fix tiny memory leak in read_packet (leak only happens when malloc returns NULL so...

[free-sw/xcb/libxcb] / src / xcb_in.c

diff --git a/src/xcb_in.c b/src/xcb_in.c
index 1cb6b69..f613772 100644 (file)
--- a/src/xcb_in.c
+++ b/src/xcb_in.c
@@ -39,6 +39,7 @@
 
 #define XCB_ERROR 0
 #define XCB_REPLY 1
+#define XCB_XGE_EVENT 35
 
 struct event_list {
     xcb_generic_event_t *event;
@@ -77,6 +78,7 @@ static int read_packet(xcb_connection_t *c)
 {
     xcb_generic_reply_t genrep;
     int length = 32;
+    int eventlength = 0; /* length after first 32 bytes for GenericEvents */
     void *buf;
     pending_reply *pend = 0;
     struct event_list *event;
@@ -141,17 +143,36 @@ static int read_packet(xcb_connection_t *c)
         length += genrep.length * 4;
     }
 
-    buf = malloc(length + (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
+    /* XGE events may have sizes > 32 */
+    if (genrep.response_type == XCB_XGE_EVENT)
+    {
+        eventlength = ((xcb_ge_event_t*)&genrep)->length * 4;
+    }
+
+    buf = malloc(length + eventlength +
+            (genrep.response_type == XCB_REPLY ? 0 : sizeof(uint32_t)));
     if(!buf)
     {
         _xcb_conn_shutdown(c);
         return 0;
     }
+
     if(_xcb_in_read_block(c, buf, length) <= 0)
     {
         free(buf);
         return 0;
     }
+
+    /* pull in XGE event data if available, append after event struct */
+    if (eventlength)
+    {
+        if(_xcb_in_read_block(c, &((xcb_generic_event_t*)buf)[1], eventlength) <= 0)
+        {
+            free(buf);
+            return 0;
+        }
+    }
+
     if(pend && (pend->flags & XCB_REQUEST_DISCARD_REPLY))
     {
         free(buf);
@@ -170,6 +191,7 @@ static int read_packet(xcb_connection_t *c)
         if(!cur)
         {
             _xcb_conn_shutdown(c);
+            free(buf);
             return 0;
         }
         cur->reply = buf;
@@ -231,7 +253,7 @@ static void free_reply_list(struct reply_list *head)
     }
 }
 
-static int read_block(const int fd, void *buf, const size_t len)
+static int read_block(const int fd, void *buf, const ssize_t len)
 {
     int done = 0;
     while(done < len)
@@ -403,7 +425,8 @@ xcb_generic_event_t *xcb_poll_for_event(xcb_connection_t *c)
     {
         _xcb_lock_io(c);
         /* FIXME: follow X meets Z architecture changes. */
-        if(_xcb_in_read(c)) /* _xcb_in_read shuts down the connection on error */
+        ret = get_event(c);
+        if(!ret && _xcb_in_read(c)) /* _xcb_in_read shuts down the connection on error */
             ret = get_event(c);
         _xcb_unlock_io(c);
     }