diff options
| author | Olivier Fourdan <ofourdan@redhat.com> | 2023-02-09 11:40:07 +0100 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2023-02-09 23:54:11 +0000 |
| commit | e196535abbf2ef4aa7c1eb0b4b9b67840032b88a (patch) | |
| tree | 640822b062ea93cf0f08453ad0bafa808e335706 | |
| parent | 2f8778ca68c44dcd6c86fab25c33704d825201d6 (diff) | |
| download | xserver-e196535abbf2ef4aa7c1eb0b4b9b67840032b88a.tar.gz | |
dix: Clear device sprite after free in AttachDevice()
The code in AttachDevice() may free the dev->spriteInfo->sprite under
some circumstances and later call GetCurrentRootWindow() which uses
the same dev->spriteInfo->sprite.
While it seems unlikely that this is actually an issue, considering the
cases where one or the other get called, it still makes the code look
suspicious.
Make sure to clear set dev->spriteInfo->sprite to NULL immediately
after it's freed to avoid any confusion, even if only to clarify the
code.
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1436
| -rw-r--r-- | dix/devices.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/dix/devices.c b/dix/devices.c index 5f9ce1678..f5ab17352 100644 --- a/dix/devices.c +++ b/dix/devices.c @@ -2630,6 +2630,7 @@ AttachDevice(ClientPtr client, DeviceIntPtr dev, DeviceIntPtr master) screen = miPointerGetScreen(dev); screen->DeviceCursorCleanup(dev, screen); free(dev->spriteInfo->sprite); + dev->spriteInfo->sprite = NULL; } dev->master = master; |