frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

shm: Fix use-after-free in ShmDestroyPixmap 

We pass the pPixmap->drawable.id to the ShmDetachSegment function after
the pPixmap is freed. Fortunately, we don't use the value inside
ShmDetachSegment and can simply pass zero instead.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
This commit is contained in:
Chris Wilson 2015-02-14 10:36:44 +00:00 committed by Adam Jackson
parent d61ae18074
commit bcec9f867d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xext/shm.c
View File

@ -260,7 +260,7 @@ ShmDestroyPixmap(PixmapPtr pPixmap)
pScreen->DestroyPixmap = ShmDestroyPixmap; pScreen->DestroyPixmap = ShmDestroyPixmap;
if (shmdesc) if (shmdesc)
ShmDetachSegment(shmdesc, pPixmap->drawable.id); ShmDetachSegment(shmdesc, 0);
return ret; return ret;
} }
@ -427,7 +427,7 @@ ProcShmAttach(ClientPtr client)
/*ARGSUSED*/ static int /*ARGSUSED*/ static int
ShmDetachSegment(void *value, /* must conform to DeleteType */ ShmDetachSegment(void *value, /* must conform to DeleteType */
XID shmseg) XID unused)
{ {
ShmDescPtr shmdesc = (ShmDescPtr) value; ShmDescPtr shmdesc = (ShmDescPtr) value;
ShmDescPtr *prev; ShmDescPtr *prev;