| Priority | medium |
|---|---|
| Bug ID | 66332 |
| Assignee | dri-devel@lists.freedesktop.org |
| Summary | drmHandleEvent returns 0 on read() failure |
| Severity | normal |
| Classification | Unclassified |
| OS | All |
| Reporter | mgold@qnx.com |
| Hardware | All |
| Status | NEW |
| Version | XOrg CVS |
| Component | libdrm |
| Product | DRI |
drmHandleEvent contains this code:
len = read(fd, buffer, sizeof buffer);
if (len == 0)
return 0;
if (len < sizeof *e)
return -1;
In the (len < sizeof *e) check, len gets promoted to size_t (which is
unsigned); so when len is negative "return -1" won't be executed. Instead, the
function continues to the end and returns 0. (The documentation states
drmHandleEvent will return -1 if the read fails.)
If there's an error like EBADF, the caller won't detect it and might end up
busy-waiting. Rewriting the condition as (len < (int)(sizeof *e)) will fix
this.
You are receiving this mail because:
- You are the assignee for the bug.
_______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx http://lists.freedesktop.org/mailman/listinfo/dri-devel
