JBR-3948 Linux: SIGSEGV at [libawt_xawt] Java_sun_awt_X11_XInputMethod_createXICNative

The crashes begin with the call to getDefaultConfig() in
createStatusWindow() returning garbage. With 8280468 fixed, there aren't
many reasons left for it to do so; it must be that the argument to the
call (the screen number) is out of range.

This change eliminates the possibilities to get an absolutely incorrect
screen number by checking the return values of several Xlib functions,
which, when fail, will leave their outgoing arguments uninitialized.
This, in turn, can lead to reading some random memory resulting in
equally random screen number that is later being fed to
getDefaultConfig().

Although on modern systems with Xinerama there should really be no
screen other than zero, as the last resort, this number is also
range-checked in getDefaultConfig() itself.

2 files changed, 10 insertions, 2 deletions

diff --git a/src/java.desktop/unix/native/libawt_xawt/awt/awt_GraphicsEnv.c b/src/java.desktop/unix/native/libawt_xawt/awt/awt_GraphicsEnv.c
index a451277d70e..fbac58237a5 100644
--- a/src/java.desktop/unix/native/libawt_xawt/awt/awt_GraphicsEnv.c
+++ b/src/java.desktop/unix/native/libawt_xawt/awt/awt_GraphicsEnv.c
@@ -786,6 +786,7 @@ AwtGraphicsConfigDataPtr
 getDefaultConfig(int screen) {
     // NB: should be invoked only while holding the AWT lock
     DASSERT(screen >= 0 && screen < awt_numScreens);
+    if (screen < 0 || screen >= awt_numScreens) return NULL;
     ensureConfigsInited(NULL, screen);
     return x11Screens[screen].defaultConfig;
 }
diff --git a/src/java.desktop/unix/native/libawt_xawt/awt/awt_InputMethod.c b/src/java.desktop/unix/native/libawt_xawt/awt/awt_InputMethod.c
index 5709fd59797..aafb1af3d81 100644
--- a/src/java.desktop/unix/native/libawt_xawt/awt/awt_InputMethod.c
+++ b/src/java.desktop/unix/native/libawt_xawt/awt/awt_InputMethod.c
@@ -604,12 +604,19 @@ static StatusWindow *createStatusWindow(Window parent) {
     Window rootWindow;
     Window *ignoreWindowPtr;
     unsigned int ignoreUnit;
+    Status rc;
 
-    XGetGeometry(dpy, parent, &rootWindow, &x, &y, &w, &h, &bw, &depth);
+    rc = XGetGeometry(dpy, parent, &rootWindow, &x, &y, &w, &h, &bw, &depth);
+    if (rc == 0) {
+        return NULL;
+    }
 
     attrib.override_redirect = True;
     attribmask = CWOverrideRedirect;
-    XGetWindowAttributes(dpy, parent, &xwa);
+    rc = XGetWindowAttributes(dpy, parent, &xwa);
+    if (rc == 0) {
+        return NULL;
+    }
     bw = 2; /*xwa.border_width does not have the correct value*/
 
     if (xwa.screen != NULL) {