<div class="gmail_quote">On Fri, May 18, 2012 at 5:16 PM, Gary Thomas <span dir="ltr">&lt;<a href="mailto:gary@mlbassoc.com" target="_blank">gary@mlbassoc.com</a>&gt;</span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

On 2012-05-16 15:26, Gary Thomas wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Newer versions of GCC uncovered illegal code practice which can cause<br>
runtime failures in the Xext/xace.c code.  This problem has been fixed upstream:<br>
   <a href="http://cgit.freedesktop.org/xorg/xserver/patch/Xext/xace.c?id=6dae7f3792611aace1df0cca63bf50c50d93de43" target="_blank">http://cgit.freedesktop.org/<u></u>xorg/xserver/patch/Xext/xace.<u></u>c?id=<u></u>6dae7f3792611aace1df0cca63bf50<u></u>c50d93de43</a><br>


   Subject: xace: Invalid reference to out-of-scope data.<br>
<br>
Incorporate this patch into the recipe, with a PR bump.<br>
<br>
Signed-off-by: Gary Thomas&lt;<a href="mailto:gary@mlbassoc.com" target="_blank">gary@mlbassoc.com</a>&gt;<br>
</blockquote>
<br>
Ping?<br></blockquote><div><br></div><div>Double ping. </div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
---<br>
  .../fix-bogus-stack-variables.<u></u>patch                |  231 ++++++++++++++++++++<br>
  .../xorg-xserver/<a href="http://xserver-kdrive_1.7.99.2.bb" target="_blank">xserver-<u></u>kdrive_1.7.99.2.bb</a>        |    3 +-<br>
  2 files changed, 233 insertions(+), 1 deletions(-)<br>
  create mode 100644 meta/recipes-graphics/xorg-<u></u>xserver/xserver-kdrive-1.7.99.<u></u>2/fix-bogus-stack-variables.<u></u>patch<br>
<br>
diff --git a/meta/recipes-graphics/xorg-<u></u>xserver/xserver-kdrive-1.7.99.<u></u>2/fix-bogus-stack-variables.<u></u>patch b/meta/recipes-graphics/xorg-<u></u>xserver/xserver-kdrive-1.7.99.<u></u>2/fix-bogus-stack-variables.<u></u>patch<br>


new file mode 100644<br>
index 0000000..d900fc3<br>
--- /dev/null<br>
+++ b/meta/recipes-graphics/xorg-<u></u>xserver/xserver-kdrive-1.7.99.<u></u>2/fix-bogus-stack-variables.<u></u>patch<br>
@@ -0,0 +1,233 @@<br>
+From 6dae7f3792611aace1df0cca63bf50<u></u>c50d93de43 Mon Sep 17 00:00:00 2001<br>
+From: Chris Wilson&lt;<a href="mailto:chris@chris-wilson.co.uk" target="_blank">chris@chris-wilson.co.<u></u>uk</a>&gt;<br>
+Date: Tue, 10 Aug 2010 18:30:20 +0000<br>
+Subject: xace: Invalid reference to out-of-scope data.<br>
+<br>
+The callback data passed by reference to the hook was allocated on stack<br>
+within the scope of the case statement. The compiler is free to reuse<br>
+any of that stack space whilst making the function call so we may end up<br>
+passing garbage into the callback.<br>
+<br>
+References:<br>
+<br>
+  Bug 18451 - Xorg server 1.5.2 SEGV during XFixesGetCursorImage()<br>
+  <a href="https://bugs.freedesktop.org/show_bug.cgi?id=18451" target="_blank">https://bugs.freedesktop.org/<u></u>show_bug.cgi?id=18451</a><br>
+<br>
+v2: Drop the unrelated hunk that snuck in when ammending the commit<br>
+message.<br>
+<br>
+Signed-off-by: Chris Wilson&lt;<a href="mailto:chris@chris-wilson.co.uk" target="_blank">chris@chris-wilson.co.<u></u>uk</a>&gt;<br>
+Reviewed-by: Alan Coopersmith&lt;<a href="mailto:alan.coopersmith@oracle.com" target="_blank">alan.coopersmith@<u></u>oracle.com</a>&gt;<br>
+Signed-off-by: Keith Packard&lt;<a href="mailto:keithp@keithp.com" target="_blank">keithp@keithp.com</a>&gt;<br>
+<br>
+Upstream-Status: accepted<br>
+---<br>
+(limited to &#39;Xext/xace.c&#39;)<br>
+<br>
+diff --git a/Xext/xace.c b/Xext/xace.c<br>
+index e10d837..c757cad 100644<br>
+--- a/Xext/xace.c<br>
++++ b/Xext/xace.c<br>
+@@ -87,7 +87,18 @@ void XaceHookAuditEnd(ClientPtr ptr, int result)<br>
+  */<br>
+ int XaceHook(int hook, ...)<br>
+ {<br>
+-    pointer calldata; /* data passed to callback */<br>
++    union {<br>
++      XaceResourceAccessRec res;<br>
++      XaceDeviceAccessRec dev;<br>
++      XaceSendAccessRec send;<br>
++      XaceReceiveAccessRec recv;<br>
++      XaceClientAccessRec client;<br>
++      XaceExtAccessRec ext;<br>
++      XaceServerAccessRec server;<br>
++      XaceScreenAccessRec screen;<br>
++      XaceAuthAvailRec auth;<br>
++      XaceKeyAvailRec key;<br>
++    } u;<br>
+     int *prv = NULL;  /* points to return value from callback */<br>
+     va_list ap;               /* argument list */<br>
+     va_start(ap, hook);<br>
+@@ -99,117 +110,86 @@ int XaceHook(int hook, ...)<br>
+      */<br>
+     switch (hook)<br>
+     {<br>
+-      case XACE_RESOURCE_ACCESS: {<br>
+-          XaceResourceAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          <a href="http://rec.id" target="_blank">rec.id</a> = va_arg(ap, XID);<br>
+-          rec.rtype = va_arg(ap, RESTYPE);<br>
+-          rec.res = va_arg(ap, pointer);<br>
+-          rec.ptype = va_arg(ap, RESTYPE);<br>
+-          rec.parent = va_arg(ap, pointer);<br>
+-          rec.access_mode = va_arg(ap, Mask);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_RESOURCE_ACCESS:<br>
++          u.res.client = va_arg(ap, ClientPtr);<br>
++          <a href="http://u.res.id" target="_blank">u.res.id</a> = va_arg(ap, XID);<br>
++          u.res.rtype = va_arg(ap, RESTYPE);<br>
++          u.res.res = va_arg(ap, pointer);<br>
++          u.res.ptype = va_arg(ap, RESTYPE);<br>
++          u.res.parent = va_arg(ap, pointer);<br>
++          u.res.access_mode = va_arg(ap, Mask);<br>
++          u.res.status = Success; /* default allow */<br>
++          prv =&amp;u.res.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_DEVICE_ACCESS: {<br>
+-          XaceDeviceAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.dev = va_arg(ap, DeviceIntPtr);<br>
+-          rec.access_mode = va_arg(ap, Mask);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_DEVICE_ACCESS:<br>
++          u.dev.client = va_arg(ap, ClientPtr);<br>
++          u.dev.dev = va_arg(ap, DeviceIntPtr);<br>
++          u.dev.access_mode = va_arg(ap, Mask);<br>
++          u.dev.status = Success; /* default allow */<br>
++          prv =&amp;u.dev.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_SEND_ACCESS: {<br>
+-          XaceSendAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.dev = va_arg(ap, DeviceIntPtr);<br>
+-          rec.pWin = va_arg(ap, WindowPtr);<br>
+-          rec.events = va_arg(ap, xEventPtr);<br>
+-          rec.count = va_arg(ap, int);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_SEND_ACCESS:<br>
++          u.send.client = va_arg(ap, ClientPtr);<br>
++          u.send.dev = va_arg(ap, DeviceIntPtr);<br>
++          u.send.pWin = va_arg(ap, WindowPtr);<br>
++          u.send.events = va_arg(ap, xEventPtr);<br>
++          u.send.count = va_arg(ap, int);<br>
++          u.send.status = Success; /* default allow */<br>
++          prv =&amp;u.send.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_RECEIVE_ACCESS: {<br>
+-          XaceReceiveAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.pWin = va_arg(ap, WindowPtr);<br>
+-          rec.events = va_arg(ap, xEventPtr);<br>
+-          rec.count = va_arg(ap, int);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_RECEIVE_ACCESS:<br>
++          u.recv.client = va_arg(ap, ClientPtr);<br>
++          u.recv.pWin = va_arg(ap, WindowPtr);<br>
++          u.recv.events = va_arg(ap, xEventPtr);<br>
++          u.recv.count = va_arg(ap, int);<br>
++          u.recv.status = Success; /* default allow */<br>
++          prv =&amp;u.recv.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_CLIENT_ACCESS: {<br>
+-          XaceClientAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.target = va_arg(ap, ClientPtr);<br>
+-          rec.access_mode = va_arg(ap, Mask);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_CLIENT_ACCESS:<br>
++          u.client.client = va_arg(ap, ClientPtr);<br>
++          u.client.target = va_arg(ap, ClientPtr);<br>
++          u.client.access_mode = va_arg(ap, Mask);<br>
++          u.client.status = Success; /* default allow */<br>
++          prv =&amp;u.client.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_EXT_ACCESS: {<br>
+-          XaceExtAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.ext = va_arg(ap, ExtensionEntry*);<br>
+-          rec.access_mode = DixGetAttrAccess;<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_EXT_ACCESS:<br>
++          u.ext.client = va_arg(ap, ClientPtr);<br>
++          u.ext.ext = va_arg(ap, ExtensionEntry*);<br>
++          u.ext.access_mode = DixGetAttrAccess;<br>
++          u.ext.status = Success; /* default allow */<br>
++          prv =&amp;u.ext.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_SERVER_ACCESS: {<br>
+-          XaceServerAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.access_mode = va_arg(ap, Mask);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_SERVER_ACCESS:<br>
++          u.server.client = va_arg(ap, ClientPtr);<br>
++          u.server.access_mode = va_arg(ap, Mask);<br>
++          u.server.status = Success; /* default allow */<br>
++          prv =&amp;u.server.status;<br>
+           break;<br>
+-      }<br>
+       case XACE_SCREEN_ACCESS:<br>
+-      case XACE_SCREENSAVER_ACCESS: {<br>
+-          XaceScreenAccessRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.screen = va_arg(ap, ScreenPtr);<br>
+-          rec.access_mode = va_arg(ap, Mask);<br>
+-          rec.status = Success; /* default allow */<br>
+-          calldata =&amp;rec;<br>
+-          prv =&amp;rec.status;<br>
++      case XACE_SCREENSAVER_ACCESS:<br>
++          u.screen.client = va_arg(ap, ClientPtr);<br>
++          u.screen.screen = va_arg(ap, ScreenPtr);<br>
++          u.screen.access_mode = va_arg(ap, Mask);<br>
++          u.screen.status = Success; /* default allow */<br>
++          prv =&amp;u.screen.status;<br>
+           break;<br>
+-      }<br>
+-      case XACE_AUTH_AVAIL: {<br>
+-          XaceAuthAvailRec rec;<br>
+-          rec.client = va_arg(ap, ClientPtr);<br>
+-          rec.authId = va_arg(ap, XID);<br>
+-          calldata =&amp;rec;<br>
++      case XACE_AUTH_AVAIL:<br>
++          u.auth.client = va_arg(ap, ClientPtr);<br>
++          u.auth.authId = va_arg(ap, XID);<br>
+           break;<br>
+-      }<br>
+-      case XACE_KEY_AVAIL: {<br>
+-          XaceKeyAvailRec rec;<br>
+-          rec.event = va_arg(ap, xEventPtr);<br>
+-          rec.keybd = va_arg(ap, DeviceIntPtr);<br>
+-          rec.count = va_arg(ap, int);<br>
+-          calldata =&amp;rec;<br>
++      case XACE_KEY_AVAIL:<br>
++          u.key.event = va_arg(ap, xEventPtr);<br>
++          u.key.keybd = va_arg(ap, DeviceIntPtr);<br>
++          u.key.count = va_arg(ap, int);<br>
+           break;<br>
+-      }<br>
+-      default: {<br>
++      default:<br>
+           va_end(ap);<br>
+           return 0;   /* unimplemented hook number */<br>
+-      }<br>
+     }<br>
+     va_end(ap);<br>
+<br>
+     /* call callbacks and return result, if any. */<br>
+-    CallCallbacks(&amp;XaceHooks[hook]<u></u>, calldata);<br>
++    CallCallbacks(&amp;XaceHooks[hook]<u></u>,&amp;u);<br>
+     return prv ? *prv : Success;<br>
+ }<br>
+<br>
+--<br>
+cgit v0.9.0.2-2-gbebe<br>
diff --git a/meta/recipes-graphics/xorg-<u></u>xserver/<a href="http://xserver-kdrive_1.7.99.2.bb" target="_blank">xserver-kdrive_1.7.99.<u></u>2.bb</a> b/meta/recipes-graphics/xorg-<u></u>xserver/<a href="http://xserver-kdrive_1.7.99.2.bb" target="_blank">xserver-kdrive_1.7.99.<u></u>2.bb</a><br>


index 360a0f3..d90dc25 100644<br>
--- a/meta/recipes-graphics/xorg-<u></u>xserver/<a href="http://xserver-kdrive_1.7.99.2.bb" target="_blank">xserver-kdrive_1.7.99.<u></u>2.bb</a><br>
+++ b/meta/recipes-graphics/xorg-<u></u>xserver/<a href="http://xserver-kdrive_1.7.99.2.bb" target="_blank">xserver-kdrive_1.7.99.<u></u>2.bb</a><br>
@@ -7,7 +7,7 @@ RDEPENDS_${PN} += &quot;xkeyboard-config&quot;<br>
  EXTRA_OECONF += &quot;--disable-glx&quot;<br>
<br>
  PE = &quot;1&quot;<br>
-PR = &quot;r29&quot;<br>
+PR = &quot;r30&quot;<br>
<br>
  SRC_URI = &quot;${XORG_MIRROR}/individual/<u></u>xserver/xorg-server-${PV}.tar.<u></u>bz2 \<br>
        file://extra-kmodes.patch \<br>
@@ -20,6 +20,7 @@ SRC_URI = &quot;${XORG_MIRROR}/individual/<u></u>xserver/xorg-server-${PV}.tar.<u></u>bz2 \<br>
        file://fix-newer-xorg-headers.<u></u>patch \<br>
        file://crosscompile.patch \<br>
        file://error-address-work-<u></u>around.patch \<br>
+        file://fix-bogus-stack-<u></u>variables.patch \<br>
        file://nodolt.patch&quot;<br>
  #     file://kdrive-evdev.patch<br>
  #     file://kdrive-use-evdev.patch<span class="HOEnZb"><font color="#888888"><br>
</font></span></blockquote><span class="HOEnZb"><font color="#888888">
<br>
-- <br>
------------------------------<u></u>------------------------------<br>
Gary Thomas                 |  Consulting for the<br>
MLB Associates              |    Embedded world<br>
------------------------------<u></u>------------------------------<br>
<br>
______________________________<u></u>_________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org" target="_blank">Openembedded-core@lists.<u></u>openembedded.org</a><br>
<a href="http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-core" target="_blank">http://lists.linuxtogo.org/<u></u>cgi-bin/mailman/listinfo/<u></u>openembedded-core</a><br>
</font></span></blockquote></div><br>