Bug 25209

I fixed on Opensolaris. I'll summit patch with Xorg patch format.

There's no followup, and I was unable to find any information in Sun/Oracle's
bug-tracking.

Let's close as invalid, this can be reopened if more information or a patch is provided.

The submitter no longer works at Sun/Oracle, so the e-mail to him would be
bouncing.

The fix he applied to the OpenSolaris libX11 can be seen at:
http://src.opensolaris.org/source/xref/x-cons/xnv-clone/open-src/lib/libX11/6714036.patch

The explanation provided by another engineer in the Sun internal bug database
(which unfortunately isn't part of what's exported to the external view shown
 in the bug report in the URL link):

  The problem here is not in xterm, but in libX11.

  xterm calls XmbTextListToTextProperty to convert the highlighted text
  to UTF8 when its selection is requested by the paster.  *This*
  function silently truncates the amount of data it will convert to 1K,
  resulting in the apparent malfunction in xterm.

  XmbTextListToTextProperty() eventually calls indirect_convert(),
  which does a conversion by performing two conversion steps through an
  intermediate format.  It does so piecemeal using a 1K temporary
  buffer:

    128 static int
    129 indirect_convert(
    ...
    137 {
    ...
    142     char buf[BUFSIZ], *cs;
    ...
    156     while (*from_left > 0) {
    157         cs = buf;
    158         cs_left = BUFSIZ;
    159         tmp_args[0] = (XPointer) &charset;
    160 
    161         ret = (*from_conv->methods->convert)(from_conv, from, from_left, &cs,
    162                                              &cs_left, tmp_args, 1);
    ...
    168         length = cs - buf;
    169         if (length > 0) {
    170             cs_left = length;
    171             cs = buf;
    172 
    173             tmp_args[0] = (XPointer) charset;
    174 
    175             ret = (*to_conv->methods->convert)(to_conv, &cs, &cs_left, to, to_left,
    176                                                tmp_args, 1);

  This by itself is innocuous, but the 1K buffer size seems like
  too much of a coincidence to ignore.  The conversion function
  called by indirect_convert, mbstocs(), itself calls a second
  function, mbtocs(), that turns out to be the cause:

    1754 mbtocs(
    1755     XlcConv conv,
    1756     XPointer *from,
    1757     int *from_left,
    1758     XPointer *to,
    1759     int *to_left,
    1760     XPointer *args,
    1761     int num_args)
    1762 {
    ...
    1789     if (*from_left > *to_left)
    1790         *from_left = *to_left;
    1791
    1792     while (*from_left && *to_left) {
    ...

  All these functions take a pointer to the number of remaining input
  and output bytes, so the caller can tell how much of the input was
  converted and how much of the output buffer is left.  When clamping
  the number of bytes to convert, however, this function lies to its
  caller -- and the rest of the conversion stack -- claiming that all
  input bytes had been converted.  Since the intermediate output buffer
  provided by indirect_convert() is 1K in size, only 1K of input is
  converted.

I'm getting a timeout connecting to that URL.  It looks like 
src.opensolaris.org is down.

Alan, could you please send the patch in question to the list for review?  
Thanks.

(In reply to comment #5)
> I'm getting a timeout connecting to that URL.  It looks like 
> src.opensolaris.org is down.
> 
> Alan, could you please send the patch in question to the list for review?  
> Thanks.

The data center containing both the opensolaris.org machines and our source
repositories is down for maintenance on the building's power system this 
weekend - should be back online Monday morning, and I'll try to remember to
forward the patch after that.

(If you can't wait, a community provided mirror is at:
http://hg.openindiana.org/upstream/oracle/xnv/file/3838ec082c2e/open-src/lib/libX11/6714036.patch )

Patch submitted for review: http://patchwork.freedesktop.org/patch/7585/

No review after a week so went ahead and pushed.

http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=002b36e308a26a152504f9b40aa08a0dce9a7991