[PATCH xts 1/2] xts5/XI: Fix SEGV when double-freeing Display

Peter Harris pharris at opentext.com
Wed Jun 5 16:33:30 PDT 2013


Only XOpenDisplay pairs with XCloseDisplay. The Display pointer returned
by opendisplay is self-closing.

Signed-off-by: Peter Harris <pharris at opentext.com>
---

XCloseDisplay was formatted with spaces instead of tabs, which implies that
it was added later. But the change was pre-git, so I have no way of knowing
if XOpenDisplay was changed to opendisplay after that change, or what.

 xts5/XI/CloseDevice.m           |    4 ----
 xts5/XI/GrabDevice.m            |    4 ----
 xts5/XI/GrabDeviceButton.m      |   10 ----------
 xts5/XI/SendExtensionEvent.m    |    5 +++--
 xts5/XI/XSelectExtensionEvent.m |   12 +-----------
 5 files changed, 4 insertions(+), 31 deletions(-)

diff --git a/xts5/XI/CloseDevice.m b/xts5/XI/CloseDevice.m
index c1bc64c..0646630 100644
--- a/xts5/XI/CloseDevice.m
+++ b/xts5/XI/CloseDevice.m
@@ -180,7 +180,6 @@ XDevice *dev2;
 	CHECKPASS(3);
         XUngrabDevice(client1, dev2, CurrentTime);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 	Close_Extension_Display();
 
 >>ASSERTION Good B 3
@@ -239,7 +238,6 @@ int Min_KeyCode, Max_KeyCode, numkeys;
 	CHECKPASS(3);
         XUngrabDevice(client1, dev2, CurrentTime);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 	Close_Extension_Display();
 
 >>ASSERTION Good B 3
@@ -323,7 +321,6 @@ int Min_KeyCode, Max_KeyCode, numkeys;
 	CHECKPASS(count+4);
         XUngrabDevice(client1, dev2, CurrentTime);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 	Close_Extension_Display();
 
 
@@ -388,7 +385,6 @@ int Min_KeyCode, Max_KeyCode, numkeys;
 	    }
 	devicerelkeys(dev2);
 	CHECKPASS(6);
-        XCloseDisplay(client1);
 	Close_Extension_Display();
 
 >>ASSERTION Bad B 3
diff --git a/xts5/XI/GrabDevice.m b/xts5/XI/GrabDevice.m
index 9f6bf17..0b23254 100644
--- a/xts5/XI/GrabDevice.m
+++ b/xts5/XI/GrabDevice.m
@@ -500,7 +500,6 @@ XEventClass dmnc;
 
 	/* Clear any extra events */
 	XSync(client2, True);
-        XCloseDisplay(client2);
 
 >>ASSERTION Bad B 3
 When the
@@ -572,8 +571,6 @@ int 	ret;
 		FAIL;
 	}
 
-        XCloseDisplay(client1);
-        XCloseDisplay(client2);
 	CHECKPASS(1);
 >>ASSERTION Bad B 3
 When the device is frozen by an active grab of another client, then
@@ -613,7 +610,6 @@ int 	ret;
 	}
 
 	XUngrabKeyboard (display, CurrentTime);
-        XCloseDisplay(client2);
 	CHECKPASS(1);
 >>ASSERTION Bad B 3
 When the specified time is earlier than the last-device-grab time or later
diff --git a/xts5/XI/GrabDeviceButton.m b/xts5/XI/GrabDeviceButton.m
index 511122c..c43165c 100644
--- a/xts5/XI/GrabDeviceButton.m
+++ b/xts5/XI/GrabDeviceButton.m
@@ -161,7 +161,6 @@ Display *client1;
 	devicebuttonrel (display, Devs.Button, Button1);
 	devicerelbuttons (Devs.Button);
 	XUngrabDeviceButton(display, device, AnyButton, AnyModifier, modifier_device, grab_window);
-	XCloseDisplay(client1);
 
 >>ASSERTION Good B 3
 When the conditions for activating the grab are otherwise satisfied
@@ -223,7 +222,6 @@ Display *client1;
 	XUngrabDeviceButton(display, device, AnyButton, AnyModifier, modifier_device, grab_window);
         XSync(display, 0);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 	CHECKPASS(3);
 
 >>ASSERTION Good B 3
@@ -326,7 +324,6 @@ Display *client1;
 	XUngrabDeviceButton(display, device, AnyButton, AnyModifier, modifier_device, grab_window);
         XUngrabDevice(client1, Devs.Button, CurrentTime);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 	CHECKPASS(3);
 
 >>ASSERTION Good B 3
@@ -460,7 +457,6 @@ Display *client1;
 	XUngrabDeviceButton(display, device, AnyButton, AnyModifier, modifier_device, grab_window);
         XUngrabDevice (client1, Devs.Button, CurrentTime);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 
 >>ASSERTION Good B 3
 A call to xname overrides all previous passive grabs by the same
@@ -622,7 +618,6 @@ Display *client1;
 	devicerelbuttons (Devs.Button);
 	relalldev();
 	XUngrabDeviceButton(display, device, AnyButton, AnyModifier, modifier_device, grab_window);
-        XCloseDisplay(client1);
 
 >>ASSERTION Good B 3
 When the
@@ -697,7 +692,6 @@ XAnyClassPtr any;
 	    devicebuttonrel (display, Devs.Button, i);
 	    }
 	devicerelbuttons (Devs.Button);
-        XCloseDisplay(client1);
 	CHECKPASS(count);
 
 >>ASSERTION Good B 3
@@ -755,7 +749,6 @@ Display *client1;
 	XUngrabDeviceButton(display, device, AnyButton, AnyModifier, modifier_device, grab_window);
         XUngrabDevice(client1, Devs.Button, CurrentTime);
         XSync(client1, 0);
-        XCloseDisplay(client1);
 	CHECKPASS(2);
 
 >>ASSERTION Good B 3
@@ -813,7 +806,6 @@ int ret;
 		NULL, grab_window);
         XUngrabDevice(client1, Devs.Button, CurrentTime);
         XSync(client1,0);
-        XCloseDisplay(client1);
 	CHECKPASS(2);
 
 >>ASSERTION Good B 3
@@ -882,7 +874,6 @@ Display *client1;
 	relalldev();
         XUngrabDevice(client1, Devs.Button, CurrentTime);
         XSync(client1,0);
-        XCloseDisplay(client1);
 	CHECKPASS(2);
 
 >>ASSERTION Bad B 3
@@ -1026,7 +1017,6 @@ Display	*client1;
 		FAIL;
         XUngrabDevice(Dsp, Devs.Button, CurrentTime);
         XSync(Dsp,0);
-        XCloseDisplay(client1);
 >>ASSERTION Bad B 3
 When a call to xname is made specifying an invalid window,
 a BadWindow error will result.
diff --git a/xts5/XI/SendExtensionEvent.m b/xts5/XI/SendExtensionEvent.m
index 2a13d8e..0db5c05 100644
--- a/xts5/XI/SendExtensionEvent.m
+++ b/xts5/XI/SendExtensionEvent.m
@@ -587,7 +587,7 @@ Call XSendExtensionEvent to send event to window.
 Verify that XSendExtensionEvent returned non-zero.
 Verify that no events were received.
 >>CODE
-Display	*client2;
+Display	*client2 = NULL;
 int	return_value;
 int dbp;
 XEventClass dbpc, noextensioneventclass;
@@ -606,7 +606,8 @@ XEventClass dbpc, noextensioneventclass;
 	   deallocation of closed connections and deleted resources. */
 	regdisable(); 
 
-	client2 = opendisplay();
+	if (config.display)
+		client2 = XOpenDisplay(config.display);
 	if (client2 == (Display *) NULL) {
 		delete("Can not open display");
 		regenable();
diff --git a/xts5/XI/XSelectExtensionEvent.m b/xts5/XI/XSelectExtensionEvent.m
index 253d54e..7f07cf8 100644
--- a/xts5/XI/XSelectExtensionEvent.m
+++ b/xts5/XI/XSelectExtensionEvent.m
@@ -112,8 +112,6 @@ Display *fdisplay, *client1;
 void xi_cleanup()
 {
       cleanup();
-      if (client1)
-        XCloseDisplay(client1);
       client1 = NULL;
 }
  
@@ -247,7 +245,6 @@ int	type;
 
         XSync(client1, 0);
         XSync(client2, 0);
-        XCloseDisplay(client2);
 	CHECKPASS(5);
 >>ASSERTION Good B 3
 A call to xname
@@ -277,11 +274,7 @@ XEventClass noextensionevent, devicefocusin;
 
 /* Create window with no events selected. */
 	getfocusdevice();
-        if (client1)
-	{
-            XCloseDisplay(client1);
-            client1 = NULL;
-	}
+	client1 = NULL;
 	if (!focusdevice) {
 	    report("%s: Required input devices not present\n",TestName);
 	    UNTESTED;
@@ -528,7 +521,6 @@ int dkp, tmp;
 	else
 		CHECK;
 
-        XCloseDisplay(client2);
 	CHECKPASS(12);
 >>ASSERTION Good A
 When multiple clients make a call to xname
@@ -632,7 +624,6 @@ int dkp;
 		CHECK;
 
 	devicerelkeys(Devs.Key);
-        XCloseDisplay(client2);
 	CHECKPASS(6);
 
 >>ASSERTION Good B 3
@@ -1376,7 +1367,6 @@ XEventClass dbpgclass;
 	else
 		CHECK;
 
-        XCloseDisplay(client2);
 	CHECKPASS(3);
 >>ASSERTION Bad B 3
 A call to xname specifying an invalid eventclass results in a BadClass
-- 
1.7.10.4



More information about the xorg-devel mailing list