From d05c754e1bde895589fb514d8f518afeccecbc05 Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@keithp.com>
Date: Wed, 17 May 2017 09:57:28 -0700
Subject: [PATCH] os: Check oc->trans_conn before using oc->fd in
 YieldControlNoInput

oc->trans_conn is set to NULL when the connection is closed. At this
point, oc->fd is no longer valid and shouldn't be used. Move
dereference of oc->fd up into YieldControlNoInput where the state of
oc->trans_conn can be checked in a single place.

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
---
 os/io.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/os/io.c b/os/io.c
index 6a486613c..b0402912a 100644
--- a/os/io.c
+++ b/os/io.c
@@ -183,10 +183,12 @@ YieldControl(void)
 }
 
 static void
-YieldControlNoInput(int fd)
+YieldControlNoInput(ClientPtr client)
 {
+    OsCommPtr oc = client->osPrivate;
     YieldControl();
-    ospoll_reset_events(server_poll, fd);
+    if (oc->trans_conn)
+        ospoll_reset_events(server_poll, oc->fd);
 }
 
 static void
@@ -226,7 +228,6 @@ ReadRequestFromClient(ClientPtr client)
 {
     OsCommPtr oc = (OsCommPtr) client->osPrivate;
     ConnectionInputPtr oci = oc->input;
-    int fd = oc->fd;
     unsigned int gotnow, needed;
     int result;
     register xReq *request;
@@ -357,7 +358,7 @@ ReadRequestFromClient(ClientPtr client)
                 if (0)
 #endif
                 {
-                    YieldControlNoInput(fd);
+                    YieldControlNoInput(client);
                     return 0;
                 }
             }
@@ -394,7 +395,7 @@ ReadRequestFromClient(ClientPtr client)
         }
         if (gotnow < needed) {
             /* Still don't have enough; punt. */
-            YieldControlNoInput(fd);
+            YieldControlNoInput(client);
             return 0;
         }
     }
@@ -494,7 +495,6 @@ InsertFakeRequest(ClientPtr client, char *data, int count)
 {
     OsCommPtr oc = (OsCommPtr) client->osPrivate;
     ConnectionInputPtr oci = oc->input;
-    int fd = oc->fd;
     int gotnow, moveup;
 
     NextAvailableInput(oc);
@@ -533,7 +533,7 @@ InsertFakeRequest(ClientPtr client, char *data, int count)
         (gotnow >= (int) (get_req_len((xReq *) oci->bufptr, client) << 2)))
         mark_client_ready(client);
     else
-        YieldControlNoInput(fd);
+        YieldControlNoInput(client);
     return TRUE;
 }
 
@@ -548,7 +548,6 @@ ResetCurrentRequest(ClientPtr client)
 {
     OsCommPtr oc = (OsCommPtr) client->osPrivate;
     register ConnectionInputPtr oci = oc->input;
-    int fd = oc->fd;
     register xReq *request;
     int gotnow, needed;
 
@@ -557,7 +556,7 @@ ResetCurrentRequest(ClientPtr client)
     oci->lenLastReq = 0;
     gotnow = oci->bufcnt + oci->buffer - oci->bufptr;
     if (gotnow < sizeof(xReq)) {
-        YieldControlNoInput(fd);
+        YieldControlNoInput(client);
     }
     else {
         request = (xReq *) oci->bufptr;
@@ -576,7 +575,7 @@ ResetCurrentRequest(ClientPtr client)
             YieldControl();
         }
         else
-            YieldControlNoInput(fd);
+            YieldControlNoInput(client);
     }
 }