aboutsummaryrefslogtreecommitdiff
path: root/nx-X11/programs/Xserver/hw
diff options
context:
space:
mode:
authorUlrich Sibiller <uli42@gmx.de>2019-05-31 00:52:59 +0200
committerMike Gabriel <mike.gabriel@das-netzwerkteam.de>2020-01-05 22:08:13 +0100
commit730876f8fafba2aa5fdb411fe443b41d9bd67d2c (patch)
tree8fd67dd648d93b296fe7d41081c86b313ab63482 /nx-X11/programs/Xserver/hw
parent60e0566d801ad4937f3d082b56a82fd4c636457e (diff)
downloadnx-libs-730876f8fafba2aa5fdb411fe443b41d9bd67d2c.tar.gz
nx-libs-730876f8fafba2aa5fdb411fe443b41d9bd67d2c.tar.bz2
nx-libs-730876f8fafba2aa5fdb411fe443b41d9bd67d2c.zip
NXrender.c, render.c: fix memory handling bugs
Diffstat (limited to 'nx-X11/programs/Xserver/hw')
-rw-r--r--nx-X11/programs/Xserver/hw/nxagent/NXrender.c23
1 files changed, 19 insertions, 4 deletions
diff --git a/nx-X11/programs/Xserver/hw/nxagent/NXrender.c b/nx-X11/programs/Xserver/hw/nxagent/NXrender.c
index 105d7048b..0918ecfaf 100644
--- a/nx-X11/programs/Xserver/hw/nxagent/NXrender.c
+++ b/nx-X11/programs/Xserver/hw/nxagent/NXrender.c
@@ -1001,7 +1001,8 @@ ProcRenderCompositeGlyphs (ClientPtr client)
listsBase = (GlyphListPtr) malloc (nlist * sizeof (GlyphListRec));
if (!listsBase)
{
- free(glyphsBase);
+ if (glyphsBase != glyphsLocal)
+ free(glyphsBase);
return BadAlloc;
}
}
@@ -1009,9 +1010,11 @@ ProcRenderCompositeGlyphs (ClientPtr client)
elementsBase = malloc(nlist * sizeof(XGlyphElt8));
if (!elementsBase)
{
- free(glyphsBase);
- free(listsBase);
- return BadAlloc;
+ if (glyphsBase != glyphsLocal)
+ free(glyphsBase);
+ if (listsBase != listsLocal)
+ free(listsBase);
+ return BadAlloc;
}
buffer = (CARD8 *) (stuff + 1);
@@ -1044,6 +1047,9 @@ ProcRenderCompositeGlyphs (ClientPtr client)
free (glyphsBase);
if (listsBase != listsLocal)
free (listsBase);
+#ifdef NXAGENT_SERVER
+ free(elementsBase);
+#endif
return RenderErrBase + BadGlyphSet;
}
}
@@ -1101,7 +1107,16 @@ ProcRenderCompositeGlyphs (ClientPtr client)
}
}
if (buffer > end)
+ {
+ if (glyphsBase != glyphsLocal)
+ free(glyphsBase);
+ if (listsBase != listsLocal)
+ free(listsBase);
+#ifdef NXAGENT_SERVER
+ free(elementsBase);
+#endif
return BadLength;
+ }
/*
* We need to know the glyphs extents to synchronize