diff options
| author | Peter Hutterer <peter.hutterer@who-t.net> | 2011-12-19 14:52:41 +1000 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2011-12-21 08:12:48 +1000 |
| commit | 47da6b6b2c2e9245422655f94770146fb8cd430b (patch) | |
| tree | 0d161ec313b9340e473e50249eebef49d42c063d /dix | |
| parent | 2d34b34ed7547b829979756ccfb2cff79368d0a4 (diff) | |
dix: don't retrieve the syncEvents tail on an empty list
An empty list points to itself but syncEvents has the list head only and is
of a different format than the elements. Thus, casting it to a QdEventPtr
gives us garbage.
Segfaults with XTS test case Xlib13/XGrabKeyboard
Introduced in 7af23259d88f4c28ed21140f82cc03b3724c06bb.
Reported-by: Aaron Plattner <aplattner@nvidia.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
Diffstat (limited to 'dix')
| -rw-r--r-- | dix/events.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/dix/events.c b/dix/events.c index 8dff29973..eb7bd9296 100644 --- a/dix/events.c +++ b/dix/events.c @@ -1115,13 +1115,14 @@ NoticeEventTime(InternalEvent *ev) void EnqueueEvent(InternalEvent *ev, DeviceIntPtr device) { - QdEventPtr tail; + QdEventPtr tail = NULL; QdEventPtr qe; SpritePtr pSprite = device->spriteInfo->sprite; int eventlen; DeviceEvent *event = &ev->device_event; - tail = list_last_entry(&syncEvents.pending, QdEventRec, next); + if (!list_is_empty(&syncEvents.pending)) + tail = list_last_entry(&syncEvents.pending, QdEventRec, next); NoticeTime((InternalEvent*)event); |