summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTiago Vignatti <tiago.vignatti@nokia.com>2011-03-31 23:44:03 +0300
committerTiago Vignatti <tiago.vignatti@nokia.com>2011-04-07 19:56:33 +0300
commit81414c1c836ae30628606545edbf7392d9b3d009 (patch)
tree1ac8f3bb4140e19c88d30a711f427916ce5577bb
parent74476b700f1e499a731ba2ddbba87b12b9b5139b (diff)
xfree86: xv: fix double free in xf86XVFreeAdaptor
When xf86XVFreeAdaptor is called more than once in xf86XVInitAdaptors (it may, but not often), the conditional being changed in this patch will always take true path and will keep freeing pAdaptor->pAttributes, thus letting the system error-prone. This patch fix such problem checking for a pointer instead the number of attributes. Such pointer will be deallocated when xf86XVFreeAdaptor is called first and will not let the code re-run in the following calls. This is a bit similar how the surroundings code is already doing. Signed-off-by: Tiago Vignatti <tiago.vignatti@nokia.com> Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
-rw-r--r--hw/xfree86/common/xf86xv.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/xfree86/common/xf86xv.c b/hw/xfree86/common/xf86xv.c
index 53ebe8f88..f87af4c73 100644
--- a/hw/xfree86/common/xf86xv.c
+++ b/hw/xfree86/common/xf86xv.c
@@ -343,12 +343,13 @@ xf86XVFreeAdaptor(XvAdaptorPtr pAdaptor)
free(pAdaptor->pPorts);
}
- if(pAdaptor->nAttributes) {
+ if(pAdaptor->pAttributes) {
XvAttributePtr pAttribute = pAdaptor->pAttributes;
for(i = 0; i < pAdaptor->nAttributes; i++, pAttribute++)
free(pAttribute->name);
free(pAdaptor->pAttributes);
+ pAdaptor->pAttributes = NULL;
}
free(pAdaptor->pImages);