From 730876f8fafba2aa5fdb411fe443b41d9bd67d2c Mon Sep 17 00:00:00 2001 From: Ulrich Sibiller Date: Fri, 31 May 2019 00:52:59 +0200 Subject: NXrender.c, render.c: fix memory handling bugs --- nx-X11/programs/Xserver/hw/nxagent/NXrender.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) (limited to 'nx-X11/programs/Xserver/hw/nxagent/NXrender.c') diff --git a/nx-X11/programs/Xserver/hw/nxagent/NXrender.c b/nx-X11/programs/Xserver/hw/nxagent/NXrender.c index 105d7048b..0918ecfaf 100644 --- a/nx-X11/programs/Xserver/hw/nxagent/NXrender.c +++ b/nx-X11/programs/Xserver/hw/nxagent/NXrender.c @@ -1001,7 +1001,8 @@ ProcRenderCompositeGlyphs (ClientPtr client) listsBase = (GlyphListPtr) malloc (nlist * sizeof (GlyphListRec)); if (!listsBase) { - free(glyphsBase); + if (glyphsBase != glyphsLocal) + free(glyphsBase); return BadAlloc; } } @@ -1009,9 +1010,11 @@ ProcRenderCompositeGlyphs (ClientPtr client) elementsBase = malloc(nlist * sizeof(XGlyphElt8)); if (!elementsBase) { - free(glyphsBase); - free(listsBase); - return BadAlloc; + if (glyphsBase != glyphsLocal) + free(glyphsBase); + if (listsBase != listsLocal) + free(listsBase); + return BadAlloc; } buffer = (CARD8 *) (stuff + 1); @@ -1044,6 +1047,9 @@ ProcRenderCompositeGlyphs (ClientPtr client) free (glyphsBase); if (listsBase != listsLocal) free (listsBase); +#ifdef NXAGENT_SERVER + free(elementsBase); +#endif return RenderErrBase + BadGlyphSet; } } @@ -1101,7 +1107,16 @@ ProcRenderCompositeGlyphs (ClientPtr client) } } if (buffer > end) + { + if (glyphsBase != glyphsLocal) + free(glyphsBase); + if (listsBase != listsLocal) + free(listsBase); +#ifdef NXAGENT_SERVER + free(elementsBase); +#endif return BadLength; + } /* * We need to know the glyphs extents to synchronize -- cgit v1.2.3