Bug #6956: Fix crash when removing session leader before its children.

    (Rich Coe)

2 files changed, 16 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index 8ec2d78b6..2076f3159 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,10 @@
 	* hw/xfree86/loader/loader.c:
 	Completely remove relocation pointer tables.
 
+	* Xext/appgroup.c:
+	Bug #6956: Fix crash when removing session leader before its children.
+	(Rich Coe)
+
 2006-06-01  Adam Jackson  <ajax@freedesktop.org>
 
 	* hw/xfree86/common/xf86Init.c:
diff --git a/Xext/appgroup.c b/Xext/appgroup.c
index ad4afa9e4..86bd36ecd 100644
--- a/Xext/appgroup.c
+++ b/Xext/appgroup.c
@@ -100,7 +100,7 @@ int XagAppGroupFree(
 
     if (pAppGrp->leader)
 	for (i = 0; i < pAppGrp->nclients; i++) {
-	    pAppGrp->clients[i]->appgroup = NULL;
+	    if (pAppGrp->clients[i] == NULL) continue;
 	    CloseDownClient (pAppGrp->clients[i]);
 	}
 
@@ -134,6 +134,7 @@ void XagClientStateChange(
     ClientPtr pClient = pci->client;
     AppGroupPtr pAppGrp;
     XID authId = 0;
+    int slot;
 
     if (!pClient->appgroup) {
 	switch (pClient->clientState) {
@@ -195,16 +196,22 @@ void XagClientStateChange(
 
     case ClientStateInitial: 
     case ClientStateCheckedSecurity:
+	slot = -1;
 	/* see the comment above about Initial vs. CheckedSecurity */
-	{
+	if (pAppGrp->nclients != 0) {
 	    /* if this client already in AppGroup, don't add it again */
 	    int i;
 	    for (i = 0; i < pAppGrp->nclients; i++)
 		if (pClient == pAppGrp->clients[i]) return;
+		if (slot == -1 && pAppGrp->clients[i] == NULL)
+			slot = i;
+	}
+	if (slot == -1) {
+	    slot = pAppGrp->nclients++;
+	    pAppGrp->clients = (ClientPtr*) xrealloc (pAppGrp->clients, 
+				pAppGrp->nclients * sizeof (ClientPtr));
 	}
-	pAppGrp->clients = (ClientPtr*) xrealloc (pAppGrp->clients, 
-				++pAppGrp->nclients * sizeof (ClientPtr));
-	pAppGrp->clients[pAppGrp->nclients - 1] = pClient;
+	pAppGrp->clients[slot] = pClient;
 	pClient->appgroup = pAppGrp;
 	break;
 
@@ -217,10 +224,6 @@ void XagClientStateChange(
 		    pAppGrp->clients[i] = NULL;
 		    break;
 		}
-	    for (i = 0; i < pAppGrp->nclients; i++)
-		if (pAppGrp->clients[i] == NULL && i + 1 < pAppGrp->nclients)
-		    pAppGrp->clients[i] = pAppGrp->clients[i + 1];
-	    pAppGrp->nclients--;
 	}
 	pClient->appgroup = NULL; /* redundant, pClient will be freed */
 	break;