frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix pixmap double-frees on error paths. 

If AddResource fails, it will automatically free the object that was
passed to it by calling the appropriate deleteFunc; and of course
FreeResource also calls the deleteFunc. In both cases it's wrong to call
the destroy hook manually.

Commit by Jamey Sharp and Josh Triplett.

Signed-off-by: Jamey Sharp <jamey@minilop.net>
Signed-off-by: Josh Triplett <josh@joshtriplett.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
This commit is contained in:
Jamey Sharp 2010-09-14 18:35:21 -07:00
parent 8f69c935f6
commit 0f380a5005
2 changed files with 1 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Xext/shm.c
View File

@ -991,7 +991,6 @@ CreatePmap:
pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER; pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER;
pMap->drawable.id = newPix->info[j].id; pMap->drawable.id = newPix->info[j].id;
if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) { if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) {
(*pScreen->DestroyPixmap)(pMap);
result = BadAlloc; result = BadAlloc;
break; break;
} }
@ -1002,10 +1001,8 @@ CreatePmap:
} }
if(result == BadAlloc) { if(result == BadAlloc) {
while(j--) { while(j--)
(*pScreen->DestroyPixmap)(pMap);
FreeResource(newPix->info[j].id, RT_NONE); FreeResource(newPix->info[j].id, RT_NONE);
}
free(newPix); free(newPix);
} else } else
AddResource(stuff->pid, XRT_PIXMAP, newPix); AddResource(stuff->pid, XRT_PIXMAP, newPix);
@ -1110,7 +1107,6 @@ CreatePmap:
{ {
return Success; return Success;
} }
pDraw->pScreen->DestroyPixmap(pMap);
} }
return BadAlloc; return BadAlloc;
} }

1
dix/dispatch.c
View File

@ -1419,7 +1419,6 @@ CreatePmap:
} }
if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap)) if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap))
return Success; return Success;
(*pDraw->pScreen->DestroyPixmap)(pMap);
} }
return BadAlloc; return BadAlloc;
} }