Check if new space was actually allocated before freeing.
There will be no new space allocated, if mode != PropModeReplace and len == 0, or if mode is not one of the handled modes. This fixes freeing data that is still in use, leading to double frees and other memory corruption. Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
parent
9a1bfa5664
commit
4dc91b3e54
|
@ -351,9 +351,14 @@ dixChangeWindowProperty(ClientPtr pClient, WindowPtr pWin, Atom property,
|
|||
access_mode |= DixPostAccess;
|
||||
rc = XaceHookPropertyAccess(pClient, pWin, &pProp, access_mode);
|
||||
if (rc == Success)
|
||||
xfree(savedProp.data);
|
||||
else {
|
||||
xfree(pProp->data);
|
||||
{
|
||||
if (savedProp.data != pProp->data)
|
||||
xfree(savedProp.data);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (savedProp.data != pProp->data)
|
||||
xfree(pProp->data);
|
||||
*pProp = savedProp;
|
||||
return rc;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue
Block a user