gnome-rr-config: Make sure to copy over vendor/product/serial

When GnomeRROutputInfo is normally created, we strdup the
vendor/product/serial strings that we read from EDID. When it's
finalized, we free them as well.

When we copy the output info, we actually copy the raw struct, and then
selectively strdup members that we care about. When the copy is freed,
we then free the pointer that we dup'd from. When the original output
info is freed, this leads to a double-free. Due to coincidences, on x86,
this doesn't lead to a crash, but on ARM, the heap is completely
corrupted.

To prevent this, when we copy the output infos, strdup them from the
original output as well. We really should clean this API up so that it's
not so awfully RandR-y in style, since it's obvious that the APIs we
have aren't great and really aren't what we need.

https://bugzilla.gnome.org/show_bug.cgi?id=742569

1 files changed, 6 insertions, 0 deletions

diff --git a/libgnome-desktop/gnome-rr-config.c b/libgnome-desktop/gnome-rr-config.c
index 616c45e9..e6de41ff 100644
--- a/libgnome-desktop/gnome-rr-config.c
+++ b/libgnome-desktop/gnome-rr-config.c
@@ -427,6 +427,12 @@ make_outputs (GnomeRRConfig *config)
 	    new->priv->name = g_strdup (old->priv->name);
 	if (old->priv->display_name)
 	    new->priv->display_name = g_strdup (old->priv->display_name);
+        if (old->priv->vendor)
+            new->priv->vendor = g_strdup (old->priv->vendor);
+        if (old->priv->product)
+            new->priv->product = g_strdup (old->priv->product);
+        if (old->priv->serial)
+            new->priv->serial = g_strdup (old->priv->serial);
 
 	if (old->priv->on && !first_on)
 	    first_on = old;