Check for clientGone before sending events from XFixes (bug #1753).

Freeing resources during client closedown can cause cursor changes which
attempt to send cursor events through the XFixes extension; a client in the
process of closing down has no file to send events to, causing a crash when
this path is hit.

2 files changed, 5 insertions, 2 deletions

diff --git a/xfixes/cursor.c b/xfixes/cursor.c
index 86a512c25..3cdacc0e4 100755
--- a/xfixes/cursor.c
+++ b/xfixes/cursor.c
@@ -143,7 +143,8 @@ CursorDisplayCursor (ScreenPtr pScreen,
 	CursorCurrent = pCursor;
 	for (e = cursorEvents; e; e = e->next)
 	{
-	    if (e->eventMask & XFixesDisplayCursorNotifyMask)
+	    if ((e->eventMask & XFixesDisplayCursorNotifyMask) &&
+		!e->pClient->clientGone)
 	    {
 		xXFixesCursorNotifyEvent	ev;
 		ev.type = XFixesEventBase + XFixesCursorNotify;
diff --git a/xfixes/select.c b/xfixes/select.c
index d1c22c552..f0a9f2f4f 100755
--- a/xfixes/select.c
+++ b/xfixes/select.c
@@ -78,7 +78,9 @@ XFixesSelectionCallback (CallbackListPtr *callbacks, pointer data, pointer args)
     }
     for (e = selectionEvents; e; e = e->next)
     {
-	if (e->selection == selection->selection && (e->eventMask & eventMask))
+	if (e->selection == selection->selection && 
+	    (e->eventMask & eventMask) &&
+	    !e->pClient->clientGone)
 	{
 	    xXFixesSelectionNotifyEvent	ev;