From eab5bb0a5defb6f16120e4f4657a18b01df4f60f Mon Sep 17 00:00:00 2001 From: Jeremy Huddleston Sequoia Date: Thu, 20 Aug 2026 00:11:23 -0700 Subject: [PATCH] RegionValidate: Fix double free of badreg->data on the error path RegionValidate() copies *badreg into ri[0].reg, so ri[0].reg.data aliases badreg->data. A later RECTALLOC_BAIL() can realloc() that block and move it, updating ri[0].reg.data but not badreg->data. On the bail path, freeing ri[0].reg.data and then calling RegionBreak(badreg) frees badreg->data a second time, which by then is a stale pointer into memory already freed or reallocated to something else. Signed-off-by: Jeremy Huddleston Sequoia Part-of: (cherry picked from commit 4ef1b4cd2690c6d8e4b029b02bf707cb04d0da24) (cherry picked from commit bb02769445b1a516f33b4855977cc227f0542cb7) (cherry picked from commit bc0760d9514fe5f2d9e4f5287ab0318d45c32736) (cherry picked from commit e84a8065c4f33178bbc687fa0a67511fb9eb4165) --- dix/region.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dix/region.c b/dix/region.c index 1967c085c5..b4288243f6 100644 --- a/dix/region.c +++ b/dix/region.c @@ -1311,6 +1311,11 @@ RegionValidate(RegionPtr badreg, Bool *pOverlap) for (int i = 0; i < numRI; i++) xfreeData(&ri[i].reg); free(ri); + /* ri[0].reg.data aliased badreg->data before RegionRectAlloc() could have + * reallocated it above, so badreg->data may now be a stale pointer to + * memory already freed by xfreeData() or by the realloc() itself. + */ + badreg->data = NULL; return RegionBreak(badreg); }