Don't call xcalloc() in functions called by the big SIGIO handler.

Problem initially reported by sthen@, fix tested by many.

1 files changed, 33 insertions, 36 deletions

diff --git a/xserver/hw/xfree86/common/xf86Xinput.c b/xserver/hw/xfree86/common/xf86Xinput.c
index b939fb763..9dd185f94 100644
--- a/xserver/hw/xfree86/common/xf86Xinput.c
+++ b/xserver/hw/xfree86/common/xf86Xinput.c
@@ -134,6 +134,11 @@ xf86ProcessCommonOptions(LocalDevicePtr local,
 
     /* Backwards compatibility. */
     local->history_size = GetMotionHistorySize();
+    /* Preallocate xEvent store */
+    if (!xf86Events)
+        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
+    if (!xf86Events)
+        FatalError("Couldn't allocate event store\n");
 }
 
 /***********************************************************************
@@ -462,6 +467,8 @@ DeleteInputDeviceRequest(DeviceIntPtr pDev)
  * convenient functions to post events
  */
 
+#define MAX_VALUATORS 36 /* XXX from comment in dix/getevents.c */
+
 _X_EXPORT void
 xf86PostMotionEvent(DeviceIntPtr	device,
                     int			is_absolute,
@@ -471,17 +478,12 @@ xf86PostMotionEvent(DeviceIntPtr	device,
 {
     va_list var;
     int i = 0;
-    static int *valuators = NULL;
-    static int n_valuators = 0;
-
-    if (num_valuators > n_valuators) {
-	xfree (valuators);
-	valuators = NULL;
-    }
+    static int valuators[MAX_VALUATORS];
 
-    if (!valuators) {
-	valuators = xcalloc(sizeof(int), num_valuators);
-	n_valuators = num_valuators;
+    if (num_valuators > MAX_VALUATORS) {
+	xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+	    " is greater than MAX_VALUATORS\n", num_valuators);
+	return;
     }
 
     va_start(var, num_valuators);
@@ -530,9 +532,7 @@ xf86PostMotionEventP(DeviceIntPtr	device,
 #endif
 
     if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");
 
     nevents = GetPointerEvents(xf86Events, device, MotionNotify, 0,
                                flags, first_valuator, num_valuators,
@@ -556,9 +556,15 @@ xf86PostProximityEvent(DeviceIntPtr	device,
                        ...)
 {
     va_list var;
-    int i, nevents, *valuators = NULL;
+    int i, nevents;
+    int valuators[MAX_VALUATORS];
 
-    valuators = xcalloc(sizeof(int), num_valuators);
+
+    if (num_valuators > MAX_VALUATORS) {
+	xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+	    " is greater than MAX_VALUATORS\n", num_valuators);
+	return;
+    }
 
     va_start(var, num_valuators);
     for (i = 0; i < num_valuators; i++)
@@ -566,9 +572,7 @@ xf86PostProximityEvent(DeviceIntPtr	device,
     va_end(var);
 
     if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");
 
     nevents = GetProximityEvents(xf86Events, device,
                                  is_in ? ProximityIn : ProximityOut, 
@@ -576,7 +580,6 @@ xf86PostProximityEvent(DeviceIntPtr	device,
     for (i = 0; i < nevents; i++)
         mieqEnqueue(device, xf86Events + i);
 
-    xfree(valuators);
 }
 
 _X_EXPORT void
@@ -589,7 +592,7 @@ xf86PostButtonEvent(DeviceIntPtr	device,
                     ...)
 {
     va_list var;
-    int *valuators = NULL;
+    int valuators[MAX_VALUATORS];
     int i = 0, nevents = 0;
     int index;
 
@@ -600,18 +603,19 @@ xf86PostButtonEvent(DeviceIntPtr	device,
             return;
     }
 #endif
+    if (num_valuators > MAX_VALUATORS) {
+	xf86Msg(X_ERROR, "xf86PostMotionEvent: num_valuator %d"
+	    " is greater than MAX_VALUATORS\n", num_valuators);
+	return;
+    }
     
-    valuators = xcalloc(sizeof(int), num_valuators);
-
     va_start(var, num_valuators);
     for (i = 0; i < num_valuators; i++)
         valuators[i] = va_arg(var, int);
     va_end(var);
 
     if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");
 
     nevents = GetPointerEvents(xf86Events, device,
                                is_down ? ButtonPress : ButtonRelease, button,
@@ -621,8 +625,6 @@ xf86PostButtonEvent(DeviceIntPtr	device,
 
     for (i = 0; i < nevents; i++)
         mieqEnqueue(device, xf86Events + i);
-
-    xfree(valuators);
 }
 
 _X_EXPORT void
@@ -635,7 +637,8 @@ xf86PostKeyEvent(DeviceIntPtr	device,
                  ...)
 {
     va_list var;
-    int i = 0, nevents = 0, *valuators = NULL;
+    int i = 0, nevents = 0;
+    static int valuators[MAX_VALUATORS];
 
     /* instil confidence in the user */
     DebugF("this function has never been tested properly.  if things go quite "
@@ -643,12 +646,9 @@ xf86PostKeyEvent(DeviceIntPtr	device,
            "broken.\n");
 
     if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");
 
     if (is_absolute) {
-        valuators = xcalloc(sizeof(int), num_valuators);
         va_start(var, num_valuators);
         for (i = 0; i < num_valuators; i++)
             valuators[i] = va_arg(var, int);
@@ -658,7 +658,6 @@ xf86PostKeyEvent(DeviceIntPtr	device,
                                             is_down ? KeyPress : KeyRelease,
                                             key_code, first_valuator,
                                             num_valuators, valuators);
-        xfree(valuators);
     }
     else {
         nevents = GetKeyboardEvents(xf86Events, device,
@@ -687,9 +686,7 @@ xf86PostKeyboardEvent(DeviceIntPtr      device,
 #endif
 
     if (!xf86Events)
-        xf86Events = (xEvent *)xcalloc(sizeof(xEvent), GetMaximumEventsNum());
-    if (!xf86Events)
-        FatalError("Couldn't allocate event store\n");
+        FatalError("Didn't allocate event store\n");
 
     nevents = GetKeyboardEvents(xf86Events, device,
                                 is_down ? KeyPress : KeyRelease, key_code);