[PATCH] render: Fix double-free on ARGB cursor error path

[Keith Packard]

Adam Jackson <ajax at redhat.com> writes:

> On Wed, 2014-08-20 at 11:48 -0500, Keith Packard wrote:
>> Adam Jackson <ajax at redhat.com> writes:
>> 
>> > The gotos deleted by this patch are the only way to get to the bail:
>> > label here.  In neither case do we need to free the cursor bits from the
>> > caller; AllocARGBCursor will already do that on the failure path,
>> > likewise AddResource will call the resource delete function on error.
>> 
>> I don't see AllocARGBCursor freeing anything in the failure paths, so I
>> think we need to free source/mask. We also need to free argbits
>
> I'm not making shit up, I promise.  AllocARGBCursor glues the source and
> mask parameters into the cursor bits near the top:

Yeah, I saw that part after I'd noticed that the first error return (on
malloc failure) didn't free anything.

-- 
keith.packard at intel.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 810 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20140820/e6c206d9/attachment.sig>