fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2025-12-30 02:40:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

xwayland: Check for outputs before lease devices

Browse source 
In xwl_randr_request_lease(), the code checks first for leased device,
and then checks for existing output for lease.

The former assumes there are outputs for lease whereas the latter checks
for the output, connector and lease.

So if there is any existing rrLease->outputs[]->devPrivate unset, the
code would crash on a NULL pointer dereference on the first sanity check
before having a chance to reach the second check that would have caught
the problem.

Invert the sanity checks so that we would catch this first and return a
BadValue instead of possibly segfaulting.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Xaver Hugl <xaver.hugl@kde.org>
(cherry picked from commit 21916ae148)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1494>
This commit is contained in:
Olivier Fourdan 2024-04-25 16:43:16 +02:00
parent 34832a182c
commit cb6c7256ab
1 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
hw/xwayland/xwayland-drm-lease.c
View file

@ -116,6 +116,13 @@ xwl_randr_request_lease(ClientPtr client, ScreenPtr screen, RRLeasePtr rrLease)
return BadMatch;
}
for (i = 0; i < rrLease->numOutputs; ++i) {
output = rrLease->outputs[i]->devPrivate;
if (!output || !output->lease_connector || output->lease) {
return BadValue;
}
}
xorg_list_for_each_entry(device_data, &xwl_screen->drm_lease_devices, link) {
Bool connectors_of_device = FALSE;
for (i = 0; i < rrLease->numOutputs; ++i) {
@ -134,13 +141,6 @@ xwl_randr_request_lease(ClientPtr client, ScreenPtr screen, RRLeasePtr rrLease)
}
}
for (i = 0; i < rrLease->numOutputs; ++i) {
output = rrLease->outputs[i]->devPrivate;
if (!output || !output->lease_connector || output->lease) {
return BadValue;
}
}
req = wp_drm_lease_device_v1_create_lease_request(
lease_device->drm_lease_device);
lease_private = calloc(1, sizeof(struct xwl_drm_lease));