shm: Fix use-after-free in ShmDestroyPixmap
We pass the pPixmap->drawable.id to the ShmDetachSegment function after the pPixmap is freed. Fortunately, we don't use the value inside ShmDetachSegment and can simply pass zero instead. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Michel Dänzer <michel@daenzer.net>
This commit is contained in:
parent
d61ae18074
commit
bcec9f867d
|
@ -260,7 +260,7 @@ ShmDestroyPixmap(PixmapPtr pPixmap)
|
|||
pScreen->DestroyPixmap = ShmDestroyPixmap;
|
||||
|
||||
if (shmdesc)
|
||||
ShmDetachSegment(shmdesc, pPixmap->drawable.id);
|
||||
ShmDetachSegment(shmdesc, 0);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
@ -427,7 +427,7 @@ ProcShmAttach(ClientPtr client)
|
|||
|
||||
/*ARGSUSED*/ static int
|
||||
ShmDetachSegment(void *value, /* must conform to DeleteType */
|
||||
XID shmseg)
|
||||
XID unused)
|
||||
{
|
||||
ShmDescPtr shmdesc = (ShmDescPtr) value;
|
||||
ShmDescPtr *prev;
|
||||
|
|
Loading…
Reference in New Issue
Block a user