shared/frame: fix potential memory leak in frame_create

In frame_create, we need to destroy any frame buttons created
in preceding calls to frame_button_create during the function
execution if any of the successive calls to frame_button_create
fail.

This has minimal severity since most, if not all, cases in
frame_button_create that result in a fail (i.e. NULL result) means
a program is OOM and the program will have to exit/abort anyway.

Signed-off-by: U. Artie Eoff <ullysses.a.eoff@intel.com>

1 files changed, 25 insertions, 18 deletions

diff --git a/shared/frame.c b/shared/frame.c
index a501649f..2f24f82e 100644
--- a/shared/frame.c
+++ b/shared/frame.c
@@ -277,6 +277,26 @@ frame_touch_destroy(struct frame_touch *touch)
 	free(touch);
 }
 
+void
+frame_destroy(struct frame *frame)
+{
+	struct frame_button *button, *next;
+	struct frame_touch *touch, *next_touch;
+	struct frame_pointer *pointer, *next_pointer;
+
+	wl_list_for_each_safe(button, next, &frame->buttons, link)
+		frame_button_destroy(button);
+
+	wl_list_for_each_safe(touch, next_touch, &frame->touches, link)
+		frame_touch_destroy(touch);
+
+	wl_list_for_each_safe(pointer, next_pointer, &frame->pointers, link)
+		frame_pointer_destroy(pointer);
+
+	free(frame->title);
+	free(frame);
+}
+
 struct frame *
 frame_create(struct theme *t, int32_t width, int32_t height, uint32_t buttons,
 	     const char *title)
@@ -295,16 +315,16 @@ frame_create(struct theme *t, int32_t width, int32_t height, uint32_t buttons,
 	frame->status = FRAME_STATUS_REPAINT;
 	frame->geometry_dirty = 1;
 
+	wl_list_init(&frame->buttons);
+	wl_list_init(&frame->pointers);
+	wl_list_init(&frame->touches);
+
 	if (title) {
 		frame->title = strdup(title);
 		if (!frame->title)
 			goto free_frame;
 	}
 
-	wl_list_init(&frame->buttons);
-	wl_list_init(&frame->pointers);
-	wl_list_init(&frame->touches);
-
 	if (title) {
 		button = frame_button_create(frame,
 					     DATADIR "/weston/icon_window.png",
@@ -347,23 +367,10 @@ frame_create(struct theme *t, int32_t width, int32_t height, uint32_t buttons,
 	return frame;
 
 free_frame:
-	free(frame->title);
-	free(frame);
+	frame_destroy(frame);
 	return NULL;
 }
 
-void
-frame_destroy(struct frame *frame)
-{
-	struct frame_button *button, *next;
-
-	wl_list_for_each_safe(button, next, &frame->buttons, link)
-		frame_button_destroy(button);
-
-	free(frame->title);
-	free(frame);
-}
-
 int
 frame_set_title(struct frame *frame, const char *title)
 {