fdo-mirrors/xorg-libx11
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/lib/libx11.git synced 2026-05-01 06:48:01 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Protect colormap add/removal with display lock

Browse source 
This fixes a bug where concurrent threads call XCreateColormap and
XFreeColormap corrupting a linked list where colormap structures
are stored.

Fixes: https://gitlab.freedesktop.org/xorg/lib/libx11/issues/94

v2: handle XCopyColormapAndFree also (Adam Jackson)

Signed-off-by: Tapani Pälli <tapani.palli@intel.com>
This commit is contained in:
Tapani Pälli 2019-05-13 08:29:49 +03:00
parent fea80d03c3
commit 99a2cf1aa0
3 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/CopyCmap.c
View file

@ -53,12 +53,12 @@ Colormap XCopyColormapAndFree(
mid = req->mid = XAllocID(dpy); mid = req->mid = XAllocID(dpy);
req->srcCmap = src_cmap; req->srcCmap = src_cmap;
UnlockDisplay(dpy);
SyncHandle();
#if XCMS #if XCMS
_XcmsCopyCmapRecAndFree(dpy, src_cmap, mid); _XcmsCopyCmapRecAndFree(dpy, src_cmap, mid);
#endif #endif
UnlockDisplay(dpy);
SyncHandle();
return(mid); return(mid);
} }

6
src/CrCmap.c
View file

@ -48,12 +48,12 @@ Colormap XCreateColormap(
if (visual == CopyFromParent) req->visual = CopyFromParent; if (visual == CopyFromParent) req->visual = CopyFromParent;
else req->visual = visual->visualid; else req->visual = visual->visualid;
UnlockDisplay(dpy);
SyncHandle();
#ifdef XCMS #ifdef XCMS
_XcmsAddCmapRec(dpy, mid, w, visual); _XcmsAddCmapRec(dpy, mid, w, visual);
#endif #endif
UnlockDisplay(dpy);
SyncHandle();
return(mid); return(mid);
} }

6
src/FreeCmap.c
View file

@ -41,12 +41,12 @@ XFreeColormap(
LockDisplay(dpy); LockDisplay(dpy);
GetResReq(FreeColormap, cmap, req); GetResReq(FreeColormap, cmap, req);
UnlockDisplay(dpy);
SyncHandle();
#ifdef XCMS #ifdef XCMS
_XcmsDeleteCmapRec(dpy, cmap); _XcmsDeleteCmapRec(dpy, cmap);
#endif #endif
UnlockDisplay(dpy);
SyncHandle();
return 1; return 1;
} }