Skip to content

N
nx-libs
Commit e8ada07f authored by Nickolai Zeldovich's avatar Nickolai Zeldovich Committed by Ulrich Sibiller
Browse files
Options

XListFontsWithInfo: avoid accessing realloc'ed memory

If exactly one of the two reallocs in XListFontsWithInfo() fails, the subsequent code accesses memory freed by the other realloc. Signed-off-by: 's avatarNickolai Zeldovich <nickolai@csail.mit.edu> Reviewed-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: 's avatarAlan Coopersmith <alan.coopersmith@oracle.com> (cherry picked from commit deedeada53676ee529d700bf96fde0b29a3a1def) Signed-off-by: 's avatarJulien Cristau <jcristau@debian.org> Backported-to-NX-by: 's avatarUlrich Sibiller <uli42@gmx.de>
parent 290f94ae
Show whitespace changes
Inline Side-by-side
Showing with 7 additions and 6 deletions
nx-X11/lib/X11/FontInfo.c
View file @ e8ada07f
...@@ -90,6 +90,11 @@ XFontStruct **info) /* RETURN */ ...@@ -90,6 +90,11 @@ XFontStruct **info) /* RETURN */
Xrealloc ((char *) flist, Xrealloc ((char *) flist,
(unsigned) (sizeof(char *) * (size+1))); (unsigned) (sizeof(char *) * (size+1)));
if (tmp_finfo)
finfo = tmp_finfo;
if (tmp_flist)
flist = tmp_flist;
if ((! tmp_finfo) || (! tmp_flist)) { if ((! tmp_finfo) || (! tmp_flist)) {
/* free all the memory that we allocated */ /* free all the memory that we allocated */
for (j=(i-1); (j >= 0); j--) { for (j=(i-1); (j >= 0); j--) {
...@@ -97,14 +102,10 @@ XFontStruct **info) /* RETURN */ ...@@ -97,14 +102,10 @@ XFontStruct **info) /* RETURN */
if (finfo[j].properties) if (finfo[j].properties)
Xfree((char *) finfo[j].properties); Xfree((char *) finfo[j].properties);
} }
if (tmp_flist) Xfree((char *) tmp_flist); Xfree((char *) flist);
else Xfree((char *) flist); Xfree((char *) finfo);
if (tmp_finfo) Xfree((char *) tmp_finfo);
else Xfree((char *) finfo);
goto clearwire; goto clearwire;
} }
finfo = tmp_finfo;
flist = tmp_flist;
} }
else { else {
if (! (finfo = (XFontStruct *) if (! (finfo = (XFontStruct *)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment