Close a timing hole in selections.

Fixes: debbugs:16737
* src/xselect.c (x_reply_selection_request)
(receive_incremental_selection): Call set_property_change_object
inside block_input.
(wait_for_property_change): Move set property_change_reply(_object)
outside of this function.
(set_property_change_object): New function.

diff --git a/src/ChangeLog b/src/ChangeLog
index 09225f26dfc538798029024a1f3ef603077063fc..1c3f933d7d86b7a702f6abc313fbf99378f6f143 100644 (file)
--- a/src/ChangeLog
+++ b/src/ChangeLog
@@ -1,3 +1,12 @@
+2015-04-04  Jan Djärv  <jan.h.d@swipnet.se>
+
+       * xselect.c (x_reply_selection_request)
+       (receive_incremental_selection): Call set_property_change_object
+       inside block_input.
+       (wait_for_property_change): Move set property_change_reply(_object)
+       outside of this function (Bug#16737).
+       (set_property_change_object): New function.
+
 2015-04-03  Jan Djärv  <jan.h.d@swipnet.se>
 
        * xterm.c (handle_one_xevent): Always redraw tool tips on

diff --git a/src/xselect.c b/src/xselect.c
index 027192dfea288889857394e30a531181c629f987..1570c4fef9c03e7ddc9f16620ecf0541e550a296 100644 (file)
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -531,6 +531,16 @@ static struct prop_location *property_change_reply_object;
 
 static struct prop_location *property_change_wait_list;
 
+static void
+set_property_change_object (struct prop_location *location)
+{
+  /* Input must be blocked so we don't get the event before we set these.  */
+  if (! input_blocked_p ())
+    emacs_abort ();
+  XSETCAR (property_change_reply, Qnil);
+  property_change_reply_object = location;
+}
+
 \f
 /* Send the reply to a selection request event EVENT.  */
 
@@ -633,6 +643,11 @@ x_reply_selection_request (struct input_event *event,
       {
        int format_bytes = cs->format / 8;
        bool had_errors_p = x_had_errors_p (display);
+
+        /* Must set this inside block_input ().  unblock_input may read
+           events and setting property_change_reply in
+           wait_for_property_change is then too late.  */
+        set_property_change_object (cs->wait_object);
        unblock_input ();
 
        bytes_remaining = cs->size;
@@ -673,6 +688,8 @@ x_reply_selection_request (struct input_event *event,
                             : format_bytes);
            XFlush (display);
            had_errors_p = x_had_errors_p (display);
+            // See comment above about property_change_reply.
+            set_property_change_object (cs->wait_object);
            unblock_input ();
 
            if (had_errors_p) break;
@@ -1059,14 +1076,11 @@ wait_for_property_change (struct prop_location *location)
 {
   ptrdiff_t count = SPECPDL_INDEX ();
 
-  if (property_change_reply_object)
-    emacs_abort ();
-
   /* Make sure to do unexpect_property_change if we quit or err.  */
   record_unwind_protect_ptr (wait_for_property_change_unwind, location);
 
-  XSETCAR (property_change_reply, Qnil);
-  property_change_reply_object = location;
+  /* See comment in x_reply_selection_request about setting
+     property_change_reply.  Do not do it here.  */
 
   /* If the event we are waiting for arrives beyond here, it will set
      property_change_reply, because property_change_reply_object says so.  */
@@ -1381,6 +1395,8 @@ receive_incremental_selection (struct x_display_info *dpyinfo,
   wait_object = expect_property_change (display, window, property,
                                        PropertyNewValue);
   XFlush (display);
+  // See comment in x_reply_selection_request about property_change_reply.
+  set_property_change_object (wait_object);
   unblock_input ();
 
   while (true)
@@ -1419,6 +1435,8 @@ receive_incremental_selection (struct x_display_info *dpyinfo,
       XDeleteProperty (display, window, property);
       wait_object = expect_property_change (display, window, property,
                                            PropertyNewValue);
+      // See comment in x_reply_selection_request about property_change_reply.
+      set_property_change_object (wait_object);
       XFlush (display);
       unblock_input ();