xcb: Remove free XID cache

cairo-xcb kept a cache of free xid to avoid calling xcb_generate_id()
later. However, this is unsafe: When libxcb runs out of ids, it asks the
X11 server for an empty range of ids to use. The X11 server of course
does not know about cairo's cache and could hand out an id that cairo
will use again later. This would then result in BadIdChoice errors
later.

Fix this by simply removing the whole cache.

Fixes: https://gitlab.freedesktop.org/cairo/cairo/-/issues/434
Signed-off-by: Uli Schlachter <psychon@znc.in>

1 files changed, 2 insertions, 48 deletions

diff --git a/src/cairo-xcb-connection.c b/src/cairo-xcb-connection.c
index 51f5ee323..2c58cca70 100644
--- a/src/cairo-xcb-connection.c
+++ b/src/cairo-xcb-connection.c
@@ -255,7 +255,7 @@ pixmap_depths_usable (cairo_xcb_connection_t *connection,
     cairo_bool_t success = TRUE;
     int depth, i, j;
 
-    pixmap = _cairo_xcb_connection_get_xid (connection);
+    pixmap = xcb_generate_id (connection->xcb_connection);
 
     for (depth = 1, i = 0; depth <= 32; depth++) {
 	if (missing & DEPTH_MASK(depth)) {
@@ -275,8 +275,6 @@ pixmap_depths_usable (cairo_xcb_connection_t *connection,
 	free (create_error);
     }
 
-    _cairo_xcb_connection_put_xid (connection, pixmap);
-
     return success;
 }
 
@@ -462,10 +460,9 @@ can_use_shm (cairo_xcb_connection_t *connection)
 	return FALSE;
     }
 
-    shmseg = _cairo_xcb_connection_get_xid (connection);
+    shmseg = xcb_generate_id (connection->xcb_connection);
     cookie[0] = xcb_shm_attach_checked (c, shmseg, shmid, FALSE);
     cookie[1] = xcb_shm_detach_checked (c, shmseg);
-    _cairo_xcb_connection_put_xid (connection, shmseg);
 
     error = xcb_request_check (c, cookie[0]);
     if (error != NULL)
@@ -586,8 +583,6 @@ _device_destroy (void *device)
 #endif
     _cairo_freepool_fini (&connection->shm_info_freelist);
 
-    _cairo_freepool_fini (&connection->xid_pool);
-
     CAIRO_MUTEX_FINI (connection->shm_mutex);
     CAIRO_MUTEX_FINI (connection->screens_mutex);
 
@@ -662,10 +657,6 @@ _cairo_xcb_connection_get (xcb_connection_t *xcb_connection)
 	goto unlock;
     }
 
-    cairo_list_init (&connection->free_xids);
-    _cairo_freepool_init (&connection->xid_pool,
-			  sizeof (cairo_xcb_xid_t));
-
     cairo_list_init (&connection->shm_pools);
     cairo_list_init (&connection->shm_pending);
     _cairo_freepool_init (&connection->shm_info_freelist,
@@ -766,43 +757,6 @@ _cairo_xcb_connection_get_xrender_format_for_visual (cairo_xcb_connection_t *con
     return format ? format->xrender_format : XCB_NONE;
 }
 
-void
-_cairo_xcb_connection_put_xid (cairo_xcb_connection_t *connection,
-			       uint32_t xid)
-{
-    cairo_xcb_xid_t *cache;
-
-    assert (CAIRO_MUTEX_IS_LOCKED (connection->device.mutex));
-    cache = _cairo_freepool_alloc (&connection->xid_pool);
-    if (likely (cache != NULL)) {
-	cache->xid = xid;
-	cairo_list_add (&cache->link, &connection->free_xids);
-    }
-}
-
-uint32_t
-_cairo_xcb_connection_get_xid (cairo_xcb_connection_t *connection)
-{
-    uint32_t xid;
-
-    assert (CAIRO_MUTEX_IS_LOCKED (connection->device.mutex));
-    if (! cairo_list_is_empty (&connection->free_xids)) {
-	cairo_xcb_xid_t *cache;
-
-	cache = cairo_list_first_entry (&connection->free_xids,
-					cairo_xcb_xid_t,
-					link);
-	xid = cache->xid;
-
-	cairo_list_del (&cache->link);
-	_cairo_freepool_free (&connection->xid_pool, cache);
-    } else {
-	xid = xcb_generate_id (connection->xcb_connection);
-    }
-
-    return xid;
-}
-
 /**
  * cairo_xcb_device_get_connection:
  * @device: a #cairo_device_t for the XCB backend