Bug 99946

Summary:	xcb_send_event() reads beyond end of argument / is hard to use correctly
Product:	XCB	Reporter:	Uli Schlachter <psychon>
Component:	Library	Assignee:	xcb mailing list dummy <xcb>
Status:	RESOLVED MOVED	QA Contact:	xcb mailing list dummy <xcb>
Severity:	normal
Priority:	medium
Version:	unspecified
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Uli Schlachter 2017-02-24 17:42:22 UTC

https://bugreports.qt.io/browse/QTBUG-56518 is about valgrind warnings that occur in Qt. The code in question does basically:

    xcb_unmap_notify_event_t event;
    set all fields of event;
    xcb_send_event(c, false, root, mask, &event);

The problem here is that sizeof(event) is 16 while xcb_send_event() expects 32 bytes of event data. So the argument needs to be "something bigger". This is quite unintuitive and it seems like everyone using xcb_send_event() is getting this wrong. (I would claim that I know may way around XCB and I did not know this!)

Can there be a version of xcb_send_event() which gets a length argument? Are there any other ideas on how this could be made safer or more obvious?

Comment 1 Josh Triplett 2017-02-24 19:02:51 UTC

Events always have exactly 32 bytes on the wire; they don't have length fields.  I think the specification of the existing xcb_send_event assumed that all event senders would provide 32 bytes to avoid copies.  However, I'd agree that that makes it harder to use, and more importantly much easier to misuse.

A hypothetical xcb_send_event with a length could avoid copies by using writev and having a fixed-size 32-byte array of padding to use as varying amounts of as the other half.

Comment 2 GitLab Migration User 2019-02-16 19:41:00 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/lib/libxcb/issues/18.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.