[PATCH 4/9] Fix pixmap double-frees on error paths.
Peter Hutterer
peter.hutterer at who-t.net
Mon Sep 19 22:29:01 PDT 2011
On Sat, Sep 17, 2011 at 03:22:30AM -0500, Jamey Sharp wrote:
> Commit by Jamey Sharp and Josh Triplett.
>
> Signed-off-by: Jamey Sharp <jamey at minilop.net>
> Signed-off-by: Josh Triplett <josh at joshtriplett.org>
> ---
> Xext/shm.c | 6 +-----
> dix/dispatch.c | 1 -
> 2 files changed, 1 insertions(+), 6 deletions(-)
>
> diff --git a/Xext/shm.c b/Xext/shm.c
> index b08af82..4141a8f 100644
> --- a/Xext/shm.c
> +++ b/Xext/shm.c
> @@ -991,7 +991,6 @@ CreatePmap:
> pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER;
> pMap->drawable.id = newPix->info[j].id;
> if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) {
> - (*pScreen->DestroyPixmap)(pMap);
> result = BadAlloc;
> break;
> }
> @@ -1002,10 +1001,8 @@ CreatePmap:
> }
>
> if(result == BadAlloc) {
> - while(j--) {
> - (*pScreen->DestroyPixmap)(pMap);
> + while(j--)
> FreeResource(newPix->info[j].id, RT_NONE);
> - }
> free(newPix);
> } else
> AddResource(stuff->pid, XRT_PIXMAP, newPix);
> @@ -1110,7 +1107,6 @@ CreatePmap:
> {
> return Success;
> }
> - pDraw->pScreen->DestroyPixmap(pMap);
> }
if we create the pixmap but it cannot be added to the resource (and return
BadAlloc), shouldn't we destroy it?
> return BadAlloc;
> }
> diff --git a/dix/dispatch.c b/dix/dispatch.c
> index 192c8c3..f8200b1 100644
> --- a/dix/dispatch.c
> +++ b/dix/dispatch.c
> @@ -1419,7 +1419,6 @@ CreatePmap:
> }
> if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap))
> return Success;
> - (*pDraw->pScreen->DestroyPixmap)(pMap);
> }
> return BadAlloc;
> }
this seems to have the same issue
Cheers,
Peter
More information about the xorg-devel
mailing list