This request installs hooks that keep sending replies even after the request handler has finished. Each reply accesses the input buffer. If we let the buffer to be shared, we will eventually read garbage or even from freed memory.
Signed-off-by: Rami Ylimäki <rami.ylim...@vincit.fi> Reviewed-by: Erkki Seppälä <erkki.sepp...@vincit.fi> --- record/record.c | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-) diff --git a/record/record.c b/record/record.c index 5cae2b9..f0bfed7 100644 --- a/record/record.c +++ b/record/record.c @@ -44,6 +44,7 @@ and Jim Haggerty of Metheus. #include "inputstr.h" #include "eventconvert.h" #include "scrnintstr.h" +#include "os.h" #include <stdio.h> @@ -2423,6 +2424,12 @@ ProcRecordEnableContext(ClientPtr client) /* send StartOfData */ RecordAProtocolElement(pContext, NULL, XRecordStartOfData, NULL, 0, 0, 0); RecordFlushReplyBuffer(pContext, NULL, 0, NULL, 0); + + /* We need to still access the client input buffer as we keep + * sending replies to this request even after the request has + * been technically completed. */ + ReserveClientInput(client); + return Success; } /* ProcRecordEnableContext */ -- 1.7.1 _______________________________________________ xorg-devel@lists.x.org: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel