xc/programs/Xserver/Xprint/ps/PsGC.c

//freedesktop.org/bugzilla/show_bug.cgi?id=1416) attachment #994
    (https://bugs.freedesktop.org/attachment.cgi?id=994): Fix Xprt
    PostScript DDX crashes when copying offscreen pixmap content to the
    same pixmap (the crash can be reproduced with % x11perf -copypixpix500
    ... # or the reduced testcase in bug #1416 (attachment #993)).

2 files changed, 17 insertions, 7 deletions

diff --git a/Xprint/ps/PsGC.c b/Xprint/ps/PsGC.c
index 78c83930d..c4984d075 100644
--- a/Xprint/ps/PsGC.c
+++ b/Xprint/ps/PsGC.c
@@ -380,6 +380,16 @@ PsCreateAndCopyGC(DrawablePtr pDrawable, GCPtr pSrc)
 {
     GCPtr pDst;
     
+    if (pSrc == NULL) {
+        /* https://freedesktop.org/bugzilla/show_bug.cgi?id=1416 ("'x11perf
+         * -copypixpix500' crashes Xprt's PostScript DDX [PsCreateAndCopyGC"):
+         * I have no clue whether this is the real fix or just wallpapering
+         * over the crash (that's why we warn here loudly when this
+         * happens) ... */
+        fprintf(stderr, "PsCreateAndCopyGC: pSrc == NULL\n");
+        return NULL;
+    }
+    
     if ((pDst =
 	 CreateScratchGC(pDrawable->pScreen, pDrawable->depth)) == NULL) 
     {
diff --git a/Xprint/ps/PsPixmap.c b/Xprint/ps/PsPixmap.c
index 616c2dbe8..6f4ca39d2 100644
--- a/Xprint/ps/PsPixmap.c
+++ b/Xprint/ps/PsPixmap.c
@@ -92,7 +92,7 @@ PsCreatePixmap(
 {
   PixmapPtr pPixmap;
 
-  pPixmap = (PixmapPtr)xalloc(sizeof(PixmapRec));
+  pPixmap = (PixmapPtr)xcalloc(1, sizeof(PixmapRec));
   if( !pPixmap)  return NullPixmap;
   pPixmap->drawable.type         = DRAWABLE_PIXMAP;
   pPixmap->drawable.class        = 0;
@@ -108,10 +108,9 @@ PsCreatePixmap(
   pPixmap->devKind               = 0;
   pPixmap->refcnt                = 1;
 
-  pPixmap->devPrivate.ptr = (PsPixmapPrivPtr)xalloc(sizeof(PsPixmapPrivRec));
+  pPixmap->devPrivate.ptr = (PsPixmapPrivPtr)xcalloc(1, sizeof(PsPixmapPrivRec));
   if( !pPixmap->devPrivate.ptr )
     { xfree(pPixmap); return NullPixmap; }
-  memset(pPixmap->devPrivate.ptr, 0, sizeof(PsPixmapPrivRec));
   return pPixmap;
 }
 
@@ -192,11 +191,11 @@ PsGetFreeDisplayBlock(PsPixmapPrivPtr priv)
   {
     if( disp->nelms>=DPY_BLOCKSIZE && disp->next ) continue;
     if( disp->nelms<DPY_BLOCKSIZE ) return(disp);
-    disp->next = (DisplayListPtr)xalloc(sizeof(DisplayListRec));
+    disp->next = (DisplayListPtr)xcalloc(1, sizeof(DisplayListRec));
     disp->next->next  = (DisplayListPtr)0;
     disp->next->nelms = 0;
   }
-  disp = (DisplayListPtr)xalloc(sizeof(DisplayListRec));
+  disp = (DisplayListPtr)xcalloc(1, sizeof(DisplayListRec));
   disp->next     = (DisplayListPtr)0;
   disp->nelms    = 0;
   priv->dispList = disp;
@@ -480,6 +479,7 @@ PsCreateFillElementList(PixmapPtr pix, int *nElms)
 
     for( i=0 ; i<disp->nelms ; i++,elm++ )
     {
+      if( !elm->gc ) continue; /* workaround for https://freedesktop.org/bugzilla/show_bug.cgi?id=1416 */
       if( !elm->gc->fgPixel ) continue;
       switch(elm->type)
       {
@@ -498,7 +498,7 @@ PsCreateFillElementList(PixmapPtr pix, int *nElms)
 
   if( (*nElms) )
   {
-    elms = (PsElmPtr)xalloc((*nElms)*sizeof(PsElmRec));
+    elms = (PsElmPtr)xcalloc(1, (*nElms)*sizeof(PsElmRec));
     if( elms )
     {
       disp = priv->dispList;
@@ -568,7 +568,7 @@ PsCloneFillElementList(int nElms, PsElmPtr elms)
   int      i;
   PsElmPtr newElms;
 
-  newElms = (PsElmPtr)xalloc(nElms*sizeof(PsElmRec));
+  newElms = (PsElmPtr)xcalloc(1, nElms*sizeof(PsElmRec));
   if( !newElms ) return(newElms);
   for( i=0 ; i<nElms ; i++ )
   {