frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xf86vidmode: fix result copying in ProcVidModeGetMonitor() 

The monitor values (vendor and model) accidentally had been copied
at the start of the payload, instead of being appended after the
previously copied data, and also moving the wrong pointer, thus
corrupting the reply and causing some clients to hang.

Signed-off-by: Tautvis <gtautvis@gmail.com>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Tautvis 2025-07-01 13:23:20 +02:00 committed by Enrico Weigelt
parent 6a3162d623
commit 6c2f17a5e0
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Xext/vidmode.c
View File

@ -1280,7 +1280,7 @@ ProcVidModeGetMonitor(ClientPtr client)
+ nHsync + nVrefresh + nVendorItems + nModelItems
};
const int buflen = nHsync * nVrefresh + nVendorItems + nModelItems;
const int buflen = nHsync + nVrefresh + nVendorItems + nModelItems;
CARD32 *sendbuf = calloc(buflen, sizeof(CARD32));
if (!sendbuf)
@ -1302,22 +1302,22 @@ ProcVidModeGetMonitor(ClientPtr client)
bufwalk++;
}
memcpy(sendbuf,
memcpy(bufwalk,
pVidMode->GetMonitorValue(pScreen, VIDMODE_MON_VENDOR, 0).ptr,
vendorLength);
sendbuf += nVendorItems;
bufwalk += nVendorItems;
memcpy(sendbuf,
memcpy(bufwalk,
pVidMode->GetMonitorValue(pScreen, VIDMODE_MON_MODEL, 0).ptr,
modelLength);
sendbuf += nModelItems;
bufwalk += nModelItems;
if (client->swapped) {
swaps(&rep.sequenceNumber);
swapl(&rep.length);
}
WriteToClient(client, SIZEOF(xXF86VidModeGetMonitorReply), &rep);
WriteToClient(client, sizeof(xXF86VidModeGetMonitorReply), &rep);
WriteToClient(client, buflen * sizeof(CARD32), sendbuf);
free(sendbuf);