[PATCH 4/9] Fix pixmap double-frees on error paths.

[Peter Hutterer]

On Sat, Sep 17, 2011 at 03:22:30AM -0500, Jamey Sharp wrote:
> Commit by Jamey Sharp and Josh Triplett.
> 
> Signed-off-by: Jamey Sharp <jamey at minilop.net>
> Signed-off-by: Josh Triplett <josh at joshtriplett.org>
> ---
>  Xext/shm.c     |    6 +-----
>  dix/dispatch.c |    1 -
>  2 files changed, 1 insertions(+), 6 deletions(-)
> 
> diff --git a/Xext/shm.c b/Xext/shm.c
> index b08af82..4141a8f 100644
> --- a/Xext/shm.c
> +++ b/Xext/shm.c
> @@ -991,7 +991,6 @@ CreatePmap:
>  	    pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER;
>  	    pMap->drawable.id = newPix->info[j].id;
>  	    if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) {
> -		(*pScreen->DestroyPixmap)(pMap);
>  		result = BadAlloc;
>  		break;
>  	    }
> @@ -1002,10 +1001,8 @@ CreatePmap:
>      }
>  
>      if(result == BadAlloc) {
> -	while(j--) {
> -	    (*pScreen->DestroyPixmap)(pMap);
> +	while(j--)
>  	    FreeResource(newPix->info[j].id, RT_NONE);
> -	}
>  	free(newPix);
>      } else 
>  	AddResource(stuff->pid, XRT_PIXMAP, newPix);
> @@ -1110,7 +1107,6 @@ CreatePmap:
>  	{
>  	    return Success;
>  	}
> -	pDraw->pScreen->DestroyPixmap(pMap);
>      }

if we create the pixmap but it cannot be added to the resource (and return
BadAlloc), shouldn't we destroy it?

>      return BadAlloc;
>  }
> diff --git a/dix/dispatch.c b/dix/dispatch.c
> index 192c8c3..f8200b1 100644
> --- a/dix/dispatch.c
> +++ b/dix/dispatch.c
> @@ -1419,7 +1419,6 @@ CreatePmap:
>  	}
>  	if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap))
>  	    return Success;
> -	(*pDraw->pScreen->DestroyPixmap)(pMap);
>      }
>      return BadAlloc;
>  }

this seems to have the same issue

Cheers,
  Peter