[PATCH] xfree86: fix a memory leak in edidMakeAtom().

[Leo Liu]

leak happens when looping `xrandr --prop', need free for the mallocated 
data,
duplication of passed data to make sure free dynamic allocation inside the
xf86RegisterRootWindowProperty().

v2: rebase
v3: remove cast from malloc return(Michel)

Signed-off-by: Leo Liu <leo.liu at amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
Reviewed-by: Michel Dänzer <michel.daenzer at amd.com>
---
  hw/xfree86/common/xf86Helper.c | 5 ++++-
  hw/xfree86/common/xf86Init.c   | 1 +
  hw/xfree86/ddc/ddcProperty.c   | 7 +------
  3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/hw/xfree86/common/xf86Helper.c b/hw/xfree86/common/xf86Helper.c
index c42e93e..ba61444 100644
--- a/hw/xfree86/common/xf86Helper.c
+++ b/hw/xfree86/common/xf86Helper.c
@@ -1858,6 +1858,7 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom 
property, Atom type,
      }
      else {
          free((void *) pNewProp->name);
+        free((void *) pNewProp->data);
          existing = TRUE;
      }

@@ -1865,7 +1866,9 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom 
property, Atom type,
      pNewProp->type = type;
      pNewProp->format = format;
      pNewProp->size = len;
-    pNewProp->data = value;
+    if (!(pNewProp->data = malloc(len * format/8)))
+        return BadAlloc;
+    memcpy(pNewProp->data, value, (len * format/8));

      DebugF("new property filled\n");

diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 017dcb6..bd098e3 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -746,6 +746,7 @@ InitOutput(ScreenInfo * pScreenInfo, int argc, char 
**argv)
                      xf86DrvMsg(xf86Screens[i]->scrnIndex, X_WARNING,
                                 "Failed to register VT properties\n");
              }
+            free(VT);
          }

          if (SeatId) {
diff --git a/hw/xfree86/ddc/ddcProperty.c b/hw/xfree86/ddc/ddcProperty.c
index fc63f0e..16dd476 100644
--- a/hw/xfree86/ddc/ddcProperty.c
+++ b/hw/xfree86/ddc/ddcProperty.c
@@ -38,14 +38,9 @@ static void
  edidMakeAtom(int i, const char *name, CARD8 *data, int size)
  {
      Atom atom;
-    unsigned char *atom_data;
-
-    if (!(atom_data = malloc(size * sizeof(CARD8))))
-        return;

      atom = MakeAtom(name, strlen(name), TRUE);
-    memcpy(atom_data, data, size);
-    xf86RegisterRootWindowProperty(i, atom, XA_INTEGER, 8, size, 
atom_data);
+    xf86RegisterRootWindowProperty(i, atom, XA_INTEGER, 8, size, data);
  }

  static void
-- 
2.5.0

On 12/15/2015 10:29 PM, Michel Dänzer wrote:
> On 11.12.2015 23:45, Leo Liu wrote:
>> Subject: [PATCH] xfree86: fix a memory leak in edidMakeAtom()
>>
>> leak happens when looping `xrandr --prop', need free for the mallocated
>> data,
>> duplication of passed data to make sure free dynamic allocation inside the
>> xf86RegisterRootWindowProperty().
>>
>> v2: rebase
>>
>> Signed-off-by: Leo Liu <leo.liu at amd.com>
>> Signed-off-by: Michel Dänzer <michel.daenzer at amd.com>
> [...]
>
>> @@ -1865,7 +1866,9 @@ xf86RegisterRootWindowProperty(int ScrnIndex, Atom
>> property, Atom type,
>>       pNewProp->type = type;
>>       pNewProp->format = format;
>>       pNewProp->size = len;
>> -    pNewProp->data = value;
>> +    if (!(pNewProp->data = (void *)malloc(len * format/8)))
> malloc returns void*, so this cast is superfluous. With that removed,
>
> Reviewed-by: Michel Dänzer <michel.daenzer at amd.com>
>
>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-xfree86-fix-a-memory-leak-in-edidMakeAtom.patch
Type: text/x-patch
Size: 2783 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20151216/4d12c15b/attachment.bin>