Hi,

I tracked down a server crash located in xf86fbman.c.
The crash was in function AllocateArea.

The problem is a broken link in the chained list of
areas. The link breaks when no new item
in the list is allocated which occurs in some rare cases
(which I could reproduce).

Here is a fix :

1. Add a variable newlink=0
2. Insert after link = xalloc(sizeof(FBLink)); the line newlink=1;
3. Update the links only if a new item has been allocated :

if(area) {
 area->pScreen = pScreen;
 area->granularity = granularity;
 area->box.x1 = x;
 area->box.x2 = x + w;
 area->box.y1 = boxp->y1;
 area->box.y2 = boxp->y1 + h;
 area->MoveAreaCallback = moveCB;
 area->RemoveAreaCallback = removeCB;
 area->devPrivate.ptr = privData;

        REGION_INIT(pScreen, &NewReg, &(area->box), 1);
 REGION_SUBTRACT(pScreen, offman->FreeBoxes, offman->FreeBoxes, &NewReg);
 REGION_UNINIT(pScreen, &NewReg);
 if ( newlink ) { <---------------------------------------- ADD THIS TEST 
********************
  link->next = offman->UsedAreas;
  offman->UsedAreas = link;
  }
 offman->NumUsedAreas++;
   }



--
 _________________________________
(
)   Jacques GANGLOFF
(   Associate Professor
)   LSIIT / GRAViR
(   Bd S�bastien Brant
)   67400 Illkirch
(   Tel : +33 (0)3 90 24 44 68
)   Fax : +33 (0)3 90 24 44 80
(   http://gravir.u-strasbg.fr
)_________________________________



_______________________________________________
Xpert mailing list
[EMAIL PROTECTED]
http://XFree86.Org/mailman/listinfo/xpert

Reply via email to