[PATCH] xfree86: fix a memory leak in edidMakeAtom().

[Leo Liu]

Thanks Michel.

Rebased and reattached.

Thanks,
Leo

Subject: [PATCH] xfree86: fix a memory leak in edidMakeAtom()

leak happens when looping `xrandr --prop', need free for the mallocated 
data,
duplication of passed data to make sure free dynamic allocation inside the
xf86RegisterRootWindowProperty().

v2: rebase

Signed-off-by: Leo Liu <leo.liu at amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
---
  hw/xfree86/common/xf86Helper.c | 5 ++++-
  hw/xfree86/common/xf86Init.c   | 1 +
  hw/xfree86/ddc/ddcProperty.c   | 7 +------
  3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c
index c42e93e..bcdbc70 100644
--- a/hw/xfree86/common/xf86Helper.c
+++ b/hw/xfree86/common/xf86Helper.c
@@ -1858,6 +1858,7 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom 
property, Atom type,
      }
      else {
          free((void *) pNewProp->name);
+        free((void *) pNewProp->data);
          existing = TRUE;
      }

@@ -1865,7 +1866,9 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom 
property, Atom type,
      pNewProp->type = type;
      pNewProp->format = format;
      pNewProp->size = len;
-    pNewProp->data = value;
+    if (!(pNewProp->data = (void *)malloc(len * format/8)))
+        return BadAlloc;
+    memcpy(pNewProp->data, value, (len * format/8));

      DebugF("new property filled\n");

diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 017dcb6..bd098e3 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -746,6 +746,7 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char 
**argv)
                      xf86DrvMsg(xf86Screens[i]->scrnIndex, X_WARNING,
                                 "Failed to register VT properties\n");
              }
+            free(VT);
          }

          if (SeatId) {
diff --git a/hw/xfree86/ddc/ddcProperty.c b/hw/xfree86/ddc/ddcProperty.c
index fc63f0e..16dd476 100644
--- a/hw/xfree86/ddc/ddcProperty.c
+++ b/hw/xfree86/ddc/ddcProperty.c
@@ -38,14 +38,9 @@ static void
  edidMakeAtom(int i, const char *name, CARD8 *data, int size)
  {
      Atom atom;
-    unsigned char *atom_data;
-
-    if (!(atom_data = malloc(size * sizeof(CARD8))))
-        return;

      atom = MakeAtom(name, strlen(name), TRUE);
-    memcpy(atom_data, data, size);
-    xf86RegisterRootWindowProperty(i, atom, XA_INTEGER, 8, size, 
atom_data);
+    xf86RegisterRootWindowProperty(i, atom, XA_INTEGER, 8, size, data);
  }

  static void
-- 
2.5.0

On 12/11/2015 02:04 AM, Michel Dänzer wrote:
> Hi Leo,
>
>
> any chance you could rebase this fix onto current xserver master? If
> not, I can give it a shot.
>
>
> On 07.08.2013 16:53, Michel Dänzer wrote:
>> From: Leo Liu <leo.liu at amd.com>
>>
>> leak happens when looping `xrandr --prop', need free for the mallocated data,
>> duplication of passed data to make sure free dynamic allocation inside the
>> xf86RegisterRootWindowProperty().
>>
>> Signed-off-by: Leo Liu <leo.liu at amd.com>
>> Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
>> ---
>>   hw/xfree86/common/xf86Helper.c |    6 +++++-
>>   hw/xfree86/common/xf86Init.c   |    1 +
>>   hw/xfree86/ddc/ddcProperty.c   |    7 +------
>>   3 files changed, 7 insertions(+), 7 deletions(-)
>>
>> diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c
>> index 721159d..ed8cc87 100644
>> --- a/hw/xfree86/common/xf86Helper.c
>> +++ b/hw/xfree86/common/xf86Helper.c
>> @@ -1813,6 +1813,7 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom property, Atom type,
>>       }
>>       else {
>>           free(pNewProp->name);
>> +        free(pNewProp->data);
>>           existing = TRUE;
>>       }
>>   
>> @@ -1820,7 +1821,10 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom property, Atom type,
>>       pNewProp->type = type;
>>       pNewProp->format = format;
>>       pNewProp->size = len;
>> -    pNewProp->data = value;
>> +    if (!(pNewProp->data = (pointer)malloc(len * format/8)))
>> +        return BadAlloc;
>> +    memcpy(pNewProp->data, value, (len * format/8));
>>   
>>       DebugF("new property filled\n");
>>   
>> diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
>> index 91ec4c8..9694ab4 100644
>> --- a/hw/xfree86/common/xf86Init.c
>> +++ b/hw/xfree86/common/xf86Init.c
>> @@ -747,6 +747,7 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char **argv)
>>                       xf86DrvMsg(xf86Screens[i]->scrnIndex, X_WARNING,
>>                                  "Failed to register VT property\n");
>>               }
>> +            free(VT);
>>           }
>>   
>>           if (SeatId) {
>> diff --git a/hw/xfree86/ddc/ddcProperty.c b/hw/xfree86/ddc/ddcProperty.c
>> index fc63f0e..16dd476 100644
>> --- a/hw/xfree86/ddc/ddcProperty.c
>> +++ b/hw/xfree86/ddc/ddcProperty.c
>> @@ -38,14 +38,9 @@ static void
>>   edidMakeAtom(int i, const char *name, CARD8 *data, int size)
>>   {
>>       Atom atom;
>> -    unsigned char *atom_data;
>> -
>> -    if (!(atom_data = malloc(size * sizeof(CARD8))))
>> -        return;
>>   
>>       atom = MakeAtom(name, strlen(name), TRUE);
>> -    memcpy(atom_data, data, size);
>> -    xf86RegisterRootWindowProperty(i, atom, XA_INTEGER, 8, size, atom_data);
>> +    xf86RegisterRootWindowProperty(i, atom, XA_INTEGER, 8, size, data);
>>   }
>>   
>>   static void
>>
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-xfree86-fix-a-memory-leak-in-edidMakeAtom.patch
Type: text/x-patch
Size: 2606 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20151211/171b4c06/attachment.bin>