drmHandleEvent returns 0 on read() failure

Submitted by Michael Gold

Assigned to Default DRI bug account

Link to original bug (#66332)

Description

drmHandleEvent contains this code:

        len = read(fd, buffer, sizeof buffer);
        if (len == 0)
                return 0;
        if (len < sizeof *e)
                return -1;

In the len < sizeof *e check, len gets promoted to size_t (which is unsigned); so when len is negative return -1 won't be executed. Instead, the function continues to the end and returns 0. (The documentation states drmHandleEvent will return -1 if the read fails.)

If there's an error like EBADF, the caller won't detect it and might end up busy-waiting. Rewriting the condition as len < (int)(sizeof *e) will fix this.

Version: XOrg git