Fix junk data being returned with incremental selection transfers

* src/xselect.c (receive_incremental_selection): New arg
REAL_BYTES_RET.  Set it to the actual size instead of using the
size of the array after it was grown by xpalloc.
(x_get_window_property_as_lisp_data): Adjust call to
receive_incremental_selection.

1 files changed, 29 insertions, 5 deletions

diff --git a/src/xselect.c b/src/xselect.c
index bab0400540e..74d762f3055 100644
--- a/src/xselect.c
+++ b/src/xselect.c
@@ -1567,7 +1567,8 @@ receive_incremental_selection (struct x_display_info *dpyinfo,
 			       unsigned char **data_ret,
 			       ptrdiff_t *size_bytes_ret,
 			       Atom *type_ret, int *format_ret,
-			       unsigned long *size_ret)
+			       unsigned long *size_ret,
+			       ptrdiff_t *real_bytes_ret)
 {
   ptrdiff_t offset = 0;
   struct prop_location *wait_object;
@@ -1622,7 +1623,8 @@ receive_incremental_selection (struct x_display_info *dpyinfo,
 
       if (tmp_size_bytes == 0) /* we're done */
 	{
-	  TRACE0 ("Done reading incrementally");
+	  TRACE1 ("Done reading incrementally; total bytes: %"pD"d",
+		  *size_bytes_ret);
 
 	  if (! waiting_for_other_props_on_window (display, window))
 	    XSelectInput (display, window, STANDARD_EVENT_SET);
@@ -1652,6 +1654,19 @@ receive_incremental_selection (struct x_display_info *dpyinfo,
       memcpy ((*data_ret) + offset, tmp_data, tmp_size_bytes);
       offset += tmp_size_bytes;
 
+      /* *size_bytes_ret is not really the size of the data inside the
+	 buffer; it is the size of the buffer allocated by xpalloc.
+
+	 This matters when the cardinal specified in the INCR property
+	 (a _lower bound_ on the size of the selection data) is
+	 smaller than the actual selection contents, which can happen
+	 when programs are streaming selection data from a file
+	 descriptor.  In that case, we used to return junk if xpalloc
+	 decided to grow the buffer by more than the provided
+	 increment; to avoid that, store the actual size of the
+	 selection data in *real_bytes_ret.  */
+      *real_bytes_ret += tmp_size_bytes;
+
       /* Use xfree, not XFree, because x_get_window_property
 	 calls xmalloc itself.  */
       xfree (tmp_data);
@@ -1674,10 +1689,14 @@ x_get_window_property_as_lisp_data (struct x_display_info *dpyinfo,
   int actual_format;
   unsigned long actual_size;
   unsigned char *data = 0;
-  ptrdiff_t bytes = 0;
+  ptrdiff_t bytes = 0, array_bytes;
   Lisp_Object val;
   Display *display = dpyinfo->display;
 
+  /* array_bytes is only used as an argument to xpalloc.  The actual
+     size of the data inside the buffer is inside bytes.  */
+  array_bytes = 0;
+
   TRACE0 ("Reading selection data");
 
   x_get_window_property (display, window, property, &data, &bytes,
@@ -1718,10 +1737,15 @@ x_get_window_property_as_lisp_data (struct x_display_info *dpyinfo,
 	 calls xmalloc itself.  */
       xfree (data);
       unblock_input ();
+
+      /* Clear bytes again.  Previously, receive_incremental_selection
+	 would set this to min_size_bytes, but that is now done to
+	 array_bytes instead.  */
+      bytes = 0;
       receive_incremental_selection (dpyinfo, window, property, target_type,
-				     min_size_bytes, &data, &bytes,
+				     min_size_bytes, &data, &array_bytes,
 				     &actual_type, &actual_format,
-				     &actual_size);
+				     &actual_size, &bytes);
     }
 
   if (!for_multiple)