[PATCH] drm: fix the usage after free

[Christian König]

Hi Mathias,

thanks for the good help and no problem with the Signed-off-by line. If 
you don't object we will just add a "Signed-off-by: Mathias Tillman 
<master.homer at gmail.com>" line when we push this patch to the repository.

It's just for tracking who created which code and who might know why 
something is implemented as it is, but since it's rather obvious what's 
wrong here there probably won't be any more questions about his.

I honestly don't remember if I have commit access to libdrm myself, but 
going to check. If not Alex or somebody else need to commit this.

Regards,
Christian.

On 24.08.2015 10:03, Mathias Tillman wrote:
> Sorry, no I am not a developer working on libdrm, this is my first 
> contribution to it in fact. How would I go about adding my Signed-Off?
>
> On Mon, 24 Aug 2015 at 09:59 Zhou, Jammy <Jammy.Zhou at amd.com 
> <mailto:Jammy.Zhou at amd.com>> wrote:
>
>     > Would be more convenient if Mathias would add his Signed-off-by
>     as well and send out the patch, cause he is the original author.
>
>     Agreed. Just was not quite sure if Mathias is working on the
>     libdrm project directly or not based on the comments in the
>     bugzilla "hopefully the fix can be pushed to master soon".
>
>     Regards,
>     Jammy
>
>     -----Original Message-----
>     From: Christian König [mailto:deathsimple at vodafone.de
>     <mailto:deathsimple at vodafone.de>]
>     Sent: Monday, August 24, 2015 3:52 PM
>     To: Zhou, Jammy; dri-devel at lists.freedesktop.org
>     <mailto:dri-devel at lists.freedesktop.org>; master.homer at gmail.com
>     <mailto:master.homer at gmail.com>
>     Subject: Re: [PATCH] drm: fix the usage after free
>
>     On 24.08.2015 05:56, Jammy Zhou wrote:
>     > From: Mathias Tillman <master.homer at gmail.com
>     <mailto:master.homer at gmail.com>>
>     >
>     > For readdir_r(), the next directory entry is returned in
>     > caller-allocted buffer (pointered by pent here).
>     >
>     > https://bugs.freedesktop.org/show_bug.cgi?id=91704
>     >
>     > Signed-off-by: Jammy Zhou <Jammy.Zhou at amd.com
>     <mailto:Jammy.Zhou at amd.com>>
>
>     Would be more convenient if Mathias would add his Signed-off-by as
>     well and send out the patch, cause he is the original author.
>
>     Anyway the patch is clearly a nice catch and Reviewed-by:
>     Christian König <christian.koenig at amd.com
>     <mailto:christian.koenig at amd.com>>
>
>     Regards,
>     Christian.
>
>     > ---
>     >   xf86drm.c | 5 +++--
>     >   1 file changed, 3 insertions(+), 2 deletions(-)
>     >
>     > diff --git a/xf86drm.c b/xf86drm.c
>     > index 5e02969..a7cc643 100644
>     > --- a/xf86drm.c
>     > +++ b/xf86drm.c
>     > @@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int
>     fd, int
>     > type)
>     >
>     >       while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
>     >               if (strncmp(ent->d_name, name, len) == 0) {
>     > +                     snprintf(dev_name, sizeof(dev_name),
>     DRM_DIR_NAME "/%s",
>     > +                              ent->d_name);
>     > +
>     >                       free(pent);
>     >                       closedir(sysdir);
>     >
>     > -                     snprintf(dev_name, sizeof(dev_name),
>     DRM_DIR_NAME "/%s",
>     > -                              ent->d_name);
>     >                       return strdup(dev_name);
>     >               }
>     >       }
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/dri-devel/attachments/20150824/fb484601/attachment-0001.html>