xserver: Branch 'master' - 9 commits
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Wed Sep 12 19:17:45 UTC 2018
Xext/shm.c | 25 +++++++++++++------------
Xi/xipassivegrab.c | 4 ++--
dix/devices.c | 2 ++
fb/fboverlay.c | 6 +++---
glamor/glamor_gradient.c | 8 +++++---
hw/xfree86/drivers/modesetting/driver.c | 4 ++--
hw/xfree86/os-support/shared/posix_tty.c | 6 +++++-
mi/mibitblt.c | 2 ++
xkb/xkb.c | 2 +-
9 files changed, 35 insertions(+), 24 deletions(-)
New commits:
commit ba0f5d854f4db52974ab5cd09191303b01b075ff
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 11:39:32 2018 +1000
devices: break after finding and removing device from lists
Coverity complains about a use after free in here after the
freeing, I can't follow the linked list so well, but whot
says the device can only be on one list once, so break should
fix it.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/dix/devices.c b/dix/devices.c
index 4a628afb0..1b18b168e 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -1177,6 +1177,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
flags[tmp->id] = IsMaster(tmp) ? XIMasterRemoved : XISlaveRemoved;
CloseDevice(tmp);
ret = Success;
+ break;
}
}
@@ -1193,6 +1194,7 @@ RemoveDevice(DeviceIntPtr dev, BOOL sendevent)
prev->next = next;
ret = Success;
+ break;
}
}
commit c4591ea17110b5c318a5ef4b0f17a4eea306ea71
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 11:12:51 2018 +1000
mibltblt: free prgnSrcClip on error path.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/mi/mibitblt.c b/mi/mibitblt.c
index 2de5bf8fd..43d9bd917 100644
--- a/mi/mibitblt.c
+++ b/mi/mibitblt.c
@@ -141,6 +141,8 @@ miCopyArea(DrawablePtr pSrcDrawable,
free(ordering);
free(pwidthFirst);
free(pptFirst);
+ if (realSrcClip)
+ RegionDestroy(prgnSrcClip);
return NULL;
}
commit 758393951233d1b2520cf4cefd33ec4288a3880a
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 11:09:40 2018 +1000
xkb: fix what looks to be a copy-paste error with first vs firstMM
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 0fe6ebf4a..764079506 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2570,7 +2570,7 @@ _XkbSetMap(ClientPtr client, DeviceIntPtr dev, xkbSetMapReq * req, char *values)
first = last = 0;
if (change.map.num_modmap_keys > 0) {
firstMM = change.map.first_modmap_key;
- lastMM = first + change.map.num_modmap_keys - 1;
+ lastMM = firstMM + change.map.num_modmap_keys - 1;
}
else
firstMM = lastMM = 0;
commit cad3a1a82da3c8421b5cc98af27a779a38b5c709
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 11:05:45 2018 +1000
posix_tty: free leak of xf86SetStrOption return value.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/hw/xfree86/os-support/shared/posix_tty.c b/hw/xfree86/os-support/shared/posix_tty.c
index 6768d290b..0cb9788cc 100644
--- a/hw/xfree86/os-support/shared/posix_tty.c
+++ b/hw/xfree86/os-support/shared/posix_tty.c
@@ -188,7 +188,7 @@ xf86SetSerial(int fd, XF86OptionPtr options)
{
struct termios t;
int val;
- const char *s;
+ char *s;
int baud, r;
if (fd < 0)
@@ -264,8 +264,10 @@ xf86SetSerial(int fd, XF86OptionPtr options)
}
else {
xf86Msg(X_ERROR, "Invalid Option Parity value: %s\n", s);
+ free(s);
return -1;
}
+ free(s);
}
if ((val = xf86SetIntOption(options, "Vmin", -1)) != -1) {
@@ -291,8 +293,10 @@ xf86SetSerial(int fd, XF86OptionPtr options)
}
else {
xf86Msg(X_ERROR, "Invalid Option FlowControl value: %s\n", s);
+ free(s);
return -1;
}
+ free(s);
}
if ((xf86SetBoolOption(options, "ClearDTR", FALSE))) {
commit b6c29a881eb49300fddfd0187cb10891f5257d3b
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 10:56:40 2018 +1000
modesetting: get pEnt after error checks
This saves us having to make sure we clean it up.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/hw/xfree86/drivers/modesetting/driver.c b/hw/xfree86/drivers/modesetting/driver.c
index 792dfb655..8d29b130f 100644
--- a/hw/xfree86/drivers/modesetting/driver.c
+++ b/hw/xfree86/drivers/modesetting/driver.c
@@ -900,8 +900,6 @@ PreInit(ScrnInfoPtr pScrn, int flags)
if (pScrn->numEntities != 1)
return FALSE;
- pEnt = xf86GetEntityInfo(pScrn->entityList[0]);
-
if (flags & PROBE_DETECT) {
return FALSE;
}
@@ -910,6 +908,8 @@ PreInit(ScrnInfoPtr pScrn, int flags)
if (!GetRec(pScrn))
return FALSE;
+ pEnt = xf86GetEntityInfo(pScrn->entityList[0]);
+
ms = modesettingPTR(pScrn);
ms->SaveGeneration = -1;
ms->pEnt = pEnt;
commit f0a5c0d1fdaeee3cd701215f4f57b7eacaf783c2
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 10:52:25 2018 +1000
glamor: fix leak of fs_getcolor_source.
This is created using XNFstrdup, so it needs to be freed.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/glamor/glamor_gradient.c b/glamor/glamor_gradient.c
index 4e864cd79..eef078860 100644
--- a/glamor/glamor_gradient.c
+++ b/glamor/glamor_gradient.c
@@ -38,7 +38,7 @@
#define RADIAL_SMALL_STOPS (6 + 2)
#define RADIAL_LARGE_STOPS (16 + 2)
-static const char *
+static char *
_glamor_create_getcolor_fs_source(ScreenPtr screen, int stops_count,
int use_array)
{
@@ -310,7 +310,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
"}\n"\
"\n"\
"%s\n" /* fs_getcolor_source */
- const char *fs_getcolor_source;
+ char *fs_getcolor_source;
glamor_priv = glamor_get_screen_private(screen);
@@ -343,6 +343,7 @@ _glamor_create_radial_gradient_program(ScreenPtr screen, int stops_count,
fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
free(gradient_fs);
+ free(fs_getcolor_source);
glAttachShader(gradient_prog, vs_prog);
glAttachShader(gradient_prog, fs_prog);
@@ -493,7 +494,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
"}\n"\
"\n"\
"%s" /* fs_getcolor_source */
- const char *fs_getcolor_source;
+ char *fs_getcolor_source;
glamor_priv = glamor_get_screen_private(screen);
@@ -522,6 +523,7 @@ _glamor_create_linear_gradient_program(ScreenPtr screen, int stops_count,
fs_prog = glamor_compile_glsl_prog(GL_FRAGMENT_SHADER, gradient_fs);
free(gradient_fs);
+ free(fs_getcolor_source);
glAttachShader(gradient_prog, vs_prog);
glAttachShader(gradient_prog, fs_prog);
commit c7fa6a0a0d4ad28ee21b8dd9ad4fbe33f462bc71
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 10:50:21 2018 +1000
fboverlay: move bpp checks above malloc
Avoids having to free the malloced object.
Pointed out by coverity.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/fb/fboverlay.c b/fb/fboverlay.c
index a028a8de1..d47a7c67b 100644
--- a/fb/fboverlay.c
+++ b/fb/fboverlay.c
@@ -279,11 +279,11 @@ fbOverlayFinishScreenInit(ScreenPtr pScreen,
(&fbOverlayScreenPrivateKeyRec, PRIVATE_SCREEN, 0))
return FALSE;
- pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
- if (!pScrPriv)
+ if (bpp1 == 24 || bpp2 == 24)
return FALSE;
- if (bpp1 == 24 || bpp2 == 24)
+ pScrPriv = malloc(sizeof(FbOverlayScrPrivRec));
+ if (!pScrPriv)
return FALSE;
if (!fbInitVisuals(&visuals, &depths, &nvisuals, &ndepths, &depth1,
commit 51ae6126dcf3e234d0f678f02934bc9515abb8ae
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 10:33:04 2018 +1000
xi: free modifiers_failed on error path. (v2)
Pointed out by coverity.
v2: set modifies_failed to NULL at start (whot)
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index aa965e46f..65d5870f6 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -88,7 +88,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
};
int i, ret = Success;
uint32_t *modifiers;
- xXIGrabModifierInfo *modifiers_failed;
+ xXIGrabModifierInfo *modifiers_failed = NULL;
GrabMask mask = { 0 };
GrabParameters param;
void *tmp;
@@ -232,8 +232,8 @@ ProcXIPassiveGrabDevice(ClientPtr client)
if (rep.num_modifiers)
WriteToClient(client, rep.length * 4, modifiers_failed);
- free(modifiers_failed);
out:
+ free(modifiers_failed);
xi2mask_free(&mask.xi2mask);
return ret;
}
commit 3439929c510501929c6ef1d90477c33bf8838632
Author: Dave Airlie <airlied at redhat.com>
Date: Wed Sep 12 10:30:13 2018 +1000
shm: move shmsize verify before allocating the drawable.
Otherwise if the VERIFY_SHMSIZE macro fails we leak the drawables
we allocated earlier.
Noticed by coverity scan.
Signed-off-by: Dave Airlie <airlied at redhat.com>
diff --git a/Xext/shm.c b/Xext/shm.c
index 896a966e3..589ed0b4d 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -834,6 +834,19 @@ ProcPanoramiXShmGetImage(ClientPtr client)
return BadMatch;
}
+ if (format == ZPixmap) {
+ widthBytesLine = PixmapBytePad(w, pDraw->depth);
+ length = widthBytesLine * h;
+ }
+ else {
+ widthBytesLine = PixmapBytePad(w, 1);
+ lenPer = widthBytesLine * h;
+ plane = ((Mask) 1) << (pDraw->depth - 1);
+ length = lenPer * Ones(planemask & (plane | (plane - 1)));
+ }
+
+ VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
+
drawables = calloc(PanoramiXNumScreens, sizeof(DrawablePtr));
if (!drawables)
return BadAlloc;
@@ -856,18 +869,6 @@ ProcPanoramiXShmGetImage(ClientPtr client)
.depth = pDraw->depth
};
- if (format == ZPixmap) {
- widthBytesLine = PixmapBytePad(w, pDraw->depth);
- length = widthBytesLine * h;
- }
- else {
- widthBytesLine = PixmapBytePad(w, 1);
- lenPer = widthBytesLine * h;
- plane = ((Mask) 1) << (pDraw->depth - 1);
- length = lenPer * Ones(planemask & (plane | (plane - 1)));
- }
-
- VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client);
xgi.size = length;
if (length == 0) { /* nothing to do */
More information about the xorg-commit
mailing list