[Mesa-dev] [Bug 54372] New: GLX_INTEL_swap_event crashes driver when swapping window buffers

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=54372

             Bug #: 54372
           Summary: GLX_INTEL_swap_event crashes driver when swapping
                    window buffers
    Classification: Unclassified
           Product: Mesa
           Version: 8.0
          Platform: x86-64 (AMD64)
        OS/Version: Linux (All)
            Status: NEW
          Severity: normal
          Priority: medium
         Component: GLX
        AssignedTo: mesa-dev at lists.freedesktop.org
        ReportedBy: danmanj at gmail.com


Hi, I sent this to debian's BTS, they told me to send it to mesa-dev, and
mesa-dev ignored it, so I'm sending it to your BTS as well.

Have great day!


Package: libgl1-mesa-glx
Version: 8.0.4-1
Severity: important
Tags: patch, upstream

Dear Maintainer,
When enabling GLX_INTEL_swap_event for windows:
in the file src/glx/dri2.c:
DRI2WireToEvent assumes the event it is generating is asociated with a
GLXPixmap, and tries to look up the pixmap in the glxDrawHash hash
table, but as the buffer swap is for a _WINDOW_ not a pixmap the result
is NULL. DRI2WireToEvent then dereferences the null pointer, and SEGVs.

The attached patch handles this situation gracefully.

diff --git b/src/glx/dri2.c a/src/glx/dri2.c
index b1b5013..2cbe968 100644
--- b/src/glx/dri2.c
+++ a/src/glx/dri2.c
@@ -130,10 +130,17 @@ DRI2WireToEvent(Display *dpy, XEvent *event, xEvent
*wire)
         aevent->msc = ((CARD64)awire->msc_hi<<  32) | awire->msc_lo;

         glxDraw = GetGLXDrawable(dpy, pdraw->drawable);
-      if (awire->sbc<  glxDraw->lastEventSbc)
-        glxDraw->eventSbcWrap += 0x100000000;
-      glxDraw->lastEventSbc = awire->sbc;
-      aevent->sbc = awire->sbc + glxDraw->eventSbcWrap;
+      if(glxDraw)
+      {
+         if (awire->sbc<  glxDraw->lastEventSbc)
+           glxDraw->eventSbcWrap += 0x100000000;
+         glxDraw->lastEventSbc = awire->sbc;
+         aevent->sbc = awire->sbc + glxDraw->eventSbcWrap;
+      }
+      else
+      {
+         aevent->sbc = awire->sbc;
+      }

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.