From 119d5c0e2f800737c949ef760c5fe25d963200bf Mon Sep 17 00:00:00 2001
From: Julien Cristau <jcristau@debian.org>
Date: Mon, 7 Mar 2016 23:20:26 +0100
Subject: [PATCH] xvmc: Fix unchecked AddResource
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Rémi Cardona <remi@gentoo.org>
Signed-off-by: Julien Cristau <jcristau@debian.org>
---
 Xext/xvmc.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/Xext/xvmc.c b/Xext/xvmc.c
index 64eda922b..7565c173d 100644
--- a/Xext/xvmc.c
+++ b/Xext/xvmc.c
@@ -253,6 +253,10 @@ ProcXvMCCreateContext(ClientPtr client)
         free(pContext);
         return result;
     }
+    if (!AddResource(pContext->context_id, XvMCRTContext, pContext)) {
+        free(data);
+        return BadAlloc;
+    }
 
     rep = (xvmcCreateContextReply) {
         .type = X_Reply,
@@ -266,7 +270,6 @@ ProcXvMCCreateContext(ClientPtr client)
     WriteToClient(client, sizeof(xvmcCreateContextReply), &rep);
     if (dwords)
         WriteToClient(client, dwords << 2, data);
-    AddResource(pContext->context_id, XvMCRTContext, pContext);
 
     free(data);
 
@@ -329,6 +332,11 @@ ProcXvMCCreateSurface(ClientPtr client)
         free(pSurface);
         return result;
     }
+    if (!AddResource(pSurface->surface_id, XvMCRTSurface, pSurface)) {
+        free(data);
+        return BadAlloc;
+    }
+
     rep = (xvmcCreateSurfaceReply) {
         .type = X_Reply,
         .sequenceNumber = client->sequence,
@@ -338,7 +346,6 @@ ProcXvMCCreateSurface(ClientPtr client)
     WriteToClient(client, sizeof(xvmcCreateSurfaceReply), &rep);
     if (dwords)
         WriteToClient(client, dwords << 2, data);
-    AddResource(pSurface->surface_id, XvMCRTSurface, pSurface);
 
     free(data);
 
@@ -445,6 +452,11 @@ ProcXvMCCreateSubpicture(ClientPtr client)
         free(pSubpicture);
         return result;
     }
+    if (!AddResource(pSubpicture->subpicture_id, XvMCRTSubpicture, pSubpicture)) {
+        free(data);
+        return BadAlloc;
+    }
+
     rep = (xvmcCreateSubpictureReply) {
         .type = X_Reply,
         .sequenceNumber = client->sequence,
@@ -462,7 +474,6 @@ ProcXvMCCreateSubpicture(ClientPtr client)
     WriteToClient(client, sizeof(xvmcCreateSubpictureReply), &rep);
     if (dwords)
         WriteToClient(client, dwords << 2, data);
-    AddResource(pSubpicture->subpicture_id, XvMCRTSubpicture, pSubpicture);
 
     free(data);