XkbGetKeyboardByName relies on flags to read the data from the server. If the X server sends us the wrong flags or if a subreply is smaller than it should be, XkbGetKeyboardByName will not read all the available data and leave data in the buffer, which will cause the next _XReply() to fail with:
[xcb] Extra reply data still left in queue [xcb] This is most likely caused by a broken X extension library [xcb] Aborting, sorry about that. xcb_io.c:576: _XReply: Assertion `!xcb_xlib_extra_reply_data_left' failed. Aborted Check if there is some extra data left at the end of XkbGetKeyboardByName() and discard that data if any is found. Many thanks to Peter Hutterer <[email protected]> for finding the root cause of the issue and Adam Jackson <[email protected]> for helping with the analysis! Signed-off-by: Olivier Fourdan <[email protected]> --- v2: bail out if extra data is found, do not return success. v3: fix indentation, remove warning message src/xkb/XKBGetByName.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/xkb/XKBGetByName.c b/src/xkb/XKBGetByName.c index 973052c..efd985b 100644 --- a/src/xkb/XKBGetByName.c +++ b/src/xkb/XKBGetByName.c @@ -44,7 +44,7 @@ XkbGetKeyboardByName(Display *dpy, { register xkbGetKbdByNameReq *req; xkbGetKbdByNameReply rep; - int len, extraLen; + int len, extraLen = 0; char *str; XkbDescPtr xkb; int mapLen, codesLen, typesLen, compatLen; @@ -204,12 +204,16 @@ XkbGetKeyboardByName(Display *dpy, if (status != Success) goto BAILOUT; } + if (extraLen > 0) + goto BAILOUT; UnlockDisplay(dpy); SyncHandle(); return xkb; BAILOUT: if (xkb != NULL) XkbFreeKeyboard(xkb, XkbAllComponentsMask, xTrue); + if (extraLen > 0) + _XEatData(dpy, extraLen); UnlockDisplay(dpy); SyncHandle(); return NULL; -- 2.5.0 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
