[Xcb] [Bug 99946] New: xcb_send_event() reads beyond end of argument / is hard to use correctly

[b***@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=99946

Bug ID: 99946
Summary: xcb_send_event() reads beyond end of argument / is
hard to use correctly
Product: XCB
Version: unspecified
Hardware: Other
OS: All
Status: NEW
Severity: normal
Priority: medium
Component: Library
Assignee: ***@lists.freedesktop.org
Reporter: ***@znc.in
QA Contact: ***@lists.freedesktop.org

https://bugreports.qt.io/browse/QTBUG-56518 is about valgrind warnings that
occur in Qt. The code in question does basically:

xcb_unmap_notify_event_t event;
set all fields of event;
xcb_send_event(c, false, root, mask, &event);

The problem here is that sizeof(event) is 16 while xcb_send_event() expects 32
bytes of event data. So the argument needs to be "something bigger". This is
quite unintuitive and it seems like everyone using xcb_send_event() is getting
this wrong. (I would claim that I know may way around XCB and I did not know
this!)

Can there be a version of xcb_send_event() which gets a length argument? Are
there any other ideas on how this could be made safer or more obvious?

[b***@freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=99946

--- Comment #1 from Josh Triplett <***@freedesktop.org> ---
Events always have exactly 32 bytes on the wire; they don't have length fields.
I think the specification of the existing xcb_send_event assumed that all
event senders would provide 32 bytes to avoid copies. However, I'd agree that
that makes it harder to use, and more importantly much easier to misuse.

A hypothetical xcb_send_event with a length could avoid copies by using writev
and having a fixed-size 32-byte array of padding to use as varying amounts of
as the other half.