xlib: Unlike the visual when destroying it

Otherwise we leave dangling pointers in the visual list, leading to
memory corruption when using low bitdepth servers.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/cairo-xlib-visual.c b/src/cairo-xlib-visual.c
index d9aac44ca..863822eeb 100644
--- a/src/cairo-xlib-visual.c
+++ b/src/cairo-xlib-visual.c
@@ -40,6 +40,7 @@
 #include "cairo-xlib-private.h"
 
 #include "cairo-error-private.h"
+#include "cairo-list-inline.h"
 
 /* A perceptual distance metric between two colors. No sqrt needed
  * since the square of the distance is still a valid metric. */
@@ -85,6 +86,7 @@ _cairo_xlib_visual_info_create (Display *dpy,
     if (unlikely (info == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
+    cairo_list_init (&info->link);
     info->visualid = visualid;
 
     /* Allocate a gray ramp and a color cube.
@@ -185,6 +187,7 @@ void
 _cairo_xlib_visual_info_destroy (cairo_xlib_visual_info_t *info)
 {
     /* No need for XFreeColors() whilst using DefaultColormap */
+    _cairo_list_del (&info->link);
     free (info);
 }