diff options
| author | Keith Packard <keithp@keithp.com> | 2010-12-05 21:53:25 -0800 |
|---|---|---|
| committer | Keith Packard <keithp@keithp.com> | 2010-12-06 20:09:08 -0800 |
| commit | b0f4bd61f0caf80f3be9a176f1f7a707bc6628d8 (patch) | |
| tree | 5f370444a77d253bf1b257f1f4cfb059f83f6c4c /randr | |
| parent | 752c368421c1c824752cf467fba9318d75d2ca2c (diff) | |
ProcRRSetCrtcConfigs uses 'configs' without being initialized
If the client sends invalid data for this request, the server
will jump to 'sendReply' and call RRFreeCrtcConfigs, passing it the
uninitialized 'configs' and 'num_configs' values.
Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Aaron Plattner <aplattner@nvidia.com>
Diffstat (limited to 'randr')
| -rw-r--r-- | randr/rrcrtc.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c index 97aa3d7fa..0fc818887 100644 --- a/randr/rrcrtc.c +++ b/randr/rrcrtc.c @@ -1682,9 +1682,9 @@ ProcRRSetCrtcConfigs (ClientPtr client) rrScrPrivPtr scr_priv; xRRCrtcConfig *x_configs; RRScreenConfigRec screen_config; - RRCrtcConfigPtr configs; + RRCrtcConfigPtr configs = NULL; RROutput *output_ids; - int num_configs; + int num_configs = 0; int rc, i; int extra_len; int num_output_ids; |