glx: Fix synthetic error generation in __glXSendError

To quote Uli Schlachter, who understands this stuff more than I do:

>   The function __glXSendError() in mesa's src/glx/glx_error.c invents an X11
> protocol error out of thin air. For the sequence number it uses dpy->request.
> This is the sequence number of the last request that was sent. _XError() will
> then update dpy->last_request_read based on the sequence number of the error
> that just "came in".
>
>   If now another something comes in with a sequence number less than
> dpy->last_request_read, since sequence numbers are monotonically increasing,
> widen() will incorrectly add 1<<32 to the sequence number and things might go
> downhill afterwards.

`__glXSendErrorForXcb` was also patched, as that's the function that
`glXCreateContextAttribsARB` actually uses.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99781
Cc: mesa-stable@lists.freedesktop.org
Fixes: ad503c41 'apple: Initial import of libGL for OSX from AppleSGLX svn repository'
Reviewed-by: Adam Jackson <ajax@redhat.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
Signed-off-by: Hal Gentz <zegentzy@protonmail.com>

diff --git a/src/glx/glx_error.c b/src/glx/glx_error.c
index 653cbeb2d2a32a3504e1f383923e99cfe6468334..712ecf8213dfc15e1b95e9b5f54f78a5f785c1ea 100644 (file)
--- a/src/glx/glx_error.c
+++ b/src/glx/glx_error.c
@@ -54,7 +54,7 @@ __glXSendError(Display * dpy, int_fast8_t errorCode, uint_fast32_t resourceID,
       error.errorCode = glx_dpy->codes->first_error + errorCode;
    }
 
-   error.sequenceNumber = dpy->request;
+   error.sequenceNumber = dpy->last_request_read;
    error.resourceID = resourceID;
    error.minorCode = minorCode;
    error.majorCode = glx_dpy->majorOpcode;
@@ -73,7 +73,7 @@ __glXSendErrorForXcb(Display * dpy, const xcb_generic_error_t *err)
 
    error.type = X_Error;
    error.errorCode = err->error_code;
-   error.sequenceNumber = err->sequence;
+   error.sequenceNumber = dpy->last_request_read;
    error.resourceID = err->resource_id;
    error.minorCode = err->minor_code;
    error.majorCode = err->major_code;