From 6b1bbabe7f265201f1086d2bb254295ccb5ac1f9 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 17 Apr 2026 15:09:44 +1000
Subject: [PATCH] xkb: fix client-triggerable memory leak in
 ProcXkbGetKbdByName

CHK_MASK_LEGAL expands to 'return BadValue' when the check fails and
doesn't clean up the already allocated names.keycodes, names.types, etc.

Move the check up so we don't need any cleanup code.

Co-Authored-by: Claude Code <noreply@anthropic.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2184>
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
---
 xkb/xkb.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xkb/xkb.c b/xkb/xkb.c
index 1bc40c36d6..b0440fdf3f 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -5900,6 +5900,9 @@ ProcXkbGetKbdByName(ClientPtr client)
     if (!(client->xkbClientFlags & _XkbClientInitialized))
         return BadAccess;
 
+    CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask);
+    CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);
+
     CHK_KBD_DEVICE(dev, stuff->deviceSpec, client, access_mode);
     master = GetMaster(dev, MASTER_KEYBOARD);
 
@@ -5937,9 +5940,6 @@ ProcXkbGetKbdByName(ClientPtr client)
         return status;
     }
 
-    CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask);
-    CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);
-
     if (stuff->load)
         fwant = XkbGBN_AllComponentsMask;
     else