[PATCH xserver] Xext: dynamically allocate the PanoramiXDepths[j].vids array

[Peter Hutterer]

Control flow is:
   PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
   PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
   and writes those into the previously allocated array.

This caused invalid reads/writes followed by eventually a double-free abort.

Reproduced with xorg-integration-tests server test
XineramaTest.ScreenCrossing/* (and a bunch of others).

Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
---
 Xext/panoramiX.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/Xext/panoramiX.c b/Xext/panoramiX.c
index 844ea49ce..bd9c45b03 100644
--- a/Xext/panoramiX.c
+++ b/Xext/panoramiX.c
@@ -751,11 +751,7 @@ PanoramiXMaybeAddDepth(DepthPtr pDepth)
                                    PanoramiXNumDepths, sizeof(DepthRec));
     PanoramiXDepths[j].depth = pDepth->depth;
     PanoramiXDepths[j].numVids = 0;
-    /* XXX suboptimal, should grow these dynamically */
-    if (pDepth->numVids)
-        PanoramiXDepths[j].vids = xallocarray(pDepth->numVids, sizeof(VisualID));
-    else
-        PanoramiXDepths[j].vids = NULL;
+    PanoramiXDepths[j].vids = NULL;
 }
 
 static void
@@ -796,6 +792,9 @@ PanoramiXMaybeAddVisual(VisualPtr pVisual)
 
     for (k = 0; k < PanoramiXNumDepths; k++) {
         if (PanoramiXDepths[k].depth == pVisual->nplanes) {
+            PanoramiXDepths[k].vids = reallocarray(PanoramiXDepths[k].vids,
+                                                   PanoramiXDepths[k].numVids + 1,
+                                                   sizeof(VisualID));
             PanoramiXDepths[k].vids[PanoramiXDepths[k].numVids] = pVisual->vid;
             PanoramiXDepths[k].numVids++;
             break;
-- 
2.17.1