summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVille Syrjälä <ville.syrjala@nokia.com>2011-04-12 17:13:28 +0300
committerVille Syrjälä <ville.syrjala@nokia.com>2011-04-14 15:21:57 +0300
commit93c833ee84a3465ec5d251e622ba26434cb532f8 (patch)
treeabab416a2e9baa3f8fffcf0021428630debbc544
parentb2997431fd426ab318bc5dfd2cd43956d733ebec (diff)
dri2: Handle calloc() failure
Don't access invalid memory if calloc() fails to allocate the buffers array. Signed-off-by: Ville Syrjälä <ville.syrjala@nokia.com> Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com> Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
-rw-r--r--hw/xfree86/dri2/dri2.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 10be59953..23b65949b 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -409,6 +409,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
&& (pPriv->serialNumber == DRI2DrawableSerial(pDraw));
buffers = calloc((count + 1), sizeof(buffers[0]));
+ if (!buffers)
+ goto err_out;
for (i = 0; i < count; i++) {
const unsigned attachment = *(attachments++);
@@ -501,13 +503,15 @@ err_out:
*out_count = 0;
- for (i = 0; i < count; i++) {
+ if (buffers) {
+ for (i = 0; i < count; i++) {
if (buffers[i] != NULL)
- (*ds->DestroyBuffer)(pDraw, buffers[i]);
- }
+ (*ds->DestroyBuffer)(pDraw, buffers[i]);
+ }
- free(buffers);
- buffers = NULL;
+ free(buffers);
+ buffers = NULL;
+ }
update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height);