exa: fix a potential loophole in "mixed"

- Always free sys_ptr before setting the pixmap to pinned.

1 files changed, 13 insertions, 11 deletions

diff --git a/exa/exa_mixed.c b/exa/exa_mixed.c
index 47fa6d448..0d2552d8b 100644
--- a/exa/exa_mixed.c
+++ b/exa/exa_mixed.c
@@ -145,20 +145,22 @@ exaModifyPixmapHeader_mixed(PixmapPtr pPixmap, int width, int height, int depth,
     pExaPixmap = ExaGetPixmapPriv(pPixmap);
 
     if (pExaPixmap) {
-        if (pPixData) {
-	    if (!exaPixmapIsPinned(pPixmap)) {
-		free(pExaPixmap->sys_ptr);
-
-		/* We no longer need this. */
-		if (pExaPixmap->pDamage) {
-		    DamageUnregister(&pPixmap->drawable, pExaPixmap->pDamage);
-		    DamageDestroy(pExaPixmap->pDamage);
-		    pExaPixmap->pDamage = NULL;
-		}
+	if (!exaPixmapIsPinned(pPixmap)) {
+	    free(pExaPixmap->sys_ptr);
+	    pExaPixmap->sys_ptr = pPixmap->devPrivate.ptr = NULL;
+	    pExaPixmap->sys_pitch = pPixmap->devKind = 0;
+
+	    /* We no longer need this. */
+	    if (pExaPixmap->pDamage) {
+		DamageUnregister(&pPixmap->drawable, pExaPixmap->pDamage);
+		DamageDestroy(pExaPixmap->pDamage);
+		pExaPixmap->pDamage = NULL;
 	    }
-            pExaPixmap->sys_ptr = pPixData;
 	}
 
+        if (pPixData)
+            pExaPixmap->sys_ptr = pPixData;
+
         if (devKind > 0)
             pExaPixmap->sys_pitch = devKind;