
++ FD_ZERO(&clientsWritable);
+
+ if (nready)
+ SmartScheduleStopTimer();
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/xorg-xserver-server.git/commitdiff/b4aca4425a827cc471550768e075620d7f09c312
_______________________________________________
pld-cvs-commit mailing list
[email protected]
http://lists.pld-linux.org/mailman/listinfo/pld-cvs-commit
