Bug 99946 - xcb_send_event() reads beyond end of argument / is hard to use correctly
Summary: xcb_send_event() reads beyond end of argument / is hard to use correctly
Status: RESOLVED MOVED
Alias: None
Product: XCB
Classification: Unclassified
Component: Library (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: xcb mailing list dummy
QA Contact: xcb mailing list dummy
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-02-24 17:42 UTC by Uli Schlachter
Modified: 2019-02-16 19:41 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Uli Schlachter 2017-02-24 17:42:22 UTC
https://bugreports.qt.io/browse/QTBUG-56518 is about valgrind warnings that occur in Qt. The code in question does basically:

    xcb_unmap_notify_event_t event;
    set all fields of event;
    xcb_send_event(c, false, root, mask, &event);

The problem here is that sizeof(event) is 16 while xcb_send_event() expects 32 bytes of event data. So the argument needs to be "something bigger". This is quite unintuitive and it seems like everyone using xcb_send_event() is getting this wrong. (I would claim that I know may way around XCB and I did not know this!)

Can there be a version of xcb_send_event() which gets a length argument? Are there any other ideas on how this could be made safer or more obvious?
Comment 1 Josh Triplett 2017-02-24 19:02:51 UTC
Events always have exactly 32 bytes on the wire; they don't have length fields.  I think the specification of the existing xcb_send_event assumed that all event senders would provide 32 bytes to avoid copies.  However, I'd agree that that makes it harder to use, and more importantly much easier to misuse.

A hypothetical xcb_send_event with a length could avoid copies by using writev and having a fixed-size 32-byte array of padding to use as varying amounts of as the other half.
Comment 2 GitLab Migration User 2019-02-16 19:41:00 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/xorg/lib/libxcb/issues/18.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.