diff options
| author | Martin Weber <martin.weber@secunet.com> | 2020-07-21 18:24:41 +0200 |
|---|---|---|
| committer | Matt Turner <mattst88@gmail.com> | 2020-08-18 04:12:09 +0000 |
| commit | c726ceacc1a39c56d2b054ac5f35798d0c3640d7 (patch) | |
| tree | 6f6d6a3f9e77a52dda48960685287da801eafbd2 /hw | |
| parent | 0679d4660579d0f399b5a9b8140d0c0d3483fa9f (diff) | |
hw/xfree86: Avoid cursor use after free
During a VT-Switch a raw pointer to the shared cursor object
is saved which is then freed (in case of low refcount) by a call to
xf86CursorSetCursor with argument pCurs = NullCursor.
This leads to a dangling pointer which can follow in a use after free.
This fix ensures that there is a shared handle saved for the VT-Switch cycle.
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
(cherry picked from commit 7ae221ad5774756766dc78a73d71f4163ac7b1c6)
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/xfree86/ramdac/xf86CursorRD.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/xfree86/ramdac/xf86CursorRD.c b/hw/xfree86/ramdac/xf86CursorRD.c index afcce5353..ee1d98916 100644 --- a/hw/xfree86/ramdac/xf86CursorRD.c +++ b/hw/xfree86/ramdac/xf86CursorRD.c @@ -212,7 +212,7 @@ xf86CursorEnableDisableFBAccess(ScrnInfoPtr pScrn, Bool enable) xf86CursorScreenKey); if (!enable && ScreenPriv->CurrentCursor != NullCursor) { - CursorPtr currentCursor = ScreenPriv->CurrentCursor; + CursorPtr currentCursor = RefCursor(ScreenPriv->CurrentCursor); xf86CursorSetCursor(pDev, pScreen, NullCursor, ScreenPriv->x, ScreenPriv->y); @@ -231,6 +231,7 @@ xf86CursorEnableDisableFBAccess(ScrnInfoPtr pScrn, Bool enable) */ xf86CursorSetCursor(pDev, pScreen, ScreenPriv->SavedCursor, ScreenPriv->x, ScreenPriv->y); + UnrefCursor(ScreenPriv->SavedCursor); ScreenPriv->SavedCursor = NULL; } } |