From b2198df55afe50ac3b2f93544ab3f5625050c0f2 Mon Sep 17 00:00:00 2001
From: "Enrico Weigelt, metux IT consult" <info@metux.net>
Date: Tue, 16 Jul 2024 18:34:23 +0200
Subject: [PATCH] xkb: ProcXkbGetGeometry(): fix memleak

If XkbComputeGetGeometryReplySize() returns an error, the XkbGeometryRec won't
be freed, since we're bailing out too early and not calling XkbSendGeometry().

Having XkbSendGeometry() responsible for freeing that struct is unnecessarily
complicated anyways, so move that to ProcXkbGetGeometry() and do it also when
XkbComputeGetGeometryReplySize() failed.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1622>
---
 xkb/xkb.c | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/xkb/xkb.c b/xkb/xkb.c
index 70817a4f2..f203270d5 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5033,7 +5033,7 @@ XkbComputeGetGeometryReplySize(XkbGeometryPtr geom,
 }
 static int
 XkbSendGeometry(ClientPtr client,
-                XkbGeometryPtr geom, xkbGetGeometryReply * rep, Bool freeGeom)
+                XkbGeometryPtr geom, xkbGetGeometryReply *rep)
 {
     char *desc, *start;
     int len;
@@ -5085,8 +5085,6 @@ XkbSendGeometry(ClientPtr client,
         WriteToClient(client, len, start);
     if (start != NULL)
         free((char *) start);
-    if (freeGeom)
-        XkbFreeGeometry(geom, XkbGeomAllMask, TRUE);
     return Success;
 }
 
@@ -5117,9 +5115,15 @@ ProcXkbGetGeometry(ClientPtr client)
     };
     status = XkbComputeGetGeometryReplySize(geom, &rep, stuff->name);
     if (status != Success)
-        return status;
-    else
-        return XkbSendGeometry(client, geom, &rep, shouldFree);
+        goto free_out;
+
+    status = XkbSendGeometry(client, geom, &rep);
+
+free_out:
+    if (shouldFree)
+        XkbFreeGeometry(geom, XkbGeomAllMask, TRUE);
+
+    return status;
 }
 
 /***====================================================================***/
@@ -6193,7 +6197,7 @@ ProcXkbGetKbdByName(ClientPtr client)
     if (reported & (XkbGBN_KeyNamesMask | XkbGBN_OtherNamesMask))
         XkbSendNames(client, new, &nrep);
     if (reported & XkbGBN_GeometryMask)
-        XkbSendGeometry(client, new->geom, &grep, FALSE);
+        XkbSendGeometry(client, new->geom, &grep);
     if (rep.loaded) {
         XkbDescPtr old_xkb;
         xkbNewKeyboardNotify nkn;