<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - x11-libs/libxcb media-libs/mesa segfault in __glXGetString"
href="https://bugs.freedesktop.org/show_bug.cgi?id=57372">57372</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>mesa-dev@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>x11-libs/libxcb media-libs/mesa segfault in __glXGetString
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Reporter</th>
<td>rich0@gentoo.org
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86-64 (AMD64)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>9.0
</td>
</tr>
<tr>
<th>Component</th>
<td>GLX
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=70371" name="attach_70371" title="backtrace">attachment 70371</a> <a href="attachment.cgi?id=70371&action=edit" title="backtrace">[details]</a></span>
backtrace
Downstream bug:
<a href="https://bugs.gentoo.org/show_bug.cgi?id=444159">https://bugs.gentoo.org/show_bug.cgi?id=444159</a>
I'm getting a segfault in libxcb, which seems to be the result of calling
xcb_glx_get_string_string_length with a null parameter in __glXGetString. The
call into mesa originates in qt-opengl, called from the application sleepyhead.
Full backtrace attached - happy to generate additional info as required.
I couldn't find documentation concerning error handling in these functions, so
I'm not sure what point in the call chain is considered at-fault for passing
along bad input. I did note that __glXGetString does not check the value of
reply before passing it along, which might or might not be intended.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>