Skip to content

glx: Fix SEGV due to dereferencing a NULL ptr from XCB-GLX.

Freya Gentz requested to merge ZeGentzy/mesa:optirun_segv_fix into master

When run in optirun, applications that linked to libGLX.so and then proceeded to querying Mesa for extension strings caused a SEGV in Mesa.

glXQueryExtensionsString was calling a chain of functions that eventually led to __glXQueryServerString. This function would call xcb_glx_query_server_string then xcb_glx_query_server_string_reply. The latter for some unknown reason returned NULL. Passing this NULL to xcb_glx_query_server_string_string_length would cause a SEGV as the function tried to dereference it.

The reason behind the function returning NULL is yet to be determined, however, simply checking that the ptr is not NULL resolves this. A similar check has been added to __glXGetString for completeness sake, although not immediately necessary.

In addition to that, we stumbled into a similar problem in AllocAndFetchScreenConfigs which tries to access the configs to free them if __glXQueryServerString fails. This, of course, SEGVs, because the configs are yet to have been allocated. Simply continuing past the configs if their config ptrs are NULL resolves this. We also switch to calloc to make sure that the config ptrs are NULL by default, and not some uninitialized value.

Cc: mesa-stable@lists.freedesktop.org Fixes: 24b8a8cf "glx: implement __glXGetString, hide __glXGetStringFromServer" Fixes: cb3610e3 "Import the GLX client side library, formerly from xc/lib/GL/glx. Build it " Signed-off-by: Hal Gentz zegentzy@protonmail.com

Merge request reports