From 35724962f56d02170ed4f09a3f3ecdbb5708450e Mon Sep 17 00:00:00 2001 From: Mason Green Date: Fri, 9 Oct 2026 11:10:41 -0400 Subject: [PATCH] dix: dispatch: clear the client slot when NextAvailableClient() fails NextAvailableClient() stores the new client in clients[i] before InitClientResources() and InsertFakeRequest(). If either fails, the client is freed but clients[i] still points at it. When i is a free slot below currentMaxClients, the next incoming connection reaches EstablishNewConnections(), which walks clients[1..currentMaxClients) and dereferences the freed client. Clear clients[i] on both failure paths before freeing. Signed-off-by: Mason Green (cherry picked from commit 157b3b3b810b2a613464289da580b32003bf322f) --- dix/dispatch.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dix/dispatch.c b/dix/dispatch.c index f7dc019026..09ae12fffb 100644 --- a/dix/dispatch.c +++ b/dix/dispatch.c @@ -3776,6 +3776,7 @@ NextAvailableClient(void *ospriv) return (ClientPtr) NULL; InitClient(client, i, ospriv); if (!InitClientResources(client)) { + clients[i] = NULL; dixFreeObjectWithPrivates(client, PRIVATE_CLIENT); return (ClientPtr) NULL; } @@ -3783,6 +3784,7 @@ NextAvailableClient(void *ospriv) data.length = bytes_to_int32(sz_xReq + sz_xConnClientPrefix); if (!InsertFakeRequest(client, (char *) &data, sz_xReq)) { FreeClientResources(client); + clients[i] = NULL; dixFreeObjectWithPrivates(client, PRIVATE_CLIENT); return (ClientPtr) NULL; }