[Xcb] [Bug 29412] [regression] unexpected libX11 IOError

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=29412

--- Comment #5 from Josh Triplett <josh at freedesktop.org> 2010-08-06 16:04:29 PDT ---
Thanks for the test case.  Jamey and I reproduced this problem on Linux via
valgrind, which does indeed show a use-after-free.  We've fixed this in current
git, commit 4b8ff7db39f2fe7ef12968d462aaf3f9054b6c18:

    Fix use-after-free in _XReply on X errors.

    _XReply would always call dequeue_pending_request on errors.  When it
    got an error for the current request, it would call dequeue, then break
    out of the loop; then, if it had an error in the event queue, it would
    compare it with the sequence number of the now-freed pending request.
    _XReply already stored that sequence number in dpy->last_request_read
    before freeing it, so look at that instead.

    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=29412

    Signed-off-by: Jamey Sharp <jamey at minilop.net>
    Signed-off-by: Josh Triplett <josh at joshtriplett.org>

-- 
Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.