From 2ac840a14958fe74170518ee2c3a6b2dd88b20bd Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Tue, 28 Jan 2014 20:27:50 -0800
Subject: [PATCH] On realloc failure, free font_path_string instead of leaking
 it

Flagged by cppcheck 1.62:
[dix/dixfonts.c:1792]: (error) Common realloc mistake:
 'font_path_string' nulled but not freed upon failure

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Keith Packard <keithp@keithp.com>
(cherry picked from commit e6733ae91b7be52930f22a87de15fa05819ef948)
---
 dix/dixfonts.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index 2e34d370f..9a686e69c 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -1789,11 +1789,14 @@ GetFontPath(ClientPtr client, int *count, int *length, unsigned char **result)
         fpe = font_path_elements[i];
         len += fpe->name_length + 1;
     }
-    font_path_string = (unsigned char *) realloc(font_path_string, len);
-    if (!font_path_string)
+    c = realloc(font_path_string, len);
+    if (c == NULL) {
+        free(font_path_string);
+        font_path_string = NULL;
         return BadAlloc;
+    }
 
-    c = font_path_string;
+    font_path_string = c;
     *length = 0;
     for (i = 0; i < num_fpes; i++) {
         fpe = font_path_elements[i];