hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-10-28 02:21:08 +00:00
Code Issues Projects Releases Wiki Activity

RegionValidate: Fix double free of badreg->data on the error path

Browse source 
RegionValidate() copies *badreg into ri[0].reg, so ri[0].reg.data aliases badreg->data. A later
RECTALLOC_BAIL() can realloc() that block and move it, updating ri[0].reg.data but not badreg->data. On
the bail path, freeing ri[0].reg.data and then calling RegionBreak(badreg) frees badreg->data a second
time, which by then is a stale pointer into memory already freed or reallocated to something else.

Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2281>
(cherry picked from commit 4ef1b4cd26)
(cherry picked from commit bb02769445b1a516f33b4855977cc227f0542cb7)
(cherry picked from commit bc0760d9514fe5f2d9e4f5287ab0318d45c32736)
(cherry picked from commit e84a8065c4)
This commit is contained in:
Jeremy Huddleston Sequoia 2026-08-20 00:11:23 -07:00 • committed by Enrico Weigelt
commit a3b9aa0c45
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
dix/region.c
View file

@ -1311,6 +1311,11 @@ RegionValidate(RegionPtr badreg, Bool *pOverlap)
for (int i = 0; i < numRI; i++)
xfreeData(&ri[i].reg);
free(ri);
/* ri[0].reg.data aliased badreg->data before RegionRectAlloc() could have
* reallocated it above, so badreg->data may now be a stale pointer to
* memory already freed by xfreeData() or by the realloc() itself.
*/
badreg->data = NULL;
return RegionBreak(badreg);
}