GNOME Bugzilla – Bug 677977
gnome-shell 3.5.2 crashed
Last modified: 2012-06-25 18:07:55 UTC
Clearing out some recent shell crash reports from the abrt queue; not sure how I triggered this. gnome-shell 3.5.2
+ Trace 230358
Thread 1 (Thread 0x7fc93b6e29c0 (LWP 1063))
Ot looks like a bug in the X server: it says that there are two rectangles, but returns NULL. We do have an existing branch to test if rects is NULL, and not taking that path will cause a crash. I figured that count would always be 0 in that case, though.
It's common for APIs to leave out arguments untouched on error. It's better to just treat them as not defined on error, but you can also often get away with pre-initializing out args to 0 before making the call.
But we didn't get an X error back. It succeeded.
so the code i see does: /* n_rects is uninitialized */ int n_rects; /* Not using _with_return variants of of meta_error_trap so not checking for specific X errors */ meta_error_trap_push (display); rects = XShapeGetRectangles (..., &n_rects); meta_error_trap_pop (display); if (rects) { /* some stuff here */ } /* regardless of error from XShapeGetRectangles, regardless of whether rects is NULL, use potentially uninitialized n_rects variable */ region = cairo_region_create_rectangles (..., n_rects);
Created attachment 216337 [details] [review] meta-window-actor: Fix a potential crash in the window shaping code There was a potential case where we were trying to use uninitialized memory, in the case where the X server threw an error during XShapeGetRectangles. In this case, we need to use the implicit shape for the window, which means we need to rearrange code flow to make it work.
Review of attachment 216337 [details] [review]: seems right. ::: src/compositor/meta-window-actor.c @@ +2256,3 @@ int i; + cairo_rectangle_int_t *cairo_rects = g_new (cairo_rectangle_int_t, n_rects); + I think it's more common in mutter to split this into two separate lines, but there seems to be a mix of both conventions sprinkled throughout the codebase so probably doesn't matter.
Attachment 216337 [details] pushed as a2f2e07 - meta-window-actor: Fix a potential crash in the window shaping code