libX11: Changes to 'master'

Alan Coopersmith alanc at kemper.freedesktop.org
Thu Feb 17 20:56:56 PST 2011


 modules/im/ximcp/imLcPrs.c |    5 +++--
 src/Region.c               |   13 +++++++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

New commits:
commit 993abe751f4141f54d8d28b8b73588a1c9085970
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Fri Feb 11 14:49:17 2011 -0800

    Clean up memory when first XCreateRegion succeeds and second fails
    
    Error: Memory leak (CWE 401)
       Memory leak of pointer 's' allocated with XCreateRegion()
            at line 387 of /export/alanc/X.Org/sx86-gcc/lib/libX11/src/Region.c in function 'XShrinkRegion'.
              's' allocated at line 387 with XCreateRegion().
              s leaks when s != 0 at line 387.
    Error: Memory leak (CWE 401)
       Memory leak of pointer 'tra' allocated with XCreateRegion()
            at line 1452 of /export/alanc/X.Org/sx86-gcc/lib/libX11/src/Region.c in function 'XXorRegion'.
              'tra' allocated at line 1451 with XCreateRegion().
              tra leaks when tra != 0 at line 1451.
    
    [ This bug was found by the Parfait 0.3.6 bug checking tool.
      For more information see http://labs.oracle.com/projects/parfait/ ]
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>

commit 6ac417cea1136a3617f5e40f4b106aaa3f48d6c2
Author: Alan Coopersmith <alan.coopersmith at oracle.com>
Date:   Fri Feb 11 14:20:24 2011 -0800

    ximcp: Prevent memory leak & double free if multiple %L in string
    
    In the highly unlikely event that TransFileName was passed a path
    containing multiple %L entries, for each entry it would call
    _XlcFileName, leaking the previous results, and then for each entry it
    would copy from that pointer and free it, resulting in invalid pointers
    & possible double frees for each use after the first one freed it.
    
    Error: Use after free (CWE 416)
       Use after free of pointer 'lcCompose'
            at line 358 of modules/im/ximcp/imLcPrs.c in function 'TransFileName'.
              Previously freed at line 360 with free.
    Error: Use after free (CWE 416)
       Use after free of pointer 'lcCompose'
            at line 359 of modules/im/ximcp/imLcPrs.c in function 'TransFileName'.
              Previously freed at line 360 with free.
    Error: Double free (CWE 415)
       Double free of pointer 'lcCompose'
            at line 360 of modules/im/ximcp/imLcPrs.c in function 'TransFileName'.
              Previously freed at line 360 with free.
    
    [ This bug was found by the Parfait 0.3.6 bug checking tool.
      For more information see http://labs.oracle.com/projects/parfait/ ]
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>



More information about the xorg-commit mailing list