From 93c833ee84a3465ec5d251e622ba26434cb532f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@nokia.com>
Date: Tue, 12 Apr 2011 17:13:28 +0300
Subject: [PATCH] dri2: Handle calloc() failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Don't access invalid memory if calloc() fails to allocate the buffers
array.

Signed-off-by: Ville Syrjälä <ville.syrjala@nokia.com>
Reviewed-by: Tiago Vignatti <tiago.vignatti@nokia.com>
Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
---
 hw/xfree86/dri2/dri2.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index 10be59953..23b65949b 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -409,6 +409,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
 	&& (pPriv->serialNumber == DRI2DrawableSerial(pDraw));
 
     buffers = calloc((count + 1), sizeof(buffers[0]));
+    if (!buffers)
+	goto err_out;
 
     for (i = 0; i < count; i++) {
 	const unsigned attachment = *(attachments++);
@@ -501,13 +503,15 @@ err_out:
 
     *out_count = 0;
 
-    for (i = 0; i < count; i++) {
+    if (buffers) {
+	for (i = 0; i < count; i++) {
 	    if (buffers[i] != NULL)
-		    (*ds->DestroyBuffer)(pDraw, buffers[i]);
-    }
+		(*ds->DestroyBuffer)(pDraw, buffers[i]);
+	}
 
-    free(buffers);
-    buffers = NULL;
+	free(buffers);
+	buffers = NULL;
+    }
 
     update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height);