diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2014-01-06 17:10:39 -0800 |
|---|---|---|
| committer | Peter Hutterer <peter.hutterer@who-t.net> | 2014-01-09 13:36:29 +1000 |
| commit | 5493a67ec256d22a8a41597a345d8e1c54d6e335 (patch) | |
| tree | 655f288daaac41270385978f953f61b9dbc0b2c0 /dix | |
| parent | 3a113815a0cc86d64789494e905da9778174f738 (diff) | |
GrabDevice() needs to handle NULL return value from AllocGrab()
GrabDevice() calls AllocGrab() which can fail and return NULL.
This return value is not checked, and can cause NULL pointer dereferences.
Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Diffstat (limited to 'dix')
| -rw-r--r-- | dix/events.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/dix/events.c b/dix/events.c index 4aaa54c85..2f0605ef5 100644 --- a/dix/events.c +++ b/dix/events.c @@ -5051,7 +5051,7 @@ ProcUngrabPointer(ClientPtr client) * @param other_mode GrabModeSync or GrabModeAsync * @param status Return code to be returned to the caller. * - * @returns Success or BadValue. + * @returns Success or BadValue or BadAlloc. */ int GrabDevice(ClientPtr client, DeviceIntPtr dev, @@ -5132,6 +5132,8 @@ GrabDevice(ClientPtr client, DeviceIntPtr dev, GrabPtr tempGrab; tempGrab = AllocGrab(NULL); + if (tempGrab == NULL) + return BadAlloc; tempGrab->next = NULL; tempGrab->window = pWin; |