xserver: Branch 'master'

[GitLab Mirror]

 Xext/panoramiX.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

New commits:
commit 93cafb0828d2e24bd14616df1aa9883fb843dd6c
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Wed Jul 18 13:22:43 2018 +1000

    Xext: dynamically allocate the PanoramiXDepths[j].vids array
    
    Control flow is:
       PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
       PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
       and writes those into the previously allocated array.
    
    This caused invalid reads/writes followed by eventually a double-free abort.
    
    Reproduced with xorg-integration-tests server test
    XineramaTest.ScreenCrossing/* (and a bunch of others).
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Keith Packard <keithp at keithp.com>

diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
index 844ea49ce..bd9c45b03 100644
--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
@@ -751,11 +751,7 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
                                    PanoramiXNumDepths, sizeof(DepthRec));
     PanoramiXDepths[j].depth = pDepth->depth;
     PanoramiXDepths[j].numVids = 0;
-    /* XXX suboptimal, should grow these dynamically */
-    if (pDepth->numVids)
-        PanoramiXDepths[j].vids = xallocarray(pDepth->numVids, sizeof(VisualID));
-    else
-        PanoramiXDepths[j].vids = NULL;
+    PanoramiXDepths[j].vids = NULL;
 }
 
 static void
@@ -796,6 +792,9 @@ PanoramiXMaybeAddVisual(VisualPtr pVisual)
 
     for (k = 0; k < PanoramiXNumDepths; k++) {
         if (PanoramiXDepths[k].depth == pVisual->nplanes) {
+            PanoramiXDepths[k].vids = reallocarray(PanoramiXDepths[k].vids,
+                                                   PanoramiXDepths[k].numVids + 1,
+                                                   sizeof(VisualID));
             PanoramiXDepths[k].vids[PanoramiXDepths[k].numVids] = pVisual->vid;
             PanoramiXDepths[k].numVids++;
             break;