[PATCH 1/2] dri2: Handle calloc() failure

[Ian Romanick]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/12/2011 07:37 AM, ville.syrjala at nokia.com wrote:
> From: Ville Syrjälä <ville.syrjala at nokia.com>
> 
> Don't access invalid memory if calloc() fails to allocate the buffers
> array.
> 
> Signed-off-by: Ville Syrjälä <ville.syrjala at nokia.com>

Nice catch.

Reviewed-by: Ian Romanick <ian.d.romanick at intel.com>

> ---
>  hw/xfree86/dri2/dri2.c |   14 +++++++++-----
>  1 files changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
> index 10be599..23b6594 100644
> --- a/hw/xfree86/dri2/dri2.c
> +++ b/hw/xfree86/dri2/dri2.c
> @@ -409,6 +409,8 @@ do_get_buffers(DrawablePtr pDraw, int *width, int *height,
>  	&& (pPriv->serialNumber == DRI2DrawableSerial(pDraw));
>  
>      buffers = calloc((count + 1), sizeof(buffers[0]));
> +    if (!buffers)
> +	goto err_out;
>  
>      for (i = 0; i < count; i++) {
>  	const unsigned attachment = *(attachments++);
> @@ -501,13 +503,15 @@ err_out:
>  
>      *out_count = 0;
>  
> -    for (i = 0; i < count; i++) {
> +    if (buffers) {
> +	for (i = 0; i < count; i++) {
>  	    if (buffers[i] != NULL)
> -		    (*ds->DestroyBuffer)(pDraw, buffers[i]);
> -    }
> +		(*ds->DestroyBuffer)(pDraw, buffers[i]);
> +	}
>  
> -    free(buffers);
> -    buffers = NULL;
> +	free(buffers);
> +	buffers = NULL;
> +    }
>  
>      update_dri2_drawable_buffers(pPriv, pDraw, buffers, out_count, width, height);
>  

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk2k3osACgkQX1gOwKyEAw/wowCbBt7tg/L54hWgWyJ0E+H3w88j
x3EAnj3KY0gSgiAVi+n6Xs0kGngYtAmG
=gL2B
-----END PGP SIGNATURE-----