hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-29 02:31:18 +00:00
Code Issues Projects Releases Wiki Activity

dix: dispatch: clear the client slot when NextAvailableClient() fails

Browse source 
NextAvailableClient() stores the new client in clients[i] before
InitClientResources() and InsertFakeRequest(). If either fails, the
client is freed but clients[i] still points at it.

When i is a free slot below currentMaxClients, the next incoming
connection reaches EstablishNewConnections(), which walks
clients[1..currentMaxClients) and dereferences the freed client.

Clear clients[i] on both failure paths before freeing.

Signed-off-by: Mason Green <mason@greenm01.net>
(cherry picked from commit 157b3b3b81)
This commit is contained in:
Mason Green 2026-10-09 11:10:41 -04:00 • committed by Enrico Weigelt
commit 35724962f5
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
dix/dispatch.c
View file

@ -3776,6 +3776,7 @@ NextAvailableClient(void *ospriv)
return (ClientPtr) NULL;
InitClient(client, i, ospriv);
if (!InitClientResources(client)) {
clients[i] = NULL;
dixFreeObjectWithPrivates(client, PRIVATE_CLIENT);
return (ClientPtr) NULL;
}
@ -3783,6 +3784,7 @@ NextAvailableClient(void *ospriv)
data.length = bytes_to_int32(sz_xReq + sz_xConnClientPrefix);
if (!InsertFakeRequest(client, (char *) &data, sz_xReq)) {
FreeClientResources(client);
clients[i] = NULL;
dixFreeObjectWithPrivates(client, PRIVATE_CLIENT);
return (ClientPtr) NULL;
}