From bdeab7863eb7abe2d9d05eed259542695935559c Mon Sep 17 00:00:00 2001 From: Dave Airlie Date: Wed, 12 Sep 2018 10:30:13 +1000 Subject: [PATCH] shm: move shmsize verify before allocating the drawable. Otherwise if the VERIFY_SHMSIZE macro fails we leak the drawables we allocated earlier. Noticed by coverity scan. Signed-off-by: Dave Airlie (cherry picked from commit 3439929c510501929c6ef1d90477c33bf8838632) --- Xext/shm.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/Xext/shm.c b/Xext/shm.c index 896a966e3..589ed0b4d 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -834,6 +834,19 @@ ProcPanoramiXShmGetImage(ClientPtr client) return BadMatch; } + if (format == ZPixmap) { + widthBytesLine = PixmapBytePad(w, pDraw->depth); + length = widthBytesLine * h; + } + else { + widthBytesLine = PixmapBytePad(w, 1); + lenPer = widthBytesLine * h; + plane = ((Mask) 1) << (pDraw->depth - 1); + length = lenPer * Ones(planemask & (plane | (plane - 1))); + } + + VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client); + drawables = calloc(PanoramiXNumScreens, sizeof(DrawablePtr)); if (!drawables) return BadAlloc; @@ -856,18 +869,6 @@ ProcPanoramiXShmGetImage(ClientPtr client) .depth = pDraw->depth }; - if (format == ZPixmap) { - widthBytesLine = PixmapBytePad(w, pDraw->depth); - length = widthBytesLine * h; - } - else { - widthBytesLine = PixmapBytePad(w, 1); - lenPer = widthBytesLine * h; - plane = ((Mask) 1) << (pDraw->depth - 1); - length = lenPer * Ones(planemask & (plane | (plane - 1))); - } - - VERIFY_SHMSIZE(shmdesc, stuff->offset, length, client); xgi.size = length; if (length == 0) { /* nothing to do */