libX11: Changes to 'master'

Jamey Sharp jamey at kemper.freedesktop.org
Fri Aug 6 16:03:04 PDT 2010


 src/xcb_io.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

New commits:
commit 4b8ff7db39f2fe7ef12968d462aaf3f9054b6c18
Author: Jamey Sharp <jamey at minilop.net>
Date:   Fri Aug 6 15:51:56 2010 -0700

    Fix use-after-free in _XReply on X errors.
    
    _XReply would always call dequeue_pending_request on errors.  When it
    got an error for the current request, it would call dequeue, then break
    out of the loop; then, if it had an error in the event queue, it would
    compare it with the sequence number of the now-freed pending request.
    _XReply already stored that sequence number in dpy->last_request_read
    before freeing it, so look at that instead.
    
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=29412
    
    Signed-off-by: Jamey Sharp <jamey at minilop.net>
    Signed-off-by: Josh Triplett <josh at joshtriplett.org>



More information about the xorg-commit mailing list