Date: Mon, 07 Nov 2011 22:09:34 -0800
From: Keith Packard <keithp@keithp.com>
Subject: Re: X server SIGSEGV?

If you aren't using the Record extension (and you aren't), you can work
around the bug by moving the code which accesses the (non-existant)
request buffer inside the loop looking at the recording contexts (of
which there should be none):

diff --git a/record/record.c b/record/record.c
index 68311ac..9e36103 100644
--- a/record/record.c
+++ b/record/record.c
@@ -603,12 +603,10 @@ RecordAReply(CallbackListPtr *pcbl, pointer nulldata, pointer calldata)
     RecordContextPtr pContext;
     RecordClientsAndProtocolPtr pRCAP;
     int eci;
-    int majorop;
     ReplyInfoRec *pri = (ReplyInfoRec *)calldata;
     ClientPtr client = pri->client;
     REQUEST(xReq);
 
-    majorop = stuff->reqType;
     for (eci = 0; eci < numEnabledContexts; eci++)
     {
 	pContext = ppAllContexts[eci];
@@ -616,6 +614,7 @@ RecordAReply(CallbackListPtr *pcbl, pointer nulldata, pointer calldata)
 					  NULL);
 	if (pRCAP)
 	{
+	    int majorop = stuff->reqType;
 	    if (pContext->continuedReply)
 	    {
 		RecordAProtocolElement(pContext, client, XRecordFromServer,

I'll see if I can't get someone to fix this for real...