- rel 2; fix segfaults if built with xproto 7.0.28+

diff --git a/xorg-xserver-server-xproto-crash.patch b/xorg-xserver-server-xproto-crash.patch
new file mode 100644 (file)
index 0000000..6201c30
--- /dev/null
+++ b/xorg-xserver-server-xproto-crash.patch
@@ -0,0 +1,59 @@
+commit 50c167164700e8ead9b7ccf9f9eafc7541baac75
+Author: Martin Peres <martin.peres@linux.intel.com>
+Date:   Mon Jul 20 10:37:30 2015 +0300
+
+    os: make sure the clientsWritable fd_set is initialized before use
+    
+    In WaitForSomething(), the fd_set clientsWritable may be used
+    unitialized when the boolean AnyClientsWriteBlocked is set in the
+    WakeupHandler(). This leads to a crash in FlushAllOutput() after
+    x11proto's commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7.
+    
+    The problem did not manifest before because both the XFD_SIZE and the
+    maximum number of clients were set to 256. As the connectionTranslation
+    table was initalized for the 256 clients to 0, the test on the index not
+    being 0 was aborting before dereferencing the client #0.
+    
+    As of commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7 in x11proto, the
+    XFD_SIZE got bumped to 512. This lead the OutputPending fd_set to have
+    any fd above 256 to be uninitialized which in turns lead to reading an
+    index after the end of the ConnectionTranslation table. This index would
+    then be used to find the client corresponding to the fd marked as
+    pending writes and would also result to an out-of-bound access which
+    would usually be the fatal one.
+    
+    Fix this by zeroing the clientsWritable fd_set at the beginning of
+    WaitForSomething(). In this case, the bottom part of the loop, which
+    would indirectly call FlushAllOutput, will not do any work but the next
+    call to select will result in the execution of the right codepath. This
+    is exactly what we want because we need to know the writable clients
+    before handling them. In the end, it also makes sure that the fds above
+    MaxClient are initialized, preventing the crash in FlushAllOutput().
+    
+    Thanks to everyone involved in tracking this one down!
+    
+    Reported-by: Karol Herbst <freedesktop@karolherbst.de>
+    Reported-by: Tobias Klausmann <tobias.klausmann@mni.thm.de>
+    Signed-off-by: Martin Peres <martin.peres@linux.intel.com>
+    Tested-by: Tobias Klausmann <tobias.klausmann@mni.thm.de>
+    Tested-by: Martin Peres <martin.peres@linux.intel.com>
+    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316
+    Cc: Ilia Mirkin  <imirkin@alum.mit.edu>
+    Cc: Olivier Fourdan <ofourdan@redhat.com
+    Cc: Adam Jackson <ajax@redhat.com>
+    Cc: Alan Coopersmith <alan.coopersmith@oracle.com
+    Cc: Chris Wilson <chris@chris-wilson.co.uk>
+    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+
+diff --git a/os/WaitFor.c b/os/WaitFor.c
+index 431f1a6..993c14e 100644
+--- a/os/WaitFor.c
++++ b/os/WaitFor.c
+@@ -158,6 +158,7 @@ WaitForSomething(int *pClientsReady)
+     Bool someReady = FALSE;
+ 
+     FD_ZERO(&clientsReadable);
++    FD_ZERO(&clientsWritable);
+ 
+     if (nready)
+         SmartScheduleStopTimer();

diff --git a/xorg-xserver-server.spec b/xorg-xserver-server.spec
index c4f4b37b304e696a213befadb7d5b2160f1140f2..b55f4704adffe5d08da22dbdf41ee790e5cd4e3d 100644 (file)
--- a/xorg-xserver-server.spec
+++ b/xorg-xserver-server.spec
@@ -35,7 +35,7 @@ Summary:      X.org server
 Summary(pl.UTF-8):     Serwer X.org
 Name:          xorg-xserver-server
 Version:       1.17.3
-Release:       1
+Release:       2
 License:       MIT
 Group:         X11/Servers
 Source0:       http://xorg.freedesktop.org/releases/individual/xserver/xorg-server-%{version}.tar.bz2
@@ -49,7 +49,7 @@ Source12:     xvfb-run.sh
 Patch0:                %{name}-xwrapper.patch
 Patch1:                %{name}-pic-libxf86config.patch
 Patch2:                dtrace-link.patch
-
+Patch3:                xorg-xserver-server-xproto-crash.patch
 Patch4:                %{name}-builtin-SHA1.patch
 
 Patch6:                110_nvidia_slowdow_fix.patch
@@ -431,7 +431,7 @@ Biblioteka rozszerzenia GLX dla serwera X.org.
 %patch0 -p0
 %patch1 -p1
 %patch2 -p1
-
+%patch3 -p1
 %patch4 -p1
 
 %patch6 -p1