Due to what looks like a copy & paste error, pScreenData->pBlueTbl would
be accessed after being free'd.
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
name_ptr and detail_ptr weren't free'd in some cases before returning
False.
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
If list_count is 0, dst would be allocated and leaked.
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Bitmap file data is read looping through the lines in the input file. If
there is extra data after the bitmap, these lines will be processed and
if this data represents another bitmap it will replace the one read
before causing the memory allocated for bits to leak.
This changes the code to stop processing the file once a bitmap was
read.
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Haven't restored the "specs" path in the install path, but have restored
libX11 & i18n subdirectories in the path for better logical grouping.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
Moves HAVE_XMLTO check into docbook.am, more closely matches behaviour
from before docbook.am changes (commit e8c76407d2)
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Gaetan Nadon <memsize@videotron.ca>
When writing technical documentation, it is often necessary to cross
reference to other information. When that other information is not in the
current document, additional support is needed, namely <olink>.
A new feature with version 1.7 of xorg-sgml-doctools adds references to
other documents within or outside this package.
This patch adds technical support for this feature but does not change
the content of the documentation as seen by the end user.
Each book or article must generate a database containing the href
of sections that can be referred to from another document. This database
is installed in DATAROOTDIR/sgml/X11/dbs. There is a requirement that
the value of DATAROOTDIR for xorg-sgml-doctools and for the package
documentation is the same. This forms a virtual document tree.
This database is consulted by other documents while they are being generated
in order to fulfill the missing information for linking.
Refer to the xorg-sgml-doctools for further technical information.
Co-authored-by: Matt Dew <marcoz@osource.org>
Signed-off-by: Gaetan Nadon <memsize@videotron.ca>
Add #define XK_SINHALA so that the Sinhala keysyms can be used by
the lk xkb keymap.
Signed-off-by: Harshula Jayasuriya <harshula@gmail.com>
Reviewed-by: Daniel Stone <daniel@fooishbar.org>
Historically, Xlib dropped the Display lock around the upcall to any
user-supplied _XErrorFunction, but somewhere along the way I quit doing
that if you built with XCB. The reasons are lost somewhere in the
pre-git history of Xlib/XCB, and I can't now see any reason to hold the
lock.
The documentation for XSetErrorHandler still applies though:
Because this condition is not assumed to be fatal, it is acceptable
for your error handler to return; the returned value is ignored.
However, the error handler should not call any functions (directly
or indirectly) on the display that will generate protocol requests
or that will look for input events.
So while you are now once again permitted to re-enter Xlib from the
error handler, you're only allowed to call non-protocol functions.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
This bug appears as a hang in applications that wait for replies from
multiple threads, where one such thread has taken a user lock using
XLockDisplay.
Prior to this fix, the code could deadlock in this way: If thread 1 goes
to sleep waiting for a reply, and then thread 2 takes a user lock and
waits for a reply, then thread 2 will wait for thread 1 to process its
reply (because responses must be processed in order), but thread 1 will
wait for thread 2 to drop its user lock.
Fixed by making thread 1 not wait for thread 2 to drop its user lock.
This makes the semantics of user locks hard to define, but they were
already hard to define. The new behavior appears to be consistent with
the way Xlib worked historically, anyway.
Fixes: http://lists.freedesktop.org/archives/xcb/2011-March/006802.html
There was a similar potential for deadlock in _XReadEvents, fixed the
same way, with the same caveats about user-lock semantics.
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Cannot reach dead statement "return NULL;"
Check for the NULLness of prop->name and prop->value instead of
name and value, which was checked earlier anyway. Decided against
using strdup due to curious memory allocation functions and the
rest of the xkb not using it either.
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Using uninitialized value "p->modifiers"
Small fix by using Xcalloc instead of Xmalloc
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Variable "map" goes out of scope
Release modifiermap before returning. Reordered code to call
XGetModifierMapping after the first return from the function.
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Reviewed-by: Dirk Wallenstein <halsmit@t-online.de>
Braille chords management needs key release events. We need to explicitly
request then, else GTK would not pass them throught XFilterEvent and braille
wouldn't work.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Braille patterns should also be usable in Compose. This combines the
implementation of braille chords and compose tree: only emit the braille
pattern if it can not be found in the compose tree, if any.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
_XimLocalMbLookupString can return a braille keysym even if _Xlcwctomb can't
convert to the current MB charset.
_XimLocalUtf8LookupString needs to set the braille keysym and status too.
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Error: Memory leak (CWE 401)
Memory leak of pointer 's' allocated with XCreateRegion()
at line 387 of /export/alanc/X.Org/sx86-gcc/lib/libX11/src/Region.c in function 'XShrinkRegion'.
's' allocated at line 387 with XCreateRegion().
s leaks when s != 0 at line 387.
Error: Memory leak (CWE 401)
Memory leak of pointer 'tra' allocated with XCreateRegion()
at line 1452 of /export/alanc/X.Org/sx86-gcc/lib/libX11/src/Region.c in function 'XXorRegion'.
'tra' allocated at line 1451 with XCreateRegion().
tra leaks when tra != 0 at line 1451.
[ This bug was found by the Parfait 0.3.6 bug checking tool.
For more information see http://labs.oracle.com/projects/parfait/ ]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
In the highly unlikely event that TransFileName was passed a path
containing multiple %L entries, for each entry it would call
_XlcFileName, leaking the previous results, and then for each entry it
would copy from that pointer and free it, resulting in invalid pointers
& possible double frees for each use after the first one freed it.
Error: Use after free (CWE 416)
Use after free of pointer 'lcCompose'
at line 358 of modules/im/ximcp/imLcPrs.c in function 'TransFileName'.
Previously freed at line 360 with free.
Error: Use after free (CWE 416)
Use after free of pointer 'lcCompose'
at line 359 of modules/im/ximcp/imLcPrs.c in function 'TransFileName'.
Previously freed at line 360 with free.
Error: Double free (CWE 415)
Double free of pointer 'lcCompose'
at line 360 of modules/im/ximcp/imLcPrs.c in function 'TransFileName'.
Previously freed at line 360 with free.
[ This bug was found by the Parfait 0.3.6 bug checking tool.
For more information see http://labs.oracle.com/projects/parfait/ ]
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Properly handle the return value of XGetWindowProperty by considering
if after the loop as well.
Using freed pointer "prop_ret"
There were numerous things wrong in how this function interacted with
XGetWindowProperty.
None of the local variables were initialized and remained that way if
the call to XGetWindowProperty returned 1 (not Succeed). That doesn't
result in after_ret being initialized in which case if it happens to
be 0, the loop was exited. In that case format_ret and nitems_ret were
uninitialized and the function might return with success (but with
uninitialized pointer in prop_ret) or XcmsFailure.
As the buffer enlarging code was called only when XGetWindowProperty
failed (returned not Success), after_ret would not have been
initialized. It would have been initialized only if the
XGetWindowProperty has returned Success earlier, but in that case the
code fragment would not have been reached.
This patch alters the function to return XcmsFailure if the call to
XGetWindowProperty fails.
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Reviewed-by: Rami Ylimäki <rami.ylimaki@vincit.fi>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
property_return was free'd before and in the case the conditional is true,
the call to XcmsGetProperty failed which means that property_return wasn't
set so there is no need to free it again.
Double free of pointer "property_return" in call to "free"
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
We can simplify the fstat failure case now that the GetFileSize macro
has been expanded inline.
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Removes XrmI.h header that only contained this single macro
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Possible overrun of 8192 byte fixed size buffer "buffer" by copying
"ext->name" without length checking
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fixed by zero'ing conv on allocation with Xcalloc. Then
close_converter works properly.
Using uninitialized value "conv->state" in call to function "close_converter"
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
The situation is already handled before this code.
Cannot reach dead expression "0U" inside statement "if (1U + (target_dir ? strl..."
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fixed by negative value to memcpy by checking for the negative return
value of _Xlcwctomb and returning 0/XLookupNone in that case.
a negative value was passed to memcpy
Unfortunately the other return values for *status don't fit into the
error (which appears to indicate some internal error or running out of
memory). The other valid status codes are XBufferOverflow,
XLookupNone, XLookupChars, XLookupKeySym, and XLookupBoth. Each of
these has a specific meaning attached.
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Checked return value of XGetWindowProperty and return false if it fails.
Return value of "XGetWindowProperty(im->core.display, spec->lib_connect_wid, prop, 0L, (length + bytes_after_ret + 3UL) / 4UL, 1, 0UL, &type_ret, &format_ret, &nitems, &bytes_after_ret, &prop_ret)" is not checked
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
info_list->watch_data was being reallocated, but the return value of
the reallocation was stored only into a local variable. This might
cause some funky behavior and crashes.
Variable "wd_array" goes out of scope
Value "wd_array" is overwritten in "wd_array = (XPointer*)realloc((char*)info_list->watch_data, (((dpy->watcher_count + 1) * 4U == 0U) ? 1U : ((dpy->watcher_count + 1) * 4U)))"
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Using uninitialized value "error.resourceID" in call to function "_XError"
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
The rest of the code uses goto's to free memory allocated later
and prevent memory leaks, but there were several paths were
property_return was free'd just before a goto.
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
property_return was not free'd if the allocation of pRedTbl failed.
Reviewed-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Tracked variable "size" was passed to a negative sink.
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
The NEWTABLE macro missed freeing its allocated memory on subsequent
memory allocation errors. Added call to Xfree.
Variable "table" goes out of scope
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fixed memory leak by adding Xfree for image
Variable "image" goes out of scope
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fixed memory leak by adding Xfree for colormap_ret
Variable "colormap_ret" goes out of scope
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Fixed memory leak by adding Xfree and initializing missing_list with NULL
Variable "missing_list" goes out of scope
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
XFree colormap_ret and initialize it when appropriate.
Variable "colormap_ret" goes out of scope
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Using uninitialized value "new"
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Pointer "pBuf" returned from "fgets(buf, 256, stream)" is never used
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Ander Conselvan de Oliveira <ander.conselvan-de-oliveira@nokia.com>
Signed-off-by: Erkki Seppälä <erkki.seppala@vincit.fi>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
