###############################################################################

# Copyright (c) 2008, 2013, Oracle and/or its affiliates. All rights reserved.

#

# Permission is hereby granted, free of charge, to any person obtaining a

# copy of this software and associated documentation files (the "Software"),

# to deal in the Software without restriction, including without limitation

# the rights to use, copy, modify, merge, publish, distribute, sublicense,

# and/or sell copies of the Software, and to permit persons to whom the

# Software is furnished to do so, subject to the following conditions:

#

# The above copyright notice and this permission notice (including the next

# paragraph) shall be included in all copies or substantial portions of the

# Software.

#

# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL

# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING

# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER

# DEALINGS IN THE SOFTWARE.

#

4614834: Xlib color functions are not MT-safe

In a multithreaded Xlib client:

* concurrent access to XAllocNamedColor() make the client crash

* concurrent access to XLookupColor() make the client crash

The cause of the problem is that in multithread environment some data

in XLookupColor() and XAllocNamedColor() can be accessed/modified at

same time by multi threads. Adding some lock and unlock code to make

sure only one thread can access the data at one time fixed the

problem.

diff --git a/src/GetColor.c b/src/GetColor.c

index cd0eb9f..62b3bce 100644

--- a/src/GetColor.c

+++ b/src/GetColor.c

@@ -55,12 +55,14 @@ XColor *exact_def) /* RETURN */

if ((ccc = XcmsCCCOfColormap(dpy, cmap)) != (XcmsCCC)NULL) {

const char *tmpName = colorname;

+ LockDisplay(dpy);

switch (_XcmsResolveColorString(ccc, &tmpName, &cmsColor_exact,

XcmsRGBFormat)) {

case XcmsSuccess:

case XcmsSuccessWithCompression:

_XcmsRGB_to_XColor(&cmsColor_exact, exact_def, 1);

memcpy((char *)hard_def, (char *)exact_def, sizeof(XColor));

+ UnlockDisplay(dpy);

ret = XAllocColor(dpy, cmap, hard_def);

exact_def->pixel = hard_def->pixel;

return(ret);

@@ -73,6 +75,7 @@ XColor *exact_def) /* RETURN */

*/

break;

}

+ UnlockDisplay(dpy);

}

#endif

diff --git a/src/LookupCol.c b/src/LookupCol.c

index f7f969f..718e043 100644

--- a/src/LookupCol.c

+++ b/src/LookupCol.c

@@ -53,6 +53,7 @@ XLookupColor (

if ((ccc = XcmsCCCOfColormap(dpy, cmap)) != (XcmsCCC)NULL) {

const char *tmpName = spec;

+ LockDisplay(dpy);

switch (_XcmsResolveColorString(ccc, &tmpName, &cmsColor_exact,

XcmsRGBFormat)) {

case XcmsSuccess:

@@ -60,6 +61,7 @@ XLookupColor (

_XcmsRGB_to_XColor(&cmsColor_exact, def, 1);

memcpy((char *)scr, (char *)def, sizeof(XColor));

_XUnresolveColor(ccc, scr);

+ UnlockDisplay(dpy);

return(1);

case XcmsFailure:

case _XCMS_NEWNAME:

@@ -70,6 +72,7 @@ XLookupColor (

*/

break;

}

+ UnlockDisplay(dpy);

}

#endif