search

sharplispers / clx

a fork of crhodes' fork of danb's fork of the CLX library, an X11 client for Common Lisp
Other
116 stars 46 forks source link

xrender extension: big glyphs may crash the connection #42

Closed dkochmanski closed 8 years ago

dkochmanski commented 8 years ago

How to reproduce (type in a repl to avoid problems with symbols):

(ql:quickload 'clim-listener)
(defun clim-user::crash (s)
  (climi::with-text-size (t s) (princ "?")))
(clim-listener:run-listener :new-process t)

Type in clim-listener: (crash 715) – connection gets crashed.

Analysis:

xrender extension calls directly write-image-z from the render-add-glyph without verifying whenever the request exceeds the max-request-length (put-image verifies, if the buffer may be rendered), what leads to the crash. Server can't be restarted. write-image-z is called inly from put-image and write-image-z.

Possible solutions:

  1. validate the request length in render-add-glyph and signal an error if it's too large (simple, but not general enough).
  2. embed validation in macro with-buffer-request – it has a benefit that new extensions (or "wild" calls to write-image-z and all other rendering functions will be validated, however I'm not sure yet how to do that – macrology there is strong).
dkochmanski commented 8 years ago

put-image does even better job – if a scan-line fits in the max-request, then it send the image in multiple requests even if it doesn't fit.