From 0d27fbb67caa8dc5a066e43c07b612ddb05ab1cd Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Fri, 17 Apr 2026 15:09:44 +1000
Subject: [PATCH] xkb: fix client-triggerable memory leak in
 ProcXkbGetKbdByName

CHK_MASK_LEGAL expands to 'return BadValue' when the check fails and
doesn't clean up the already allocated names.keycodes, names.types, etc.

Move the check up so we don't need any cleanup code.

Co-Authored-by: Claude Code <noreply@anthropic.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2184>
---
 xkb/xkb.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xkb/xkb.c b/xkb/xkb.c
index d7d51f9be..48f11cce0 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -6025,6 +6025,9 @@ ProcXkbGetKbdByName(ClientPtr client)
     if (stuff->load && dev->hasDdxKeymap)
         return BadAccess;
 
+    CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask);
+    CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);
+
     xkb = dev->key->xkbInfo->desc;
     status = Success;
     str = (unsigned char *) &stuff[1];
@@ -6055,9 +6058,6 @@ ProcXkbGetKbdByName(ClientPtr client)
         return status;
     }
 
-    CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask);
-    CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask);
-
     if (stuff->load)
         fwant = XkbGBN_AllComponentsMask;
     else