andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

rrproperty.c: free newly allocated prop in more error paths

Browse Source 
Reported by parfait 1.0:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateOutputProperty(property)
        at line 220 of randr/rrproperty.c in function 'RRChangeOutputProperty'.
          'prop' allocated at line 154 with RRCreateOutputProperty(property).
          prop leaks when pending != 0 at line 160.
Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateOutputProperty(property)
        at line 346 of randr/rrproperty.c in function 'RRConfigureOutputProperty'.
          'prop' allocated at line 334 with RRCreateOutputProperty(property).
        at line 350 of randr/rrproperty.c in function 'RRConfigureOutputProperty'.
          'prop' allocated at line 334 with RRCreateOutputProperty(property).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
Alan Coopersmith 2012-07-14 09:29:52 -07:00
parent 42e655de4d
commit 1eb7be8633
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
randr/rrproperty.c
View File

@ -217,6 +217,8 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
!pScrPriv->rrOutputSetProperty(output->pScreen, output,
prop->propertyName, &new_value)) {
free(new_value.data);
if (add)
RRDestroyOutputProperty(prop);
return BadValue;
}
free(prop_value->data);
@ -342,12 +344,18 @@ RRConfigureOutputProperty(RROutputPtr output, Atom property,
/*
* ranges must have even number of values
*/
if (range && (num_values & 1))
if (range && (num_values & 1)) {
if (add)
RRDestroyOutputProperty(prop);
return BadMatch;
}
new_values = malloc(num_values * sizeof(INT32));
if (!new_values && num_values)
if (!new_values && num_values) {
if (add)
RRDestroyOutputProperty(prop);
return BadAlloc;
}
if (num_values)
memcpy(new_values, values, num_values * sizeof(INT32));