[PATCH weston v3] compositor-rdp: rdp_destroy() double free error #91457

[Hardening]

Le 05/08/2015 22:20, Derek Foreman a écrit :
> On 05/08/15 03:21 PM, Dawid Gajownik wrote:
>> When something goes wrong during weston initialization,
>> weston_compositor_destroy() is executed. It destroys the backend and
>> then frees compositor memory. Unfortunately RDP backend is not correctly
>> destroyed. It frees compositor instead of a backend memory. This causes
>> later a double free error. The easiest way to reproduce a problem is to
>> run weston with an invalid option.
>>
>> Additionally some other objects of rdp_backend structure are not
>> destroyed/freed. The patch fixes both issues.
>>
>> Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91457
>>
>> v3: comply with Weston coding style, this time for real
>> v2: comply with Weston coding style
>>
>> Signed-off-by: Dawid Gajownik <gajownik at gmail.com>
> 
> Reviewed-by: Derek Foreman <derekf at osg.samsung.com>

Looks good to me too

Reviewed-by: David FORT <contact at hardening-consulting.com>

> 
>> ---
>>  src/compositor-rdp.c | 13 ++++++++++++-
>>  1 file changed, 12 insertions(+), 1 deletion(-)
>>
>> diff --git a/src/compositor-rdp.c b/src/compositor-rdp.c
>> index 6eac7f9..869c3f3 100644
>> --- a/src/compositor-rdp.c
>> +++ b/src/compositor-rdp.c
>> @@ -541,9 +541,20 @@ rdp_restore(struct weston_compositor *ec)
>>  static void
>>  rdp_destroy(struct weston_compositor *ec)
>>  {
>> +	struct rdp_backend *b = (struct rdp_backend *) ec->backend;
>> +	int i;
>> +
>>  	weston_compositor_shutdown(ec);
>> +	for (i = 0; i < MAX_FREERDP_FDS; i++)
>> +		if (b->listener_events[i])
>> +			wl_event_source_remove(b->listener_events[i]);
>> +
>> +	freerdp_listener_free(b->listener);
>>  
>> -	free(ec);
>> +	free(b->server_cert);
>> +	free(b->server_key);
>> +	free(b->rdp_key);
>> +	free(b);
>>  }
>>  
>>  static
>>
> 
> _______________________________________________
> wayland-devel mailing list
> wayland-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/wayland-devel
> 


-- 
David FORT
website: http://www.hardening-consulting.com/