From f9a04d19aef77bf787b8d322305a6971d24a6ba1 Mon Sep 17 00:00:00 2001
From: Keith Packard <keithp@keithp.com>
Date: Mon, 21 Sep 2015 07:16:12 +0100
Subject: [PATCH] fonts: Continue when font calls return Suspended more than
 once

Patch 3ab6cd31cbdf8095b2948034fce5fb645422d8da fixed Xinerama
interactions with font servers by not putting clients to sleep
multiple times. However, it introduced additional changes dealing with
libXfont routine returning Suspended more than once for the same
request. This additional change was to abandon processing of the
current request and free the closure data by jumping to
'xinerama_sleep' in each of the functions.

Font library functions shouldn't return Suspended more than once,
except for ListFontsWithInfo, which produces multiple replies, and
thus ends up returning Suspended many times during processing.

With the jump to xinerama_sleep occurring after the first reply was
processed, the closure for the request was freed and future calls into
the ListFontsWithInfo callback resulted in dereferencing freed
memory.

This patch removes the added branches, reverting the code to its
previous behaviour, which permitted multiple Suspended returns and
simply waited for the client to be signaled again so that the callback
could continue processing the request.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
---
 dix/dixfonts.c | 21 ---------------------
 1 file changed, 21 deletions(-)

diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 968cee461..300bf043a 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -313,8 +313,6 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
         if (err == Suspended) {
             if (!ClientIsAsleep(client))
                 ClientSleep(client, (ClientSleepProcPtr) doOpenFont, c);
-            else
-                goto xinerama_sleep;
             return TRUE;
         }
         break;
@@ -362,7 +360,6 @@ doOpenFont(ClientPtr client, OFclosurePtr c)
                           c->fontid, FontToXError(err));
     }
     ClientWakeup(c->client);
- xinerama_sleep:
     for (i = 0; i < c->num_fpes; i++) {
         FreeFPE(c->fpe_list[i]);
     }
@@ -595,8 +592,6 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
                 if (!ClientIsAsleep(client))
                     ClientSleep(client,
                                 (ClientSleepProcPtr) doListFontsAndAliases, c);
-                else
-                    goto xinerama_sleep;
                 return TRUE;
             }
 
@@ -622,8 +617,6 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
                         ClientSleep(client,
                                     (ClientSleepProcPtr) doListFontsAndAliases,
                                     c);
-                    else
-                        goto xinerama_sleep;
                     return TRUE;
                 }
                 if (err == Successful)
@@ -641,8 +634,6 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
                         ClientSleep(client,
                                     (ClientSleepProcPtr) doListFontsAndAliases,
                                     c);
-                    else
-                        goto xinerama_sleep;
                     return TRUE;
                 }
                 if (err == FontNameAlias) {
@@ -787,7 +778,6 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c)
 
  bail:
     ClientWakeup(client);
- xinerama_sleep:
     for (i = 0; i < c->num_fpes; i++)
         FreeFPE(c->fpe_list[i]);
     free(c->fpe_list);
@@ -887,8 +877,6 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
                 if (!ClientIsAsleep(client))
                     ClientSleep(client,
                                 (ClientSleepProcPtr) doListFontsWithInfo, c);
-                else
-                    goto xinerama_sleep;
                 return TRUE;
             }
             if (err == Successful)
@@ -904,8 +892,6 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
                 if (!ClientIsAsleep(client))
                     ClientSleep(client,
                                 (ClientSleepProcPtr) doListFontsWithInfo, c);
-                else
-                    goto xinerama_sleep;
                 return TRUE;
             }
         }
@@ -1039,7 +1025,6 @@ doListFontsWithInfo(ClientPtr client, LFWIclosurePtr c)
     WriteSwappedDataToClient(client, length, &finalReply);
  bail:
     ClientWakeup(client);
- xinerama_sleep:
     for (i = 0; i < c->num_fpes; i++)
         FreeFPE(c->fpe_list[i]);
     free(c->reply);
@@ -1296,8 +1281,6 @@ doPolyText(ClientPtr client, PTclosurePtr c)
                     client_state = START_SLEEP;
                     continue;   /* on to steps 3 and 4 */
                 }
-                else
-                    goto xinerama_sleep;
                 return TRUE;
             }
             else if (lgerr != Successful) {
@@ -1351,7 +1334,6 @@ doPolyText(ClientPtr client, PTclosurePtr c)
     }
     if (ClientIsAsleep(client)) {
         ClientWakeup(c->client);
- xinerama_sleep:
         ChangeGC(NullClient, c->pGC, clearGCmask, clearGC);
 
         /* Unreference the font from the scratch GC */
@@ -1476,8 +1458,6 @@ doImageText(ClientPtr client, ITclosurePtr c)
 
             ClientSleep(client, (ClientSleepProcPtr) doImageText, c);
         }
-        else
-            goto xinerama_sleep;
         return TRUE;
     }
     else if (lgerr != Successful) {
@@ -1500,7 +1480,6 @@ doImageText(ClientPtr client, ITclosurePtr c)
     }
     if (ClientIsAsleep(client)) {
         ClientWakeup(c->client);
- xinerama_sleep:
         ChangeGC(NullClient, c->pGC, clearGCmask, clearGC);
 
         /* Unreference the font from the scratch GC */