[PATCH xserver 1/9] xvmc: Fix unchecked AddResource

[walter harms]

Am 07.03.2016 23:20, schrieb Julien Cristau:
> Signed-off-by: Julien Cristau <jcristau at debian.org>
> ---
>  Xext/xvmc.c | 17 ++++++++++++++---
>  1 file changed, 14 insertions(+), 3 deletions(-)
> 
> diff --git a/Xext/xvmc.c b/Xext/xvmc.c
> index 64eda92..7565c17 100644
> --- a/Xext/xvmc.c
> +++ b/Xext/xvmc.c
> @@ -253,6 +253,10 @@ ProcXvMCCreateContext(ClientPtr client)
>          free(pContext);
>          return result;
>      }
> +    if (!AddResource(pContext->context_id, XvMCRTContext, pContext)) {
> +        free(data);
> +        return BadAlloc;
> +    }
>  
>      rep = (xvmcCreateContextReply) {
>          .type = X_Reply,
> @@ -266,7 +270,6 @@ ProcXvMCCreateContext(ClientPtr client)
>      WriteToClient(client, sizeof(xvmcCreateContextReply), &rep);
>      if (dwords)
>          WriteToClient(client, dwords << 2, data);
> -    AddResource(pContext->context_id, XvMCRTContext, pContext);
>  
>      free(data);
>  
> @@ -329,6 +332,11 @@ ProcXvMCCreateSurface(ClientPtr client)
>          free(pSurface);
>          return result;
>      }
> +    if (!AddResource(pSurface->surface_id, XvMCRTSurface, pSurface)) {
> +        free(data);
> +        return BadAlloc;
> +    }
> +


I do not see the whole picture but the free a few lines before indicate that
the error path may need to free other previously allocated resources.

re,
 wh

>      rep = (xvmcCreateSurfaceReply) {
>          .type = X_Reply,
>          .sequenceNumber = client->sequence,
> @@ -338,7 +346,6 @@ ProcXvMCCreateSurface(ClientPtr client)
>      WriteToClient(client, sizeof(xvmcCreateSurfaceReply), &rep);
>      if (dwords)
>          WriteToClient(client, dwords << 2, data);
> -    AddResource(pSurface->surface_id, XvMCRTSurface, pSurface);
>  
>      free(data);
>  
> @@ -445,6 +452,11 @@ ProcXvMCCreateSubpicture(ClientPtr client)
>          free(pSubpicture);
>          return result;
>      }
> +    if (!AddResource(pSubpicture->subpicture_id, XvMCRTSubpicture, pSubpicture)) {
> +        free(data);
> +        return BadAlloc;
> +    }
> +
>      rep = (xvmcCreateSubpictureReply) {
>          .type = X_Reply,
>          .sequenceNumber = client->sequence,
> @@ -462,7 +474,6 @@ ProcXvMCCreateSubpicture(ClientPtr client)
>      WriteToClient(client, sizeof(xvmcCreateSubpictureReply), &rep);
>      if (dwords)
>          WriteToClient(client, dwords << 2, data);
> -    AddResource(pSubpicture->subpicture_id, XvMCRTSubpicture, pSubpicture);
>  
>      free(data);
>