fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-05-09 15:28:08 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Xext/shm: add missing reply byte-swap in ProcShmCreateSegment

Browse source 
ProcShmCreateSegment() sent the xShmCreateSegmentReply to the client
without byte-swapping the sequenceNumber field for byte-swapped clients.
Every other SHM Proc function that sends a reply (ProcShmQueryVersion,
ProcShmGetImage) correctly swaps the reply fields.

The sequenceNumber is a CARD16 that Xlib/XCB uses to match replies to
their corresponding requests. With a garbled sequence number, the client
library will mismatch the reply with the wrong request, causing the
client to hang waiting for the real reply, process stale data from a
different request's reply, or crash due to unexpected reply format.

Fix by adding byte-swap of sequenceNumber and length before
WriteToClient, consistent with the other SHM reply handlers.

Co-Authored-by: Claude Code <noreply@anthropic.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2181>
This commit is contained in:
Peter Hutterer 2026-04-17 12:04:24 +10:00 • committed by Marge Bot
parent 598994a856
commit c49c150dcf
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Xext/shm.c
View file

@ -1326,6 +1326,10 @@ ProcShmCreateSegment(ClientPtr client)
close(fd);
return BadAlloc;
}
if (client->swapped) {
swaps(&rep.sequenceNumber);
swapl(&rep.length);
}
WriteToClient(client, sizeof (xShmCreateSegmentReply), &rep);
return Success;
}