ProcRRSetCrtcConfigs uses 'configs' without being initialized
If the client sends invalid data for this request, the server will jump to 'sendReply' and call RRFreeCrtcConfigs, passing it the uninitialized 'configs' and 'num_configs' values. Signed-off-by: Keith Packard <keithp@keithp.com> Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
This commit is contained in:
parent
752c368421
commit
b0f4bd61f0
|
@ -1682,9 +1682,9 @@ ProcRRSetCrtcConfigs (ClientPtr client)
|
||||||
rrScrPrivPtr scr_priv;
|
rrScrPrivPtr scr_priv;
|
||||||
xRRCrtcConfig *x_configs;
|
xRRCrtcConfig *x_configs;
|
||||||
RRScreenConfigRec screen_config;
|
RRScreenConfigRec screen_config;
|
||||||
RRCrtcConfigPtr configs;
|
RRCrtcConfigPtr configs = NULL;
|
||||||
RROutput *output_ids;
|
RROutput *output_ids;
|
||||||
int num_configs;
|
int num_configs = 0;
|
||||||
int rc, i;
|
int rc, i;
|
||||||
int extra_len;
|
int extra_len;
|
||||||
int num_output_ids;
|
int num_output_ids;
|
||||||
|
|
Loading…
Reference in New Issue
Block a user