andreacavalli
/
xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

shm: Fix use-after-free in ShmDestroyPixmap 

We pass the pPixmap->drawable.id to the ShmDetachSegment function after
the pPixmap is freed. Fortunately, we don't use the value inside
ShmDetachSegment and can simply pass zero instead.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Michel Dänzer <michel@daenzer.net>
(cherry picked from commit bcec9f867d)
This commit is contained in:
Chris Wilson 2015-02-14 10:36:44 +00:00 committed by Adam Jackson
parent 40f35e4488
commit 4f3df05728
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Xext/shm.c
View File

@ -260,7 +260,7 @@ ShmDestroyPixmap(PixmapPtr pPixmap)
pScreen->DestroyPixmap = ShmDestroyPixmap;
if (shmdesc)
ShmDetachSegment(shmdesc, pPixmap->drawable.id);
ShmDetachSegment(shmdesc, 0);
return ret;
}
@ -427,7 +427,7 @@ ProcShmAttach(ClientPtr client)
/*ARGSUSED*/ static int
ShmDetachSegment(void *value, /* must conform to DeleteType */
XID shmseg)
XID unused)
{
ShmDescPtr shmdesc = (ShmDescPtr) value;
ShmDescPtr *prev;