From c49c150dcfb715b989f5c182f4b5a999986afe60 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Fri, 17 Apr 2026 12:04:24 +1000 Subject: [PATCH] Xext/shm: add missing reply byte-swap in ProcShmCreateSegment ProcShmCreateSegment() sent the xShmCreateSegmentReply to the client without byte-swapping the sequenceNumber field for byte-swapped clients. Every other SHM Proc function that sends a reply (ProcShmQueryVersion, ProcShmGetImage) correctly swaps the reply fields. The sequenceNumber is a CARD16 that Xlib/XCB uses to match replies to their corresponding requests. With a garbled sequence number, the client library will mismatch the reply with the wrong request, causing the client to hang waiting for the real reply, process stale data from a different request's reply, or crash due to unexpected reply format. Fix by adding byte-swap of sequenceNumber and length before WriteToClient, consistent with the other SHM reply handlers. Co-Authored-by: Claude Code Part-of: --- Xext/shm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Xext/shm.c b/Xext/shm.c index 261408cde..65be95526 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -1326,6 +1326,10 @@ ProcShmCreateSegment(ClientPtr client) close(fd); return BadAlloc; } + if (client->swapped) { + swaps(&rep.sequenceNumber); + swapl(&rep.length); + } WriteToClient(client, sizeof (xShmCreateSegmentReply), &rep); return Success; }