diff options
| author | Jamey Sharp <jamey@minilop.net> | 2010-09-14 18:35:21 -0700 |
|---|---|---|
| committer | Jamey Sharp <jamey@minilop.net> | 2011-09-19 23:36:43 -0700 |
| commit | 0f380a5005f800572773cd4667ce43c7459cc467 (patch) | |
| tree | 07f8bc5de2a8a76c6c82202105876c677b6ae448 | |
| parent | 8f69c935f6d06ad92fd0e8d9fcb3cde86cd258f5 (diff) | |
Fix pixmap double-frees on error paths.
If AddResource fails, it will automatically free the object that was
passed to it by calling the appropriate deleteFunc; and of course
FreeResource also calls the deleteFunc. In both cases it's wrong to call
the destroy hook manually.
Commit by Jamey Sharp and Josh Triplett.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Signed-off-by: Josh Triplett <josh@joshtriplett.org>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
| -rw-r--r-- | Xext/shm.c | 6 | ||||
| -rw-r--r-- | dix/dispatch.c | 1 |
2 files changed, 1 insertions, 6 deletions
diff --git a/Xext/shm.c b/Xext/shm.c index b08af821b..4141a8fe6 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -991,7 +991,6 @@ CreatePmap: pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER; pMap->drawable.id = newPix->info[j].id; if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) { - (*pScreen->DestroyPixmap)(pMap); result = BadAlloc; break; } @@ -1002,10 +1001,8 @@ CreatePmap: } if(result == BadAlloc) { - while(j--) { - (*pScreen->DestroyPixmap)(pMap); + while(j--) FreeResource(newPix->info[j].id, RT_NONE); - } free(newPix); } else AddResource(stuff->pid, XRT_PIXMAP, newPix); @@ -1110,7 +1107,6 @@ CreatePmap: { return Success; } - pDraw->pScreen->DestroyPixmap(pMap); } return BadAlloc; } diff --git a/dix/dispatch.c b/dix/dispatch.c index 2d17adfbe..34213cf16 100644 --- a/dix/dispatch.c +++ b/dix/dispatch.c @@ -1419,7 +1419,6 @@ CreatePmap: } if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap)) return Success; - (*pDraw->pScreen->DestroyPixmap)(pMap); } return BadAlloc; } |