Bug 23690 - Return value from xcb_generate_id() not checked
Summary: Return value from xcb_generate_id() not checked
Status: RESOLVED MOVED
Alias: None
Product: xorg
Classification: Unclassified
Component: Lib/Xlib (show other bugs)
Version: 7.3 (2007.09)
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Jamey Sharp
QA Contact: Xorg Project Team
URL:
Whiteboard: 2011BRB_Reviewed
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-03 09:10 UTC by Alexey Feldgendler
Modified: 2018-08-10 20:09 UTC (History)
4 users (show)

See Also:
i915 platform:
i915 features:


Attachments
0001-_XAllocID-don-t-assert-when-running-out-of-IDs-23690.patch (1.04 KB, patch)
2009-09-03 16:43 UTC, Peter Hutterer
no flags Details | Splinter Review

Description Alexey Feldgendler 2009-09-03 09:10:35 UTC
xcb_generate_id() returns -1 (well, ~0) under some error conditions. However, _XIDHandler() in Xlib doesn't check for it, and if this value is returned, it's saved in dpy->xcb->next_xid and causes an assertion failure in _XAllocID() at a later point.

This is my guess as to what happened here: https://bugs.kde.org/show_bug.cgi?id=192468 -- I mean, it's the only concievable codepath leading to that assertion being triggered.

The return value from xcb_generate_id() should be checked, and errors should be handled gracefully.
Comment 1 Peter Hutterer 2009-09-03 16:43:19 UTC
Created attachment 29195 [details] [review]
0001-_XAllocID-don-t-assert-when-running-out-of-IDs-23690.patch

Just removing the assert seems to trigger the BadIDChoice error in the server. The client can then handle these gracefully.

Patch sent to Jamey for review, there may be some hidden details.
Comment 2 Jeremy Huddleston Sequoia 2011-10-08 19:48:52 UTC
Looking through libX11's git log, I don't see this.  What's the status of it?
Comment 3 Adam Jackson 2011-12-16 12:55:44 UTC
BadIDChoice isn't something the client is expected to handle gracefully.  Or even capable of handling gracefully, for that matter; XID choice is xlib's job.

The paths through which xcb_generate_id can return -1 are, afaict, exactly those paths that are fatal: either the socket is already in an error condition, or the server doesn't support XC-MISC, or the server thinks the client is literally out of XIDs.  It might be interesting to see which of these it is.
Comment 4 GitLab Migration User 2018-08-10 20:09:23 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/lib/libx11/issues/7.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.