Bug 21861

Summary: server crash on possibly malformed xrandr request
Product: xorg Reporter: Bart Massey <x>
Component: Server/GeneralAssignee: Julien Cristau <jcristau>
Status: RESOLVED FIXED QA Contact: Xorg Project Team <xorg-team>
Severity: normal    
Priority: medium CC: dottedmag, marien.zwart
Version: unspecified   
Hardware: x86-64 (AMD64)   
OS: Linux (All)   
Whiteboard:
i915 platform: i915 features:
Attachments:
Description Flags
log file from server crash
none
test case for server crash
none
proposed patch none

Description Bart Massey 2009-05-22 00:00:10 UTC
Created attachment 26086 [details]
log file from server crash

The attached program submitted by a user as part of an XCB bug report will reliably crash my X server.  xdpyinfo reports xorg 1.5.99.1, and xrandr reports version 1.2.  My hardware is an Intel quad-core with a 965GM IIRC.  An Xorg.log is attached.
Comment 1 Bart Massey 2009-05-22 00:01:23 UTC
Created attachment 26087 [details]
test case for server crash
Comment 2 Julien Cristau 2009-05-22 01:06:35 UTC
Created attachment 26091 [details] [review]
proposed patch

The client calls RRQueryVersion with 0.0 as version.  That's all sorts of wrong, but we still shouldn't crash...
Comment 3 Julien Cristau 2009-05-22 17:04:41 UTC
*** Bug 21883 has been marked as a duplicate of this bug. ***
Comment 4 Julien Cristau 2009-05-24 04:15:52 UTC
bugzilla apparently didn't like my mail, so trying again from the web...

commit 12e725d08b4cf7dbb7f09b9ec09fa1b621156ea9
Author: Julien Cristau <jcristau@debian.org>
Date:   Fri May 22 09:54:38 2009 +0200

    randr: fix server crash in RRGetScreenInfo

    We don't return rates to randr < 1.1 clients, so don't allocate space
    for them.  This fixes a FatalError due to not all allocated space being
    used.

    X.Org bug#21861 <http://bugs.freedesktop.org/show_bug.cgi?id=21861>

    Reported-by: Guillaume Quintin <coincoin169g@gmail.com>
    Signed-off-by: Julien Cristau <jcristau@debian.org>
Comment 5 Julien Cristau 2009-06-16 05:45:43 UTC
*** Bug 22295 has been marked as a duplicate of this bug. ***

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.