wmsetbg: free the previous root pixmap via the ESETROOT pairing

Commit 6c107e0c switched duplicatePixmap() to RetainTemporary and
removed XKillClient() from setPixmapProperty(). RetainTemporary
resources are released only on server reset, so each background change
now leaves a full-screen pixmap retained in the X server until logout.
In helper mode that is one leak per workspace switch.

po/Makefile.am

@@ -7,7 +7,7 @@ CLEANFILES = $(CATALOGS) $(DOMAIN).pot
 # Please keep this sorted in alphabetic order!
 EXTRA_DIST = be.po bg.po bs.po ca.po cs.po da.po de.po el.po es.po et.po \
 	fi.po fr.po fy.po gl.po hr.po hu.po hy.po it.po ja.po ko.po ms.po nl.po \
-	no.po pl.po pt.po ro.po ru.po sk.po sr.po sv.po tr.po uk.po zh_CN.po \
+	no.po pl.po pt.po pt_BR.po ro.po ru.po sk.po sr.po sv.po tr.po uk.po zh_CN.po \
 	zh_TW.po
 
 POTFILES  = \

po/README

@@ -3,7 +3,8 @@ File	Language	Note	Current Maintainer
 ja.po	Japanese	1	ABE Shige <sabe@ibm.net>
 				MANOME Tomonori <manome@itlb.te.noda.sut.ac.jp>
 				Takeo Hashimoto <HashimotoTakeo@mac.com>
-pt.po	Portuguese		Eliphas Levy Theodoro <eliphas@conectiva.com.br>
+pt_BR.po Brazilian Portuguese	Eliphas Levy Theodoro <eliphas@conectiva.com.br>
+pt.po	Portuguese		Hugo Carvalho <hugokarvalho@hotmail.com>
 de.po	German			Torsten Marek <torsten.marek@vbdnet.de>
 				Bernd Eggert <Bernd.Eggert@t-online.de>
 				Matthias Warkus <mawarkus@t-online.de>

src/screen.c

@@ -1143,6 +1143,7 @@ static XImage *imageCaptureArea(WScreen *scr)
 			GrabModeAsync, None, wPreferences.cursor[WCUR_CAPTURE], CurrentTime) != Success) {
 		return NULL;
 	}
+	XGrabKeyboard(dpy, scr->root_win, False, GrabModeAsync, GrabModeAsync, CurrentTime);
 
 	XGrabServer(dpy);
 
@@ -1162,12 +1163,17 @@ static XImage *imageCaptureArea(WScreen *scr)
 				if (w > 0 && h > 0) {
 					XDrawRectangle(dpy, scr->root_win, scr->frame_gc, x, y, w, h);
 					XUngrabServer(dpy);
+					XUngrabKeyboard(dpy, CurrentTime);
 					XUngrabPointer(dpy, CurrentTime);
 					return XGetImage(dpy, scr->root_win, x, y, w, h, AllPlanes, ZPixmap);
 				}
 			}
 			break;
 		case MotionNotify:
+			/* drop stale root MotionNotify still queued from before
+			 * the grab, otherwise the rectangle anchors at (-1,-1) */
+			if (xp < 0)
+				break;
 			XDrawRectangle(dpy, scr->root_win, scr->frame_gc, x, y, w, h);
 			x = event.xmotion.x_root;
                         if (x < xp) {
@@ -1186,8 +1192,11 @@ static XImage *imageCaptureArea(WScreen *scr)
 			XDrawRectangle(dpy, scr->root_win, scr->frame_gc, x, y, w, h);
 			break;
 		case KeyPress:
-			if (W_KeycodeToKeysym(dpy, event.xkey.keycode, 0) == XK_Escape)
+			if (W_KeycodeToKeysym(dpy, event.xkey.keycode, 0) == XK_Escape) {
+				if (w > 0 && h > 0)
+					XDrawRectangle(dpy, scr->root_win, scr->frame_gc, x, y, w, h);
 				quit = 1;
+			}
 			break;
 		default:
 			WMHandleEvent(&event);
@@ -1196,6 +1205,7 @@ static XImage *imageCaptureArea(WScreen *scr)
 	}
 
 	XUngrabServer(dpy);
+	XUngrabKeyboard(dpy, CurrentTime);
 	XUngrabPointer(dpy, CurrentTime);
 	return NULL;
 }

src/startup.c

@@ -387,7 +387,6 @@ static char *atomNames[] = {
 	"_WINDOWMAKER_COMMAND",
 	"_WINDOWMAKER_ICON_SIZE",
 	"_WINDOWMAKER_ICON_TILE",
-	"_WINDOWMAKER_MARK_KEY",
 
 	GNUSTEP_WM_ATTR_NAME,
 	GNUSTEP_WM_MINIATURIZE_WINDOW,
@@ -395,7 +394,9 @@ static char *atomNames[] = {
 
 	"_GTK_APPLICATION_OBJECT_PATH",
 
-	"WM_IGNORE_FOCUS_EVENTS"
+	"WM_IGNORE_FOCUS_EVENTS",
+
+	"_WINDOWMAKER_MARK_KEY"
 };
 
 /*

src/wmspec.c

@@ -408,6 +408,8 @@ static RImage *makeRImageFromARGBData(unsigned long *data)
 		return NULL;
 
 	image = RCreateImage(width, height, True);
+	if (!image)
+		return NULL;
 
 	for (imgdata = image->data, i = 2; i < size + 2; i++, imgdata += 4) {
 		pixel = data[i];
@@ -458,9 +460,11 @@ static RImage *findBestIcon(unsigned long *data, unsigned long items)
 		/* get the current icon's size */
 		sx = (int)data[i];
 		sy = (int)data[i + 1];
-		if ((sx < 1) || (sy < 1))
+		if (sx < 1 || sy < 1 || sx > 4096 || sy > 4096)
+			break;
+		size = (unsigned long)sx * (unsigned long)sy + 2;
+		if ((unsigned long)size > items - i)
 			break;
-		size = sx * sy + 2;
 
 		/* check the size difference if it's not too large */
 		if ((sx <= wanted) && (sy <= wanted)) {
@@ -485,8 +489,12 @@ static RImage *findBestIcon(unsigned long *data, unsigned long items)
 	 * small image by a small scale. */
 	largest = 0;
 	for (i = 0L; i < items - 1;) {
-		size = (int)data[i] * (int)data[i + 1];
-		if (size == 0)
+		sx = (int)data[i];
+		sy = (int)data[i + 1];
+		if (sx < 1 || sy < 1 || sx > 4096 || sy > 4096)
+			break;
+		size = (unsigned long)sx * (unsigned long)sy;
+		if ((unsigned long)size + 2 > items - i)
 			break;
 		if (size > largest) {
 			icon = &data[i];

util/wmsetbg.c

@@ -811,38 +811,67 @@ static int dummyErrorHandler(Display * dpy, XErrorEvent * err)
 	return 0;
 }
 
-static void setPixmapProperty(Pixmap pixmap)
+static Bool getRootPixmapAtom(Atom prop, Pixmap *ret)
 {
-	static Atom prop = 0;
 	Atom type;
 	int format;
 	unsigned long length, after;
-	unsigned char *data;
-	int mode;
+	unsigned char *data = NULL;
+
+	*ret = None;
+	if (XGetWindowProperty(dpy, root, prop, 0L, 1L, False, AnyPropertyType,
+			       &type, &format, &length, &after, &data) != Success)
+		return False;
+	if (type == XA_PIXMAP && format == 32 && length == 1 && data) {
+		*ret = *(Pixmap *)data;
+		XFree(data);
+		return True;
+	}
+	if (data)
+		XFree(data);
+	return False;
+}
+
+static void setPixmapProperty(Pixmap pixmap)
+{
+	static Atom prop = 0;
+	static Atom eprop = 0;
+	Pixmap old_root, old_eset;
+	Bool have_root, have_eset;
 
 	if (!prop) {
 		prop = XInternAtom(dpy, "_XROOTPMAP_ID", False);
+		eprop = XInternAtom(dpy, "ESETROOT_PMAP_ID", False);
 	}
 
 	XGrabServer(dpy);
 
-	/* Clear out the old pixmap */
-	XGetWindowProperty(dpy, root, prop, 0L, 1L, False, AnyPropertyType,
-			   &type, &format, &length, &after, &data);
-
-	if ((type == XA_PIXMAP) && (format == 32) && (length == 1)) {
+	/* Free the previous background pixmap only when both _XROOTPMAP_ID
+	 * and ESETROOT_PMAP_ID hold the same XID, that pairing marks a
+	 * RetainPermanent zombie left by a compliant root setter so
+	 * XKillClient on it cannot hit a live connection.  A bare
+	 * _XROOTPMAP_ID may come from a tool that closed in Destroy mode,
+	 * in which case the client bits of the stored XID can already be
+	 * recycled to a live client, including our own dpy, and killing
+	 * it produces "X connection broken". */
+	have_root = getRootPixmapAtom(prop, &old_root);
+	have_eset = getRootPixmapAtom(eprop, &old_eset);
+	if (have_root && have_eset && old_root == old_eset && old_eset != None) {
 		XSetErrorHandler(dummyErrorHandler);
-		XKillClient(dpy, *((Pixmap *) data));
+		XKillClient(dpy, old_eset);
 		XSync(dpy, False);
 		XSetErrorHandler(NULL);
-		mode = PropModeReplace;
-	} else {
-		mode = PropModeAppend;
 	}
-	if (pixmap)
-		XChangeProperty(dpy, root, prop, XA_PIXMAP, 32, mode, (unsigned char *)&pixmap, 1);
-	else
+
+	if (pixmap) {
+		XChangeProperty(dpy, root, prop, XA_PIXMAP, 32, PropModeReplace,
+				(unsigned char *)&pixmap, 1);
+		XChangeProperty(dpy, root, eprop, XA_PIXMAP, 32, PropModeReplace,
+				(unsigned char *)&pixmap, 1);
+	} else {
 		XDeleteProperty(dpy, root, prop);
+		XDeleteProperty(dpy, root, eprop);
+	}
 
 	XUngrabServer(dpy);
 	XFlush(dpy);