[PATCH 4/5] os: fix use after free in EstablishNewConnections
Tiago Vignatti
tiago.vignatti at nokia.com
Mon Apr 4 10:54:34 PDT 2011
In the case of failure on AllocNewConnection, new_trans_conn cannot be
dereferenced because it's already freed. Swapping the order of this logic fix
the changes introduced in 04956b80431169e0ae713a3e6ba4cdc157ce3a66.
Signed-off-by: Tiago Vignatti <tiago.vignatti at nokia.com>
CC: Jeremy Huddleston <jeremyhu at freedesktop.org>
---
os/connection.c | 7 +++----
1 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/os/connection.c b/os/connection.c
index 5580fab..0c580ab 100644
--- a/os/connection.c
+++ b/os/connection.c
@@ -852,15 +852,14 @@ EstablishNewConnections(ClientPtr clientUnused, pointer closure)
_XSERVTransSetOption(new_trans_conn, TRANS_NONBLOCKING, 1);
+ if(trans_conn->flags & TRANS_NOXAUTH)
+ new_trans_conn->flags = new_trans_conn->flags | TRANS_NOXAUTH;
+
if (!AllocNewConnection (new_trans_conn, newconn, connect_time))
{
ErrorConnMax(new_trans_conn);
_XSERVTransClose(new_trans_conn);
}
-
- if(trans_conn->flags & TRANS_NOXAUTH)
- new_trans_conn->flags = new_trans_conn->flags | TRANS_NOXAUTH;
-
}
#ifndef WIN32
}
--
1.7.0.4
More information about the xorg-devel
mailing list