Make WriteEventsToClient/WriteToClient no-op on fake or dead clients.

 This matches the test in TryClientEvents, and is a superset of tests
 done by the callers of these functions. The consequence of forgetting
 these tests is a server crash, so they're always desirable. In my
 opinion, it's better to not require the callers to remember to do these
 checks.

 For callers that don't do very much work before calling WriteToClient or
 WriteEventsToClient, I've removed the redundant checks.

 Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=27497
 Signed-off-by: Jamey Sharp <jamey@minilop.net>
 Cc: Chris Wilson <chris@chris-wilson.co.uk>
 Reviewed-by: Julien Cristau <jcristau@debian.org>
 Reviewed-by: Adam Jackson <ajax@redhat.com>
 Backport to nx-libs: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

9 files changed, 20 insertions, 30 deletions

diff --git a/nx-X11/programs/Xserver/Xext/saver.c b/nx-X11/programs/Xserver/Xext/saver.c
index 10bb2dc2f..0c5d28eb2 100644
--- a/nx-X11/programs/Xserver/Xext/saver.c
+++ b/nx-X11/programs/Xserver/Xext/saver.c
@@ -467,8 +467,6 @@ SendScreenSaverNotify (pScreen, state, forced)
     for (pEv = pPriv->events; pEv; pEv = pEv->next)
     {
 	client = pEv->client;
-	if (client->clientGone)
-	    continue;
 	if (!(pEv->mask & mask))
 	    continue;
 	ev.type = ScreenSaverNotify + ScreenSaverEventBase;
diff --git a/nx-X11/programs/Xserver/Xext/security.c b/nx-X11/programs/Xserver/Xext/security.c
index fe741128e..4f055ffe0 100644
--- a/nx-X11/programs/Xserver/Xext/security.c
+++ b/nx-X11/programs/Xserver/Xext/security.c
@@ -310,15 +310,11 @@ SecurityDeleteAuthorization(
     {
 	/* send revocation event event */
 	ClientPtr client = rClient(pEventClient);
-
-	if (!client->clientGone)
-	{
-	    xSecurityAuthorizationRevokedEvent are;
-	    are.type = SecurityEventBase + XSecurityAuthorizationRevoked;
-	    are.sequenceNumber = client->sequence;
-	    are.authId = pAuth->id;
-	    WriteEventsToClient(client, 1, (xEvent *)&are);
-	}
+	xSecurityAuthorizationRevokedEvent are;
+	are.type = SecurityEventBase + XSecurityAuthorizationRevoked;
+	are.sequenceNumber = client->sequence;
+	are.authId = pAuth->id;
+	WriteEventsToClient(client, 1, (xEvent *)&are);
 	FreeResource(pEventClient->resource, RT_NONE);
     }
 
diff --git a/nx-X11/programs/Xserver/Xext/shape.c b/nx-X11/programs/Xserver/Xext/shape.c
index 76d1fdd77..80ef71f67 100644
--- a/nx-X11/programs/Xserver/Xext/shape.c
+++ b/nx-X11/programs/Xserver/Xext/shape.c
@@ -969,8 +969,6 @@ SendShapeNotify (pWin, which)
     }
     for (pShapeEvent = *pHead; pShapeEvent; pShapeEvent = pShapeEvent->next) {
 	client = pShapeEvent->client;
-	if (client == serverClient || client->clientGone)
-	    continue;
 	se.type = ShapeNotify + ShapeEventBase;
 	se.kind = which;
 	se.window = pWin->drawable.id;
diff --git a/nx-X11/programs/Xserver/Xext/sync.c b/nx-X11/programs/Xserver/Xext/sync.c
index 222ef0353..3eb45a246 100644
--- a/nx-X11/programs/Xserver/Xext/sync.c
+++ b/nx-X11/programs/Xserver/Xext/sync.c
@@ -563,17 +563,14 @@ SyncSendAlarmNotifyEvents(pAlarm)
     ane.state = pAlarm->state;
 
     /* send to owner */
-    if (pAlarm->events && !pAlarm->client->clientGone) 
+    if (pAlarm->events)
 	WriteEventsToClient(pAlarm->client, 1, (xEvent *) &ane);
 
     /* send to other interested clients */
     for (pcl = pAlarm->pEventClients; pcl; pcl = pcl->next)
     {
-	if (!pAlarm->client->clientGone)
-	{
-	    ane.sequenceNumber = pcl->client->sequence;
-	    WriteEventsToClient(pcl->client, 1, (xEvent *) &ane);
-	}
+	ane.sequenceNumber = pcl->client->sequence;
+	WriteEventsToClient(pcl->client, 1, (xEvent *) &ane);
     }
 }
 
diff --git a/nx-X11/programs/Xserver/damageext/damageext.c b/nx-X11/programs/Xserver/damageext/damageext.c
index b2ee82657..9ab5b6ad6 100755
--- a/nx-X11/programs/Xserver/damageext/damageext.c
+++ b/nx-X11/programs/Xserver/damageext/damageext.c
@@ -69,8 +69,7 @@ DamageExtNotify (DamageExtPtr pDamageExt, BoxPtr pBoxes, int nBoxes)
 	    ev.area.y = pBoxes[i].y1;
 	    ev.area.width = pBoxes[i].x2 - pBoxes[i].x1;
 	    ev.area.height = pBoxes[i].y2 - pBoxes[i].y1;
-	    if (!pClient->clientGone)
-		WriteEventsToClient (pClient, 1, (xEvent *) &ev);
+	    WriteEventsToClient (pClient, 1, (xEvent *) &ev);
 	}
     }
     else
@@ -79,8 +78,7 @@ DamageExtNotify (DamageExtPtr pDamageExt, BoxPtr pBoxes, int nBoxes)
 	ev.area.y = 0;
 	ev.area.width = pDrawable->width;
 	ev.area.height = pDrawable->height;
-	if (!pClient->clientGone)
-	    WriteEventsToClient (pClient, 1, (xEvent *) &ev);
+	WriteEventsToClient (pClient, 1, (xEvent *) &ev);
     }
     /* Composite extension marks clients with manual Subwindows as critical */
     if (pDamageClient->critical > 0)
diff --git a/nx-X11/programs/Xserver/dix/events.c b/nx-X11/programs/Xserver/dix/events.c
index 676640f01..4d1472cc8 100644
--- a/nx-X11/programs/Xserver/dix/events.c
+++ b/nx-X11/programs/Xserver/dix/events.c
@@ -4439,6 +4439,9 @@ WriteEventsToClient(ClientPtr pClient, int count, xEvent *events)
     xEvent    eventTo, *eventFrom;
     int       i;
 
+    if (!pClient || pClient == serverClient || pClient->clientGone)
+	return;
+
 #ifdef XKB
     if ((!noXkbExtension)&&(!XkbFilterEvents(pClient, count, events)))
 	return;
diff --git a/nx-X11/programs/Xserver/os/io.c b/nx-X11/programs/Xserver/os/io.c
index 234ce8b58..4d12c6e89 100644
--- a/nx-X11/programs/Xserver/os/io.c
+++ b/nx-X11/programs/Xserver/os/io.c
@@ -859,14 +859,16 @@ SetCriticalOutputPending(void)
 int
 WriteToClient (ClientPtr who, int count, char *buf)
 {
-    OsCommPtr oc = (OsCommPtr)who->osPrivate;
-    ConnectionOutputPtr oco = oc->output;
+    OsCommPtr oc;
+    ConnectionOutputPtr oco;
     int padBytes;
 #ifdef DEBUG_COMMUNICATION
     Bool multicount = FALSE;
 #endif
-    if (!count)
+    if (!count || !who || who == serverClient || who->clientGone)
 	return(0);
+    oc = who->osPrivate;
+    oco = oc->output;
 #ifdef DEBUG_COMMUNICATION
     {
 	char info[128];
diff --git a/nx-X11/programs/Xserver/xfixes/cursor.c b/nx-X11/programs/Xserver/xfixes/cursor.c
index 29c6061d6..747471e18 100755
--- a/nx-X11/programs/Xserver/xfixes/cursor.c
+++ b/nx-X11/programs/Xserver/xfixes/cursor.c
@@ -96,8 +96,7 @@ CursorDisplayCursor (ScreenPtr pScreen,
 	CursorCurrent = pCursor;
 	for (e = cursorEvents; e; e = e->next)
 	{
-	    if ((e->eventMask & XFixesDisplayCursorNotifyMask) &&
-		!e->pClient->clientGone)
+	    if ((e->eventMask & XFixesDisplayCursorNotifyMask))
 	    {
 		xXFixesCursorNotifyEvent	ev;
 		ev.type = XFixesEventBase + XFixesCursorNotify;
diff --git a/nx-X11/programs/Xserver/xfixes/select.c b/nx-X11/programs/Xserver/xfixes/select.c
index 2a20bfe87..540499518 100755
--- a/nx-X11/programs/Xserver/xfixes/select.c
+++ b/nx-X11/programs/Xserver/xfixes/select.c
@@ -79,8 +79,7 @@ XFixesSelectionCallback (CallbackListPtr *callbacks, void * data, void * args)
     for (e = selectionEvents; e; e = e->next)
     {
 	if (e->selection == selection->selection && 
-	    (e->eventMask & eventMask) &&
-	    !e->pClient->clientGone)
+	    (e->eventMask & eventMask))
 	{
 	    xXFixesSelectionNotifyEvent	ev;