xserver: Branch 'master' - 3 commits

[Adam Jackson]

 randr/rrcrtc.c   |   10 ++++------
 randr/rroutput.c |    9 +++------
 randr/rrscreen.c |    2 +-
 3 files changed, 8 insertions(+), 13 deletions(-)

New commits:
commit fc7fb5bbe1c8f787e53500b9a2ca4af815f310d1
Author: Giuseppe Bilotta <giuseppe.bilotta at gmail.com>
Date:   Thu Nov 9 10:21:21 2017 +0100

    randr: free crtc->outputs on destroy
    
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Giuseppe Bilotta <giuseppe.bilotta at gmail.com>

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index c904fa035..39af679b2 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -878,6 +878,7 @@ RRCrtcDestroyResource(void *value, XID pid)
     free(crtc->gammaRed);
     if (crtc->mode)
         RRModeDestroy(crtc->mode);
+    free(crtc->outputs);
     free(crtc);
     return 1;
 }
commit 16381d186e7c791031392ed8afcfd33009854e9e
Author: Giuseppe Bilotta <giuseppe.bilotta at gmail.com>
Date:   Thu Nov 9 10:21:20 2017 +0100

    randr: always realloc crtcs and outputs
    
    When the last crtc (resp. output) is destroyed, the rrScrPriv crtcs
    (resp. outputs) fields do not get cleared, which can lead to a situation
    where the private's numCrtcs (resp. numOutputs) field is zero, but the
    associated memory is still allocated. Just checking if numCrtcs (resp.
    numOutputs) is zero is thus not a good criteria to determine whetehr to
    use a realloc or a malloc.
    
    Since crtcs (resp. outputs) are NULL-initialized anyway, relying on
    numCrtcs (resp. numOutputs) is actually unnecessary, because
    reallocation of a NULL ptr is equivalent to a malloc anyway.
    
    Therefore, just use realloc() unconditionally, and ensure that the
    fields are properly initialized.
    
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Giuseppe Bilotta <giuseppe.bilotta at gmail.com>

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 2eb9fbdc8..c904fa035 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -66,13 +66,10 @@ RRCrtcCreate(ScreenPtr pScreen, void *devPrivate)
     pScrPriv = rrGetScrPriv(pScreen);
 
     /* make space for the crtc pointer */
-    if (pScrPriv->numCrtcs)
-        crtcs = reallocarray(pScrPriv->crtcs,
-                             pScrPriv->numCrtcs + 1, sizeof(RRCrtcPtr));
-    else
-        crtcs = malloc(sizeof(RRCrtcPtr));
+    crtcs = reallocarray(pScrPriv->crtcs,
+            pScrPriv->numCrtcs + 1, sizeof(RRCrtcPtr));
     if (!crtcs)
-        return FALSE;
+        return NULL;
     pScrPriv->crtcs = crtcs;
 
     crtc = calloc(1, sizeof(RRCrtcRec));
diff --git a/randr/rroutput.c b/randr/rroutput.c
index 647f19a52..90fe4e6c1 100644
--- a/randr/rroutput.c
+++ b/randr/rroutput.c
@@ -71,13 +71,10 @@ RROutputCreate(ScreenPtr pScreen,
 
     pScrPriv = rrGetScrPriv(pScreen);
 
-    if (pScrPriv->numOutputs)
-        outputs = reallocarray(pScrPriv->outputs,
-                               pScrPriv->numOutputs + 1, sizeof(RROutputPtr));
-    else
-        outputs = malloc(sizeof(RROutputPtr));
+    outputs = reallocarray(pScrPriv->outputs,
+                           pScrPriv->numOutputs + 1, sizeof(RROutputPtr));
     if (!outputs)
-        return FALSE;
+        return NULL;
 
     pScrPriv->outputs = outputs;
 
commit fb5ee77b91a93e27801006be8ee34d27984e7fa6
Author: Giuseppe Bilotta <giuseppe.bilotta at gmail.com>
Date:   Thu Nov 9 10:21:19 2017 +0100

    randr: rrGetScreenResources: initialize memory
    
    Similarly to bb766ef11227bd8c71ac65845d1930edd0eda40d, ensure that the
    extra padding is set to 0.
    
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Giuseppe Bilotta <giuseppe.bilotta at gmail.com>

diff --git a/randr/rrscreen.c b/randr/rrscreen.c
index d6c499580..0c70b28dd 100644
--- a/randr/rrscreen.c
+++ b/randr/rrscreen.c
@@ -558,7 +558,7 @@ rrGetScreenResources(ClientPtr client, Bool query)
 
         extraLen = rep.length << 2;
         if (extraLen) {
-            extra = malloc(extraLen);
+            extra = calloc(1, extraLen);
             if (!extra) {
                 free(modes);
                 return BadAlloc;