Skip to content
  • Hal Gentz's avatar
    glx: Fix SEGV due to dereferencing a NULL ptr from XCB-GLX. · 1591d1fe
    Hal Gentz authored
    When run in optirun, applications that linked to `libGLX.so` and then
    proceeded to querying Mesa for extension strings caused a SEGV in Mesa.
    
    `glXQueryExtensionsString` was calling a chain of functions that
    eventually led to `__glXQueryServerString`. This function would call
    `xcb_glx_query_server_string` then `xcb_glx_query_server_string_reply`.
    The latter for some unknown reason returned `NULL`. Passing this `NULL`
    to `xcb_glx_query_server_string_string_length` would cause a SEGV as the
    function tried to dereference it.
    
    The reason behind the function returning `NULL` is yet to be determined,
    however, simply checking that the ptr is not `NULL` resolves this. A
    similar check has been added to `__glXGetString` for completeness sake,
    although not immediately necessary.
    
    In addition to that, we stumbled into a similar problem in
    `AllocAndFetchScreenConfigs` which tries to access the configs to free
    them if `__glXQueryServerString` fails. This, of course, SEGVs, because the
    configs are yet to have been allocated. Simply continuing past the configs
    if their config ptrs are `NULL` resolves this. We also switch to `calloc`
    to make sure that the config ptrs are `NULL` by default, and not some
    uninitialized value.
    
    Cc: mesa-stable@lists.freedesktop.org
    Fixes: 24b8a8cf "glx: implement __glXGetString, hide __glXGetStringFromServer"
    Fixes: cb3610e3
    
     "Import the GLX client side library, formerly from xc/lib/GL/glx. Build it "
    Reviewed-by: default avatarAdam Jackson <ajax@redhat.com>
    Signed-off-by: default avatarHal Gentz <zegentzy@protonmail.com>
    1591d1fe