<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [PATCH] rdp-backend: double free error when using unhandled option"
href="https://bugs.freedesktop.org/show_bug.cgi?id=91457">91457</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[PATCH] rdp-backend: double free error when using unhandled option
</td>
</tr>
<tr>
<th>Product</th>
<td>Wayland
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>weston
</td>
</tr>
<tr>
<th>Assignee</th>
<td>wayland-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>gajownik@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=117363" name="attach_117363" title="weston output">attachment 117363</a> <a href="attachment.cgi?id=117363&action=edit" title="weston output">[details]</a></span>
weston output
Weston with rdp-backend crashes with double free error message when unknown
messages is used.
Reproduction steps:
weston --backend=rdp-backend.so --rdp4-key=test --makemecrash
[snip]
[23:58:23.132] fatal: unhandled option: --makemecrash
*** Error in `weston': double free or corruption (!prev): 0x0000000000f0a8c0
***
======= Backtrace: =========
/lib64/libc.so.6(+0x77a8d)[0x7f44f4e60a8d]
/lib64/libc.so.6(cfree+0x5cd)[0x7f44f4e6cd2d]
weston[0x40858a]
/lib64/libc.so.6(__libc_start_main+0xf0)[0x7f44f4e09700]
weston(_start+0x29)[0x4089f9]
Explanation:
src/main.c:826
weston_compositor_destroy(ec)
src/compositor.c:weston_compositor_destroy()
compositor->backend->destroy(compositor);
free(compositor);
src/compositor-rdp.c:rdp_destroy(struct weston_compositor *ec)
{
weston_compositor_shutdown(ec);
free(ec);
}
weston_compositor_destroy() is the same function rdp_destroy(). ec and
compositor are the same pointers. free(compositor) is the second free() that
crashes weston.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>