XQuartz: Avoid a crash when mistakenly free()ing in QuartzSetCursor on some configs

Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
(cherry picked from commit 648d189548530fa23d97d1e8737f89d297f1c443)

1 files changed, 5 insertions, 1 deletions

diff --git a/hw/xquartz/xpr/xprCursor.c b/hw/xquartz/xpr/xprCursor.c
index fbaf825de..95eaed96b 100644
--- a/hw/xquartz/xpr/xprCursor.c
+++ b/hw/xquartz/xpr/xprCursor.c
@@ -68,6 +68,7 @@ static Bool
 load_cursor(CursorPtr src, int screen)
 {
     uint32_t *data;
+    Bool free_data = FALSE;
     uint32_t rowbytes;
     int width, height;
     int hot_x, hot_y;
@@ -96,6 +97,7 @@ load_cursor(CursorPtr src, int screen)
         unsigned i;
         rowbytes = src->bits->width * sizeof (CARD32);
         data = xalloc(rowbytes * src->bits->height);
+        free_data = TRUE;
         if(!data) {
             FatalError("Failed to allocate memory in %s\n", __func__);
         }
@@ -122,6 +124,7 @@ load_cursor(CursorPtr src, int screen)
         /* round up to 8 pixel boundary so we can convert whole bytes */
         rowbytes = ((src->bits->width * 4) + 31) & ~31;
         data = xalloc(rowbytes * src->bits->height);
+        free_data = TRUE;
         if(!data) {
             FatalError("Failed to allocate memory in %s\n", __func__);
         }
@@ -174,7 +177,8 @@ load_cursor(CursorPtr src, int screen)
     }
 
     err = xp_set_cursor(width, height, hot_x, hot_y, data, rowbytes);
-    xfree(data);
+    if(free_data)
+        xfree(data);
     return err == Success;
 }