Commit 730876f8 authored by Ulrich Sibiller's avatar Ulrich Sibiller Committed by Mike Gabriel

NXrender.c, render.c: fix memory handling bugs

parent 60e0566d
......@@ -1001,7 +1001,8 @@ ProcRenderCompositeGlyphs (ClientPtr client)
listsBase = (GlyphListPtr) malloc (nlist * sizeof (GlyphListRec));
if (!listsBase)
{
free(glyphsBase);
if (glyphsBase != glyphsLocal)
free(glyphsBase);
return BadAlloc;
}
}
......@@ -1009,9 +1010,11 @@ ProcRenderCompositeGlyphs (ClientPtr client)
elementsBase = malloc(nlist * sizeof(XGlyphElt8));
if (!elementsBase)
{
free(glyphsBase);
free(listsBase);
return BadAlloc;
if (glyphsBase != glyphsLocal)
free(glyphsBase);
if (listsBase != listsLocal)
free(listsBase);
return BadAlloc;
}
buffer = (CARD8 *) (stuff + 1);
......@@ -1044,6 +1047,9 @@ ProcRenderCompositeGlyphs (ClientPtr client)
free (glyphsBase);
if (listsBase != listsLocal)
free (listsBase);
#ifdef NXAGENT_SERVER
free(elementsBase);
#endif
return RenderErrBase + BadGlyphSet;
}
}
......@@ -1101,7 +1107,16 @@ ProcRenderCompositeGlyphs (ClientPtr client)
}
}
if (buffer > end)
{
if (glyphsBase != glyphsLocal)
free(glyphsBase);
if (listsBase != listsLocal)
free(listsBase);
#ifdef NXAGENT_SERVER
free(elementsBase);
#endif
return BadLength;
}
/*
* We need to know the glyphs extents to synchronize
......
......@@ -1347,9 +1347,8 @@ ProcRenderCompositeGlyphs (ClientPtr client)
listsBase = (GlyphListPtr) malloc (nlist * sizeof (GlyphListRec));
if (!listsBase)
{
free(glyphsBase);
free(listsBase);
if (glyphsBase != glyphsLocal)
free(glyphsBase);
return BadAlloc;
}
}
......@@ -1417,8 +1416,13 @@ ProcRenderCompositeGlyphs (ClientPtr client)
}
}
if (buffer > end)
{
if (glyphsBase != glyphsLocal)
free(glyphsBase);
if (listsBase != listsLocal)
free(listsBase);
return BadLength;
}
CompositeGlyphs (stuff->op,
pSrc,
pDst,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment