1.17.2-4: add another patch to fix segfault introduced with previous release, related to latest xproto package

3 files changed, 72 insertions, 4 deletions

diff --git a/.SRCINFO b/.SRCINFO
index b7737b812dec..dadef6948ae2 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,6 +1,6 @@
 pkgbase = xorg-server-dev
 	pkgver = 1.17.2
-	pkgrel = 3
+	pkgrel = 4
 	url = http://xorg.freedesktop.org
 	arch = i686
 	arch = x86_64
@@ -61,6 +61,7 @@ pkgbase = xorg-server-dev
 	source = 0002-dix-hook-up-the-unaccelerated-valuator-masks.patch
 	source = 0001-systemd-logind-do-not-rely-on-directed-signals.patch
 	source = 0001-glamor-make-current-in-prepare-paths.patch
+	source = 0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch
 	sha256sums = f61120612728f2c5034671d0ca3e2273438c60aba93b3dda4a8aa40e6a257993
 	sha256sums = SKIP
 	sha256sums = af1c3d2ea5de7f6a6b5f7c60951a189a4749d1495e5462f3157ae7ac8fe1dc56
@@ -70,6 +71,7 @@ pkgbase = xorg-server-dev
 	sha256sums = 416a1422eed71efcebb1d893de74e7f27e408323a56c4df003db37f5673b3f96
 	sha256sums = 3d7edab3a54d647e7d924b29d29f91b50212f308fcb1853a5aacd3181f58276c
 	sha256sums = 793579adbef979088cadc0fd9ce0c24df0455a6936d3de7a9356df537b7d9a81
+	sha256sums = efc05c06af2bfdf588ef7a60b44c1d180fb353b1bffdfdf96415d63690b6e394
 
 pkgname = xorg-server-dev
 	pkgdesc = Xorg X server - Bleeding edge version
diff --git a/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch b/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch
new file mode 100644
index 000000000000..b3a7d2ed5e00
--- /dev/null
+++ b/0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch
@@ -0,0 +1,63 @@
+From 7cc7ffd25d5e50b54cb942d07d4cb160f20ff9c5 Mon Sep 17 00:00:00 2001
+From: Martin Peres <martin.peres@linux.intel.com>
+Date: Fri, 17 Jul 2015 17:21:26 +0300
+Subject: [PATCH] os: make sure the clientsWritable fd_set is initialized
+ before use
+
+In WaitForSomething(), the fd_set clientsWritable may be used unitialized when
+the boolean AnyClientsWriteBlocked is set in the WakeupHandler(). This leads to
+a crash in FlushAllOutput() after x11proto's commit
+2c94cdb453bc641246cc8b9a876da9799bee1ce7.
+
+The problem did not manifest before because both the XFD_SIZE and the maximum
+number of clients were set to 256. As the connectionTranslation table was
+initalized for the 256 clients to 0, the test on the index not being 0 was
+aborting before dereferencing the client #0.
+
+As of commit 2c94cdb453bc641246cc8b9a876da9799bee1ce7 in x11proto, the XFD_SIZE
+got bumped to 512. This lead the OutputPending fd_set to have any fd above 256
+to be uninitialized which in turns lead to reading an index after the end of
+the ConnectionTranslation table. This index would then be used to find the
+client corresponding to the fd marked as pending writes and would also result
+to an out-of-bound access which would usually be the fatal one.
+
+Fix this by zeroing the clientsWritable fd_set at the beginning of
+WaitForSomething(). In this case, the bottom part of the loop, which would
+indirectly call FlushAllOutput, will not do any work but the next call to
+select will result in the execution of the right codepath. This is exactly what
+we want because we need to know the writable clients before handling them. In
+the end, it also makes sure that the fds above MaxClient are initialized,
+preventing the crash in FlushAllOutput().
+
+Thanks to everyone involved in tracking this one down!
+
+Reported-by: Karol Herbst <freedesktop@karolherbst.de>
+Reported-by: Tobias Klausmann <tobias.klausmann@mni.thm.de>
+Signed-off-by: Martin Peres <martin.peres@linux.intel.com>
+Tested-by: Martin Peres <martin.peres@linux.intel.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=91316
+Cc: Ilia Mirkin  <imirkin@alum.mit.edu>
+Cc: Martin Peres <martin.peres@linux.intel.com>
+Cc: Olivier Fourdan <ofourdan@redhat.com
+Cc: Adam Jackson <ajax@redhat.com>
+Cc: Alan Coopersmith <alan.coopersmith@oracle.com
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+---
+ os/WaitFor.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/os/WaitFor.c b/os/WaitFor.c
+index 431f1a6..993c14e 100644
+--- a/os/WaitFor.c
++++ b/os/WaitFor.c
+@@ -158,6 +158,7 @@ WaitForSomething(int *pClientsReady)
+     Bool someReady = FALSE;
+ 
+     FD_ZERO(&clientsReadable);
++    FD_ZERO(&clientsWritable);
+ 
+     if (nready)
+         SmartScheduleStopTimer();
+-- 
+2.4.5
+
diff --git a/PKGBUILD b/PKGBUILD
index 348cd306e569..0a259b101849 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -4,7 +4,7 @@
 _pkgbase=xorg-server
 pkgname=('xorg-server-dev' 'xorg-server-xephyr-dev' 'xorg-server-xdmx-dev' 'xorg-server-xvfb-dev' 'xorg-server-xnest-dev' 'xorg-server-xwayland-dev' 'xorg-server-common-dev' 'xorg-server-devel-dev')
 pkgver=1.17.2  # http://lists.x.org/archives/xorg/2015-June/057436.html
-pkgrel=3
+pkgrel=4
 arch=('i686' 'x86_64')
 license=('custom')
 url="http://xorg.freedesktop.org"
@@ -22,7 +22,8 @@ source=(${url}/releases/individual/xserver/${_pkgbase}-${pkgver}.tar.bz2{,.sig}
         0001-dix-Add-unaccelerated-valuators-to-the-ValuatorMask.patch
         0002-dix-hook-up-the-unaccelerated-valuator-masks.patch
         0001-systemd-logind-do-not-rely-on-directed-signals.patch
-        0001-glamor-make-current-in-prepare-paths.patch)
+        0001-glamor-make-current-in-prepare-paths.patch
+        0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch)
 validpgpkeys=('7B27A3F1A6E18CD9588B4AE8310180050905E40C'
               'C383B778255613DFDB409D91DB221A6900000011'
               'DD38563A8A8224537D1F90E45B8A2D50A0ECD0D3')
@@ -34,7 +35,8 @@ sha256sums=('f61120612728f2c5034671d0ca3e2273438c60aba93b3dda4a8aa40e6a257993'
             '3dc795002b8763a7d29db94f0af200131da9ce5ffc233bfd8916060f83a8fad7'
             '416a1422eed71efcebb1d893de74e7f27e408323a56c4df003db37f5673b3f96'
             '3d7edab3a54d647e7d924b29d29f91b50212f308fcb1853a5aacd3181f58276c'
-            '793579adbef979088cadc0fd9ce0c24df0455a6936d3de7a9356df537b7d9a81')
+            '793579adbef979088cadc0fd9ce0c24df0455a6936d3de7a9356df537b7d9a81'
+            'efc05c06af2bfdf588ef7a60b44c1d180fb353b1bffdfdf96415d63690b6e394')
 
 prepare() {
   cd "${_pkgbase}-${pkgver}"
@@ -47,6 +49,7 @@ prepare() {
 
   msg2 "fix FS#45009, merged upstream"
   patch -Np1 -i ../0001-glamor-make-current-in-prepare-paths.patch
+  patch -Np1 -i ../0001-os-make-sure-the-clientsWritable-fd_set-is-initializ.patch
 
   msg2 "Starting autoreconf..."
   autoreconf -fvi