andreacavalli/xserver-multidpi
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

xfree86: Fix NULL pointer dereference crash

Browse Source 
screenp->displays[count] (passed to configDisplay() in
configScreen()) is NULL if there is no Virtual setting
in the configuration.

Fixes: f8a6be04d0 ("xfree86: Change
displays array to pointers array to fix invalid pointer issues
after table reallocation")

Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
(cherry picked from commit ef89b6648e)
This commit is contained in:
Zoltán Böszörményi 2021-06-21 12:12:41 +02:00 committed by Matt Turner
parent 9a59631a49
commit e49738f0c9
1 changed files with 10 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
hw/xfree86/common/xf86Config.c
View File

@ -1763,24 +1763,21 @@ configScreen(confScreenPtr screenp, XF86ConfScreenPtr conf_screen, int scrnum,
screenp->displays = xnfallocarray(count, sizeof(DispPtr));
screenp->numdisplays = count;
/* Fill in the default Virtual size, if any */
if (conf_screen->scrn_virtualX && conf_screen->scrn_virtualY) {
for (count = 0, dispptr = conf_screen->scrn_display_lst;
dispptr;
dispptr = (XF86ConfDisplayPtr) dispptr->list.next, count++) {
screenp->displays[count] = xnfcalloc(1, sizeof(DispRec));
for (count = 0, dispptr = conf_screen->scrn_display_lst;
dispptr;
dispptr = (XF86ConfDisplayPtr) dispptr->list.next, count++) {
/* Allocate individual Display records */
screenp->displays[count] = xnfcalloc(1, sizeof(DispRec));
/* Fill in the default Virtual size, if any */
if (conf_screen->scrn_virtualX && conf_screen->scrn_virtualY) {
screenp->displays[count]->virtualX = conf_screen->scrn_virtualX;
screenp->displays[count]->virtualY = conf_screen->scrn_virtualY;
}
}
/* Now do the per-Display Virtual sizes */
count = 0;
dispptr = conf_screen->scrn_display_lst;
while (dispptr) {
/* Now do the per-Display Virtual sizes */
configDisplay(screenp->displays[count], dispptr);
count++;
dispptr = (XF86ConfDisplayPtr) dispptr->list.next;
}
/*