From 429b4b20d5708d608fd55f91dd5bcd4ac0b51a12 Mon Sep 17 00:00:00 2001
From: George Staplin <gstaplin@apple.com>
Date: Sat, 22 Nov 2008 10:57:58 -0700
Subject: [PATCH] XQuartz: GL: Add a branch to prevent a NULL DrawablePtr
 structure access.

In attach() check for pDraw being NULL, and also print an ErrorF message,
because we eventually want to track down why this is occuring.

It's unclear how this occurs, but as I noted in the 1.4 branch, I believe that
the DrawablePtr/struct _Drawable -> id is the member being accessed that causes
KERN_PROTECTION_FAILURE at 0x0000000000000004

This passes my tests using: env LIBGL_ALWAYS_INDIRECT=1 ./sometest.

I fixed a warning: caused by initializing the screen->base.visuals with the
configs.  It is a ** not a *.  It seems that some other part of GLX will
initialize this for us.
(cherry picked from commit 17f6a261fca6d5856069dce28bb4838261afc6bc)
---
 hw/xquartz/GL/indirect.c | 61 ++++++++++++++++++++++++----------------
 1 file changed, 37 insertions(+), 24 deletions(-)

diff --git a/hw/xquartz/GL/indirect.c b/hw/xquartz/GL/indirect.c
index 5f508a461..3cdb0122a 100644
--- a/hw/xquartz/GL/indirect.c
+++ b/hw/xquartz/GL/indirect.c
@@ -298,49 +298,61 @@ static void surface_notify(void *_arg, void *data) {
     }
 }
 
-static void attach(__GLXAquaContext *context, __GLXAquaDrawable *draw) {
+static BOOL attach(__GLXAquaContext *context, __GLXAquaDrawable *draw) {
     DrawablePtr pDraw;
-	GLAQUA_DEBUG_MSG("attach(%p, %p)\n", context, draw);
+    
+    GLAQUA_DEBUG_MSG("attach(%p, %p)\n", context, draw);
+	
+    if(NULL == context || NULL == draw)
+	return TRUE;
+
     pDraw = draw->base.pDraw;
 
-    if (draw->sid == 0) {
-//        if (!quartzProcs->CreateSurface(pDraw->pScreen, pDraw->id, pDraw,
-        if (!DRICreateSurface(pDraw->pScreen, pDraw->id, pDraw,
-                                        0, &draw->sid, NULL,
-                                        surface_notify, draw))
-            return;
-        draw->pDraw = pDraw;
-	} 
+    if(NULL == pDraw) {
+	ErrorF("%s:attach() pDraw is NULL!\n", __FILE__);
+	return TRUE;
+    }
 
+    if (draw->sid == 0) {
+	//if (!quartzProcs->CreateSurface(pDraw->pScreen, pDraw->id, pDraw,
+        if (!DRICreateSurface(pDraw->pScreen, pDraw->id, pDraw,
+			      0, &draw->sid, NULL,
+			      surface_notify, draw))
+            return TRUE;
+        draw->pDraw = pDraw;
+    } 
+    
     if (!context->isAttached || context->sid != draw->sid) {
         x_list *lst;
-
+	
         if (xp_attach_gl_context(context->ctx, draw->sid) != Success) {
-//            quartzProcs->DestroySurface(pDraw->pScreen, pDraw->id, pDraw,
+	    //quartzProcs->DestroySurface(pDraw->pScreen, pDraw->id, pDraw,
             DRIDestroySurface(pDraw->pScreen, pDraw->id, pDraw,
-								surface_notify, draw);
+			      surface_notify, draw);
             if (surface_hash != NULL)
                 x_hash_table_remove(surface_hash, x_cvt_uint_to_vptr(draw->sid));
-
+	    
             draw->sid = 0;
-            return;
+            return TRUE;
         }
-
+	
         context->isAttached = TRUE;
         context->sid = draw->sid;
-
+	
         if (surface_hash == NULL)
             surface_hash = x_hash_table_new(NULL, NULL, NULL, NULL);
-
+	
         lst = x_hash_table_lookup(surface_hash, x_cvt_uint_to_vptr(context->sid), NULL);
         if (x_list_find(lst, context) == NULL) {
             lst = x_list_prepend(lst, context);
             x_hash_table_insert(surface_hash, x_cvt_uint_to_vptr(context->sid), lst);
         }
-
+	
         GLAQUA_DEBUG_MSG("attached 0x%x to 0x%x\n", (unsigned int) pDraw->id,
                          (unsigned int) draw->sid);
     } 
+
+    return FALSE;
 }
 
 #if 0     // unused
@@ -370,11 +382,12 @@ static void unattach(__GLXAquaContext *context) {
 static int __glXAquaContextMakeCurrent(__GLXcontext *baseContext) {
     CGLError gl_err;
     __GLXAquaContext *context = (__GLXAquaContext *) baseContext;
-	__GLXAquaDrawable *drawPriv = (__GLXAquaDrawable *) context->base.drawPriv;
-
+    __GLXAquaDrawable *drawPriv = (__GLXAquaDrawable *) context->base.drawPriv;
+    
     GLAQUA_DEBUG_MSG("glAquaMakeCurrent (ctx 0x%p)\n", baseContext);
     
-    attach(context, drawPriv);
+    if(attach(context, drawPriv))
+	return /*error*/ 0;
 
     gl_err = CGLSetCurrentContext(context->ctx);
     if (gl_err != 0)
@@ -1310,8 +1323,8 @@ static __GLXscreen * __glXAquaScreenProbe(ScreenPtr pScreen) {
     screen->base.fbconfigs = configs;
     screen->base.numFBConfigs = 1; 
 
-    screen->base.visuals = configs;
-    screen->base.numVisuals = 1;
+    screen->base.visuals = NULL;
+    screen->base.numVisuals = 0;
 
     GlxSetVisualConfig(GLX_ALL_VISUALS);