Commit a352f979 authored by Olivier Fourdan's avatar Olivier Fourdan

xwayland: handle case without any crtc

Xwayland creates and destroys the CRTC along with the Wayland outputs,
so there is possibly a case where the number of CRTC drops to 0.

However, `xwl_present_get_crtc()` always return `crtcs[0]` which is
invalid when `numCrtcs` is 0.

That leads to crash if a client queries the Present capabilities when
there is no CRTC, the backtrace looks like:

  #0  raise() from
  #1  abort() from
  #2  OsAbort() at utils.c:1350
  #3  AbortServer() at log.c:879
  #4  FatalError() at log.c:1017
  #5  OsSigHandler() at osinit.c:156
  #6  OsSigHandler() at osinit.c:110
  #7  <signal handler called>
  #8  main_arena() from
  #9  proc_present_query_capabilities() at present_request.c:236
  #10 Dispatch() at dispatch.c:478
  #11 dix_main() at main.c:276

To avoid returning an invalid pointer (`crtcs[0]`) in that case, simply
check for `numCrtcs` being 0 and return `NULL` in that case.

Thanks to Michel Dänzer <> for pointing this as a
possible cause of the crash.
Signed-off-by: default avatarOlivier Fourdan <>
Reviewed-by: Michel Dänzer's avatarMichel Dänzer <>
(cherry picked from commit e8295c50)
parent 210cd529
Pipeline #14445 passed with stage
in 2 minutes and 54 seconds
......@@ -323,6 +323,10 @@ xwl_present_get_crtc(WindowPtr present_window)
return NULL;
rr_private = rrGetScrPriv(present_window->drawable.pScreen);
if (rr_private->numCrtcs == 0)
return NULL;
return rr_private->crtcs[0];
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment