frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/hw/xwayland
History
Olivier Fourdan 8b8f9007cc xwayland: avoid using freed xwl_window on unrealize 
xwl_unrealize_window() would use freed xwl_window which can lead to
various memory corruption and crashes, as reported by valgrind:

 Invalid read of size 8
    at 0x42C802: xwl_present_cleanup (xwayland-present.c:84)
    by 0x42BA67: xwl_unrealize_window (xwayland.c:601)
    by 0x541EE9: compUnrealizeWindow (compwindow.c:285)
    by 0x57E1FA: UnrealizeTree (window.c:2816)
    by 0x581189: UnmapWindow (window.c:2874)
    by 0x54EB26: ProcUnmapWindow (dispatch.c:879)
    by 0x554B7D: Dispatch (dispatch.c:479)
    by 0x558BE5: dix_main (main.c:276)
    by 0x7C4B1BA: (below main) (libc-start.c:308)
  Address 0xf520f60 is 96 bytes inside a block of size 184 free'd
    at 0x4C2EDAC: free (vg_replace_malloc.c:530)
    by 0x42B9FB: xwl_unrealize_window (xwayland.c:624)
    by 0x541EE9: compUnrealizeWindow (compwindow.c:285)
    by 0x57E1FA: UnrealizeTree (window.c:2816)
    by 0x581189: UnmapWindow (window.c:2874)
    by 0x54EB26: ProcUnmapWindow (dispatch.c:879)
    by 0x554B7D: Dispatch (dispatch.c:479)
    by 0x558BE5: dix_main (main.c:276)
    by 0x7C4B1BA: (below main) (libc-start.c:308)
  Block was alloc'd at
    at 0x4C2FB06: calloc (vg_replace_malloc.c:711)
    by 0x42B307: xwl_realize_window (xwayland.c:488)
    by 0x541E59: compRealizeWindow (compwindow.c:268)
    by 0x57DA40: RealizeTree (window.c:2617)
    by 0x580B28: MapWindow (window.c:2694)
    by 0x54EA2A: ProcMapWindow (dispatch.c:845)
    by 0x554B7D: Dispatch (dispatch.c:479)
    by 0x558BE5: dix_main (main.c:276)
    by 0x7C4B1BA: (below main) (libc-start.c:308)

This is because UnrealizeTree() traverses the tree from top to bottom,
which invalidates the assumption that if the Window doesn't feature an
xwl_window on its own, it's the xwl_window of its first ancestor with
one.

This reverts commit 82df2ce3

Reviewed-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
 		2018-04-18 10:47:15 -04:00
..
.gitignore glamor: Implement PixmapFromBuffers and BuffersFromPixmap 2018-03-05 13:27:49 -05:00
Makefile.am xwayland: Fix build without glamor 2018-04-16 12:06:51 -04:00
drm.xml wayland: Sync drm.xml with Mesa 2017-07-05 10:13:04 -04:00
meson.build xwayland: Fix build without glamor 2018-04-16 12:06:51 -04:00
xwayland-cursor.c xwayland: Fix non-argb cursor conversion 2017-12-06 10:15:57 -05:00
xwayland-cvt.c xwayland: Add hack for FWXGA resolution #99574 2017-02-08 12:32:16 -05:00
xwayland-glamor-xv.c xwayland: use the lowercase xnf.*alloc API 2017-09-06 08:56:39 +10:00
xwayland-glamor.c xwayland: zero num_formats from the start 2018-04-10 15:42:40 -04:00
xwayland-input.c xwayland: avoid using freed xwl_window on unrealize 2018-04-18 10:47:15 -04:00
xwayland-output.c xwayland: Fix backwards need_rotate logic (v2) 2018-02-20 13:17:08 -05:00
xwayland-present.c xwayland: avoid using freed xwl_window on unrealize 2018-04-18 10:47:15 -04:00
xwayland-shm.c xserver: Check the right HAVE_*_CONFIG_H. 2017-03-23 13:17:39 -04:00
xwayland-vidmode.c xwayland: Pretend we support viewport in vidmode 2016-03-28 14:10:59 -04:00
xwayland.c xwayland: avoid using freed xwl_window on unrealize 2018-04-18 10:47:15 -04:00
xwayland.h xwayland: avoid using freed xwl_window on unrealize 2018-04-18 10:47:15 -04:00