diff options
| author | Dawid Gajownik <gajownik@gmail.com> | 2015-08-05 17:21:28 -0300 |
|---|---|---|
| committer | Daniel Stone <daniels@collabora.com> | 2015-08-06 16:10:57 +0100 |
| commit | 405ae2febaa3f1a6de5bd0eb65d9a6a811040cc9 (patch) | |
| tree | da98c64ebf084f9997661abd567e279d39428ba9 /src | |
| parent | 0b2bcbf3e3398ee187082a8d225695f06c97b63c (diff) | |
compositor-rdp: rdp_destroy() double free error #91457
When something goes wrong during weston initialization,
weston_compositor_destroy() is executed. It destroys the backend and
then frees compositor memory. Unfortunately RDP backend is not correctly
destroyed. It frees compositor instead of a backend memory. This causes
later a double free error. The easiest way to reproduce a problem is to
run weston with an invalid option.
Additionally some other objects of rdp_backend structure are not
destroyed/freed. The patch fixes both issues.
Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=91457
v3: comply with Weston coding style, this time for real
v2: comply with Weston coding style
Signed-off-by: Dawid Gajownik <gajownik@gmail.com>
Reviewed-by: David FORT <contact@hardening-consulting.com>
Reviewed-by: Derek Foreman <derekf@osg.samsung.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/compositor-rdp.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/src/compositor-rdp.c b/src/compositor-rdp.c index 6eac7f90..869c3f3c 100644 --- a/src/compositor-rdp.c +++ b/src/compositor-rdp.c @@ -541,9 +541,20 @@ rdp_restore(struct weston_compositor *ec) static void rdp_destroy(struct weston_compositor *ec) { + struct rdp_backend *b = (struct rdp_backend *) ec->backend; + int i; + weston_compositor_shutdown(ec); + for (i = 0; i < MAX_FREERDP_FDS; i++) + if (b->listener_events[i]) + wl_event_source_remove(b->listener_events[i]); + + freerdp_listener_free(b->listener); - free(ec); + free(b->server_cert); + free(b->server_key); + free(b->rdp_key); + free(b); } static |