Priority medium
Bug ID 66332
Assignee dri-devel@lists.freedesktop.org
Summary drmHandleEvent returns 0 on read() failure
Severity normal
Classification Unclassified
OS All
Reporter mgold@qnx.com
Hardware All
Status NEW
Version XOrg CVS
Component libdrm
Product DRI

drmHandleEvent contains this code:
        len = read(fd, buffer, sizeof buffer);
        if (len == 0)
                return 0;
        if (len < sizeof *e)
                return -1;
In the (len < sizeof *e) check, len gets promoted to size_t (which is
unsigned); so when len is negative "return -1" won't be executed. Instead, the
function continues to the end and returns 0. (The documentation states
drmHandleEvent will return -1 if the read fails.)

If there's an error like EBADF, the caller won't detect it and might end up
busy-waiting. Rewriting the condition as (len < (int)(sizeof *e)) will fix
this.


You are receiving this mail because: