From 6034ce11b6cd31d42df0f5781f70d3073d91f95b Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sat, 4 Oct 2025 16:04:50 -0700 Subject: [PATCH] Xext/sync: Avoid dereference of invalid pointer if malloc() failed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reported incorrectly in #1817 as: xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2835:33: acquire_memory: allocated here xwayland-24.1.6/redhat-linux-build/../Xext/sync.c:2843:12: danger: ‘priv’ leaks here; was allocated at [(30)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/29) but the "leak" is really saving the pointer in an uninitalized pointer in a structure that was already freed when the malloc of the SysCounterInfo struct failed in SyncCreateSystemCounter(), because it returned the address of the freed struct instead of NULL to indicate failure. Signed-off-by: Alan Coopersmith Part-of: --- Xext/sync.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Xext/sync.c b/Xext/sync.c index d6bc95a60..e0c012849 100644 --- a/Xext/sync.c +++ b/Xext/sync.c @@ -1005,7 +1005,7 @@ SyncCreateSystemCounter(const char *name, psci = malloc(sizeof(SysCounterInfo)); if (!psci) { FreeResource(pCounter->sync.id, X11_RESTYPE_NONE); - return pCounter; + return NULL; } pCounter->pSysCounterInfo = psci; psci->pCounter = pCounter;