Created attachment 44181 [details]
GDB session

First reported in Debian bug #616667 by Ian Jackson:
  http://bugs.debian.org/616667

Steps to reproduce:
$ touch foo && xauth -f foo generate $DISPLAY . untrusted timeout 1000000000

Prerequisite: X Server built with --enable-xcsecurity, reproduced with 1.7, 1.9, and 1.10.

Gdb session attached.

Bottom line:
 1. int overflow in os/WaitFor.c for big timeouts.
 2. AFAICT, wrong comparison between unsigned int:

(int) (a-b) will be negative with e.g. a=INT_MAX*4/5; b=INT_MAX*1/5, which is wrong.

The assert happens in SecurityAuthorizationExpired because the Timer is only going to be set on/attached to “pAuth” once TimerSet returns, so calling the callback from within TimerSet can only fail.

[If that's a supposedly-supported codepath, the assert should probably become: assert((pAuth->timer == NULL) || …);
but I don't think that should happen at all.
]

Patches will follow on xorg-devel@ in a few minutes.