summaryrefslogtreecommitdiff
path: root/Xext
diff options
context:
space:
mode:
authorJulien Cristau <jcristau@debian.org>2016-03-01 21:39:01 +0100
committerAdam Jackson <ajax@redhat.com>2016-03-11 13:14:32 -0500
commit23d9b2a566cdaeff71deae9c3a221ebf0cb5f550 (patch)
tree7cbd9383ffa143e12453bc33df6e2b22abedcc41 /Xext
parent90b854b2acc58a9936e9810f58b0bd1973697210 (diff)
xv: fix double free in AddResource failure case
XvdiDestroyVideoNotifyList already frees the list if AddResource fails, so don't do it twice. And set tpn->client to NULL explicitly to avoid confusing uninitialized memory with a valid value. Reviewed-by: Adam Jackson <ajax@redhat.com> Signed-off-by: Julien Cristau <jcristau@debian.org> (cherry picked from commit 939ce0bae68b682b57675f65c901653c1a094ebb)
Diffstat (limited to 'Xext')
-rw-r--r--Xext/xvmain.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/Xext/xvmain.c b/Xext/xvmain.c
index 3a0263427..c9b11d4bb 100644
--- a/Xext/xvmain.c
+++ b/Xext/xvmain.c
@@ -800,10 +800,9 @@ XvdiSelectVideoNotify(ClientPtr client, DrawablePtr pDraw, BOOL onoff)
if (!(tpn = malloc(sizeof(XvVideoNotifyRec))))
return BadAlloc;
tpn->next = NULL;
- if (!AddResource(pDraw->id, XvRTVideoNotifyList, tpn)) {
- free(tpn);
+ tpn->client = NULL;
+ if (!AddResource(pDraw->id, XvRTVideoNotifyList, tpn))
return BadAlloc;
- }
}
else {
/* LOOK TO SEE IF ENTRY ALREADY EXISTS */