Bug 23690

Summary:

Return value from xcb_generate_id() not checked

Product:

xorg

Reporter:

Alexey Feldgendler <alexey>

Component:

Lib/Xlib

Assignee:

Jamey Sharp <jamey>

Status:

RESOLVED MOVED

QA Contact:

Xorg Project Team <xorg-team>

Severity:

normal

Priority:

medium

CC:

jeremyhu, peter.hutterer, tiago.vignatti, xcb

Version:

7.3 (2007.09)

Hardware:

x86-64 (AMD64)

OS:

Linux (All)

Whiteboard:

2011BRB_Reviewed

i915 platform:

i915 features:

Attachments:

Description	Flags
0001-_XAllocID-don-t-assert-when-running-out-of-IDs-23690.patch	none

Description Alexey Feldgendler 2009-09-03 09:10:35 UTC

xcb_generate_id() returns -1 (well, ~0) under some error conditions. However, _XIDHandler() in Xlib doesn't check for it, and if this value is returned, it's saved in dpy->xcb->next_xid and causes an assertion failure in _XAllocID() at a later point.

This is my guess as to what happened here: https://bugs.kde.org/show_bug.cgi?id=192468 -- I mean, it's the only concievable codepath leading to that assertion being triggered.

The return value from xcb_generate_id() should be checked, and errors should be handled gracefully.

Comment 1 Peter Hutterer 2009-09-03 16:43:19 UTC

Created attachment 29195 [details] [review]
0001-_XAllocID-don-t-assert-when-running-out-of-IDs-23690.patch

Just removing the assert seems to trigger the BadIDChoice error in the server. The client can then handle these gracefully.

Patch sent to Jamey for review, there may be some hidden details.

Comment 2 Jeremy Huddleston Sequoia 2011-10-08 19:48:52 UTC

Looking through libX11's git log, I don't see this.  What's the status of it?

Comment 3 Adam Jackson 2011-12-16 12:55:44 UTC

BadIDChoice isn't something the client is expected to handle gracefully.  Or even capable of handling gracefully, for that matter; XID choice is xlib's job.

The paths through which xcb_generate_id can return -1 are, afaict, exactly those paths that are fatal: either the socket is already in an error condition, or the server doesn't support XC-MISC, or the server thinks the client is literally out of XIDs.  It might be interesting to see which of these it is.

Comment 4 GitLab Migration User 2018-08-10 20:09:23 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/lib/libx11/issues/7.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.