summaryrefslogtreecommitdiff
path: root/Xext
diff options
context:
space:
mode:
authorJulien Cristau <jcristau@debian.org>2016-03-07 23:20:26 +0100
committerAdam Jackson <ajax@redhat.com>2016-03-11 13:14:33 -0500
commitab197ee9478a0e4e7a276c03645657b4f22ae9c0 (patch)
tree9beef5d02179526e65665cb76b32b9533ae6a686 /Xext
parentbd022f03143723ac326b39d6e67853650aa1bf1d (diff)
xvmc: Fix unchecked AddResource
Reviewed-by: RĂ©mi Cardona <remi@gentoo.org> Signed-off-by: Julien Cristau <jcristau@debian.org> (cherry picked from commit 119d5c0e2f800737c949ef760c5fe25d963200bf)
Diffstat (limited to 'Xext')
-rw-r--r--Xext/xvmc.c17
1 files changed, 14 insertions, 3 deletions
diff --git a/Xext/xvmc.c b/Xext/xvmc.c
index 64eda922b..7565c173d 100644
--- a/Xext/xvmc.c
+++ b/Xext/xvmc.c
@@ -253,6 +253,10 @@ ProcXvMCCreateContext(ClientPtr client)
free(pContext);
return result;
}
+ if (!AddResource(pContext->context_id, XvMCRTContext, pContext)) {
+ free(data);
+ return BadAlloc;
+ }
rep = (xvmcCreateContextReply) {
.type = X_Reply,
@@ -266,7 +270,6 @@ ProcXvMCCreateContext(ClientPtr client)
WriteToClient(client, sizeof(xvmcCreateContextReply), &rep);
if (dwords)
WriteToClient(client, dwords << 2, data);
- AddResource(pContext->context_id, XvMCRTContext, pContext);
free(data);
@@ -329,6 +332,11 @@ ProcXvMCCreateSurface(ClientPtr client)
free(pSurface);
return result;
}
+ if (!AddResource(pSurface->surface_id, XvMCRTSurface, pSurface)) {
+ free(data);
+ return BadAlloc;
+ }
+
rep = (xvmcCreateSurfaceReply) {
.type = X_Reply,
.sequenceNumber = client->sequence,
@@ -338,7 +346,6 @@ ProcXvMCCreateSurface(ClientPtr client)
WriteToClient(client, sizeof(xvmcCreateSurfaceReply), &rep);
if (dwords)
WriteToClient(client, dwords << 2, data);
- AddResource(pSurface->surface_id, XvMCRTSurface, pSurface);
free(data);
@@ -445,6 +452,11 @@ ProcXvMCCreateSubpicture(ClientPtr client)
free(pSubpicture);
return result;
}
+ if (!AddResource(pSubpicture->subpicture_id, XvMCRTSubpicture, pSubpicture)) {
+ free(data);
+ return BadAlloc;
+ }
+
rep = (xvmcCreateSubpictureReply) {
.type = X_Reply,
.sequenceNumber = client->sequence,
@@ -462,7 +474,6 @@ ProcXvMCCreateSubpicture(ClientPtr client)
WriteToClient(client, sizeof(xvmcCreateSubpictureReply), &rep);
if (dwords)
WriteToClient(client, dwords << 2, data);
- AddResource(pSubpicture->subpicture_id, XvMCRTSubpicture, pSubpicture);
free(data);