Don't rely on freed memory to keep values.

Setting Capacity to a magic value, then freeing the struct and hoping that
the next Uninit call still has the right value in it is hopeful at best.
Use the refcounting that we already have in the driver instead.

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

1 files changed, 5 insertions, 4 deletions

diff --git a/src/xf86Aiptek.c b/src/xf86Aiptek.c
index 6a4ba96..d41f890 100644
--- a/src/xf86Aiptek.c
+++ b/src/xf86Aiptek.c
@@ -1783,12 +1783,13 @@ xf86AiptekUninit(InputDriverPtr    drv,
 
     if (device)
     {
-        if (device->common && device->common->xCapacity != -10101)
+        if (device->common)
         {
-            device->common->xCapacity = -10101;
-            free(device->common);
+            device->common->numDevices--;
+            if (device->common->numDevices == 0)
+                free(device->common);
         }
-        free (device);
+        device->common = NULL;
     }
     pInfo->private = NULL;
     xf86DeleteInput(pInfo, 0);