libX11: Changes to 'master'
Jamey Sharp
jamey at kemper.freedesktop.org
Fri Aug 6 16:03:04 PDT 2010
src/xcb_io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
New commits:
commit 4b8ff7db39f2fe7ef12968d462aaf3f9054b6c18
Author: Jamey Sharp <jamey at minilop.net>
Date: Fri Aug 6 15:51:56 2010 -0700
Fix use-after-free in _XReply on X errors.
_XReply would always call dequeue_pending_request on errors. When it
got an error for the current request, it would call dequeue, then break
out of the loop; then, if it had an error in the event queue, it would
compare it with the sequence number of the now-freed pending request.
_XReply already stored that sequence number in dpy->last_request_read
before freeing it, so look at that instead.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=29412
Signed-off-by: Jamey Sharp <jamey at minilop.net>
Signed-off-by: Josh Triplett <josh at joshtriplett.org>
More information about the xorg-commit
mailing list