From 2bcf09ff895b9a8786cc63acef499002a97143d5 Mon Sep 17 00:00:00 2001
From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Fri, 17 Jul 2015 10:59:01 +0100
Subject: [PATCH] os: Fix upper bound for looping over fd_set.fd_mask[]

When x11proto was seemingly changed to allow for more file descriptors
(and more Clients) by increasing XFD_SETSIZE in

commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7
Author: Olivier Fourdan <ofourdan@redhat.com>
Date:   Fri May 29 18:16:34 2015 +0200

    Increase the number of file descriptors

    To allow up to 512 clients, the number of file descriptors being
    monitored need to be increased accordingly.

the actual fd_set.fd_mask[] was not increased as that is defined in
terms of FD_SETSIZE and is used by all iterators inside Xpoll.h.

X however does iterate over XFD_SETSIZE instead. The result being that
we increased the upper bound without increasing the array size with the
result we were reading garbage and subsequently crashing.

Reported-by: Karol Herbst <freedesktop@karolherbst.de>
Reported-by: Tobias Klausmann <tobias.klausmann@mni.thm.de>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316
Cc: Ilia Mirkin  <imirkin@alum.mit.edu>
Cc: Martin Peres <martin.peres@linux.intel.com>
Cc: Olivier Fourdan <ofourdan@redhat.com
Cc: Adam Jackson <ajax@redhat.com>
Cc: Alan Coopersmith <alan.coopersmith@oracle.com
---
 os/WaitFor.c    |    2 +-
 os/connection.c |    4 ++--
 os/io.c         |    2 +-
 os/osdep.h      |    4 ++++
 4 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/os/WaitFor.c b/os/WaitFor.c
index 7137ee0..7b75615 100644
--- a/os/WaitFor.c
+++ b/os/WaitFor.c
@@ -323,7 +323,7 @@ WaitForSomething(int *pClientsReady)
     nready = 0;
     if (XFD_ANYSET(&clientsReadable)) {
 #ifndef WIN32
-        for (i = 0; i < howmany(XFD_SETSIZE, NFDBITS); i++) {
+        for (i = 0; i < XFD_WORDS(&clientsReadable); i++) {
             int highest_priority = 0;
 
             while (clientsReadable.fds_bits[i]) {
diff --git a/os/connection.c b/os/connection.c
index c36b125..ea3154d 100644
--- a/os/connection.c
+++ b/os/connection.c
@@ -834,7 +834,7 @@ EstablishNewConnections(ClientPtr clientUnused, void *closure)
         }
     }
 #ifndef WIN32
-    for (i = 0; i < howmany(XFD_SETSIZE, NFDBITS); i++) {
+    for (i = 0; i < XFD_WORDS(&readyconnections); i++) {
         while (readyconnections.fds_bits[i])
 #else
     for (i = 0; i < XFD_SETCOUNT(&readyconnections); i++)
@@ -1002,7 +1002,7 @@ CheckConnections(void)
     notime.tv_usec = 0;
 
 #ifndef WIN32
-    for (i = 0; i < howmany(XFD_SETSIZE, NFDBITS); i++) {
+    for (i = 0; i < XFD_WORDS(&AllClients); i++) {
         mask = AllClients.fds_bits[i];
         while (mask) {
             curoff = mffs(mask) - 1;
diff --git a/os/io.c b/os/io.c
index c8e5058..334b519 100644
--- a/os/io.c
+++ b/os/io.c
@@ -662,7 +662,7 @@ FlushAllOutput(void)
     NewOutputPending = FALSE;
 
 #ifndef WIN32
-    for (base = 0; base < howmany(XFD_SETSIZE, NFDBITS); base++) {
+    for (base = 0; base < XFD_WORDS(&OutputPending); base++) {
         mask = OutputPending.fds_bits[base];
         OutputPending.fds_bits[base] = 0;
         while (mask) {
diff --git a/os/osdep.h b/os/osdep.h
index 77a5b53..15a2875 100644
--- a/os/osdep.h
+++ b/os/osdep.h
@@ -98,6 +98,10 @@ SOFTWARE.
 /* MAXSELECT is the number of fds that select() can handle */
 #define MAXSELECT (sizeof(fd_set) * NBBY)
 
+#ifndef XFD_WORDS
+#define XFD_WORDS(set) (sizeof(__FDS_BITS(set))/sizeof(__FDS_BITS(set)[0]))
+#endif
+
 #include <stddef.h>
 
 #if defined(XDMCP) || defined(HASXDMAUTH)
-- 
1.7.10.4