diff options
| author | Ville Syrjälä <ville.syrjala@nokia.com> | 2011-04-12 17:13:28 +0300 |
|---|---|---|
| committer | Ville Syrjälä <ville.syrjala@nokia.com> | 2011-04-14 15:21:57 +0300 |
| commit | 93c833ee84a3465ec5d251e622ba26434cb532f8 (patch) | |
| tree | abab416a2e9baa3f8fffcf0021428630debbc544 | |
| parent | b2997431fd426ab318bc5dfd2cd43956d733ebec (diff) | |
dri2: Handle calloc() failure
Don't access invalid memory if calloc() fails to allocate the buffers
array.
Signed-off-by: Ville Syrjälä <ville.syrjala@nokia.com>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
| -rw-r--r-- | hw/xfree86/dri2/dri2.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c index 10be59953..23b65949b 100644 --- a/hw/xfree86/dri2/dri2.c +++ b/hw/xfree86/dri2/dri2.c @@ -409,6 +409,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height, && (pPriv->serialNumber == DRI2DrawableSerial(pDraw)); buffers = calloc((count + 1), sizeof(buffers[0])); + if (!buffers) + goto err_out; for (i = 0; i < count; i++) { const unsigned attachment = *(attachments++); @@ -501,13 +503,15 @@ err_out: *out_count = 0; - for (i = 0; i < count; i++) { + if (buffers) { + for (i = 0; i < count; i++) { if (buffers[i] != NULL) - (*ds->DestroyBuffer)(pDraw, buffers[i]); - } + (*ds->DestroyBuffer)(pDraw, buffers[i]); + } - free(buffers); - buffers = NULL; + free(buffers); + buffers = NULL; + } update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height); |