From 0f380a5005f800572773cd4667ce43c7459cc467 Mon Sep 17 00:00:00 2001 From: Jamey Sharp Date: Tue, 14 Sep 2010 18:35:21 -0700 Subject: Fix pixmap double-frees on error paths. If AddResource fails, it will automatically free the object that was passed to it by calling the appropriate deleteFunc; and of course FreeResource also calls the deleteFunc. In both cases it's wrong to call the destroy hook manually. Commit by Jamey Sharp and Josh Triplett. Signed-off-by: Jamey Sharp Signed-off-by: Josh Triplett Reviewed-by: Peter Hutterer Reviewed-by: Aaron Plattner --- Xext/shm.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) (limited to 'Xext/shm.c') diff --git a/Xext/shm.c b/Xext/shm.c index b08af821b..4141a8fe6 100644 --- a/Xext/shm.c +++ b/Xext/shm.c @@ -991,7 +991,6 @@ CreatePmap: pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER; pMap->drawable.id = newPix->info[j].id; if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) { - (*pScreen->DestroyPixmap)(pMap); result = BadAlloc; break; } @@ -1002,10 +1001,8 @@ CreatePmap: } if(result == BadAlloc) { - while(j--) { - (*pScreen->DestroyPixmap)(pMap); + while(j--) FreeResource(newPix->info[j].id, RT_NONE); - } free(newPix); } else AddResource(stuff->pid, XRT_PIXMAP, newPix); @@ -1110,7 +1107,6 @@ CreatePmap: { return Success; } - pDraw->pScreen->DestroyPixmap(pMap); } return BadAlloc; } -- cgit v1.2.3