rpms/xorg-x11-server
7
0
Fork 0
Code Issues Pull Requests Releases Activity

xserver 1.9.0

Browse Source 
xserver-1.9-reset-root-null.patch: drop, upstream.
This commit is contained in:
Peter Hutterer 2010-08-23 09:08:26 +10:00
parent a60ac6d270
commit c6ce83d02a
4 changed files with 8 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored
View File

@ -1,2 +1,3 @@
xorg-server-20100716.tar.xz
xorg-server-1.8.99.906.tar.bz2
xorg-server-1.9.0.tar.bz2

2
sources
View File

@ -1 +1 @@
d4ab361cacc35e2ed4587019980b7e57 xorg-server-1.8.99.906.tar.bz2
ba1173998a5a4216fd7b40eded96697e xorg-server-1.9.0.tar.bz2

9
xorg-x11-server.spec
View File

@ -29,8 +29,8 @@
Summary: X.Org X11 X server
Name: xorg-x11-server
Version: 1.8.99.906
Release: 2%{?gitdate:.%{gitdate}}%{dist}
Version: 1.9.0
Release: 1%{?gitdate:.%{gitdate}}%{dist}
URL: http://www.x.org
License: MIT
Group: User Interface/X
@ -97,7 +97,6 @@ Patch6053: xserver-1.8-disable-vboxvideo.patch
# https://bugs.freedesktop.org/show_bug.cgi?id=28672
Patch7000: xserver-1.8.0-no-xorg.patch
Patch7001: xserver-1.9-reset-root-null.patch
%define moduledir %{_libdir}/xorg/modules
%define drimoduledir %{_libdir}/dri
@ -547,6 +546,10 @@ rm -rf $RPM_BUILD_ROOT
%{xserver_source_dir}
%changelog
* Mon Aug 23 2010 Peter Hutterer <peter.hutterer@redhat.com> 1.9.0-1
- xserver 1.9.0
- xserver-1.9-reset-root-null.patch: drop, upstream.
* Mon Aug 16 2010 Dave Airlie <airlied@redhat.com> 1.8.99.906-2
- fix use-after-free for root window - hopefully fix (#596985)

59
xserver-1.9-reset-root-null.patch
View File

@ -1,59 +0,0 @@
From d25c74c843b83e7c6acbeb52d4807559c83f98cb Mon Sep 17 00:00:00 2001
From: Dave Airlie <airlied@linux.ie>
Date: Mon, 16 Aug 2010 12:16:48 +1000
Subject: [PATCH] dix: reset pScreen->root to NULL when root window is deleted.
We were seeing a crash in the FreeAllResources codepath,
running valgrind revealed this,
==12536== Invalid read of size 4
==12536== at 0x810BCAB: DeliverPropertyEvent (rrproperty.c:33)
==12536== by 0x80958A4: TraverseTree (window.c:227)
==12536== by 0x809593E: WalkTree (window.c:255)
==12536== by 0x810BC66: RRDeliverPropertyEvent (rrproperty.c:53)
==12536== by 0x810BD5D: RRDeleteProperty.clone.0 (rrproperty.c:76)
==12536== by 0x810BD98: RRDeleteAllOutputProperties (rrproperty.c:88)
==12536== by 0x810A36E: RROutputDestroyResource (rroutput.c:407)
==12536== by 0x808DF4E: FreeClientResources (resource.c:859)
==12536== by 0x808E005: FreeAllResources (resource.c:876)
==12536== by 0x8062300: main (main.c:305)
==12536== Address 0x46ba8ac is 4 bytes inside a block of size 164 free'd
==12536== at 0x40057F6: free (vg_replace_malloc.c:325)
==12536== by 0x8087F1F: _dixFreeObjectWithPrivates (privates.c:357)
==12536== by 0x809832A: DeleteWindow (window.c:926)
==12536== by 0x808DF4E: FreeClientResources (resource.c:859)
==12536== by 0x808E005: FreeAllResources (resource.c:876)
==12536== by 0x8062300: main (main.c:305)
Its a use after free on the root window, since we have already deleted it
at this point. This patch checks if the window we are destroying is the root
window and resets the pointer to NULL if it is.
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
dix/window.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/dix/window.c b/dix/window.c
index 4a47dd5..33ef943 100644
--- a/dix/window.c
+++ b/dix/window.c
@@ -895,10 +895,15 @@ DeleteWindow(pointer value, XID wid)
WindowPtr pParent;
WindowPtr pWin = (WindowPtr)value;
xEvent event;
+ ScreenPtr pScreen;
+
+ pScreen = pWin->drawable.pScreen;
UnmapWindow(pWin, FALSE);
CrushTree(pWin);
+ if (pWin == pScreen->root)
+ pScreen->root = NULL;
pParent = pWin->parent;
if (wid && pParent && SubStrSend(pWin, pParent))
--
1.7.2.1