From f9eb5df80eaabdc72b2f2aa0998b409a89c17f68 Mon Sep 17 00:00:00 2001 From: emersion Date: Sat, 13 Oct 2018 10:58:59 +0200 Subject: backend: fix use-after-free in wlr_backend_autocreate Found by clang static analyzer. --- backend/backend.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/backend/backend.c b/backend/backend.c index 4b186767..c5dcdb48 100644 --- a/backend/backend.c +++ b/backend/backend.c @@ -217,16 +217,16 @@ struct wlr_backend *wlr_backend_autocreate(struct wl_display *display, backend, &multi->session, name, create_renderer_func); if (subbackend == NULL) { wlr_log(WLR_ERROR, "failed to start backend '%s'", name); - wlr_backend_destroy(backend); wlr_session_destroy(multi->session); + wlr_backend_destroy(backend); free(names); return NULL; } if (!wlr_multi_backend_add(backend, subbackend)) { wlr_log(WLR_ERROR, "failed to add backend '%s'", name); - wlr_backend_destroy(backend); wlr_session_destroy(multi->session); + wlr_backend_destroy(backend); free(names); return NULL; } @@ -272,8 +272,8 @@ struct wlr_backend *wlr_backend_autocreate(struct wl_display *display, multi->session); if (!libinput) { wlr_log(WLR_ERROR, "Failed to start libinput backend"); - wlr_backend_destroy(backend); wlr_session_destroy(multi->session); + wlr_backend_destroy(backend); return NULL; } wlr_multi_backend_add(backend, libinput); @@ -283,8 +283,8 @@ struct wlr_backend *wlr_backend_autocreate(struct wl_display *display, if (!primary_drm) { wlr_log(WLR_ERROR, "Failed to open any DRM device"); wlr_backend_destroy(libinput); - wlr_backend_destroy(backend); wlr_session_destroy(multi->session); + wlr_backend_destroy(backend); return NULL; } -- cgit v1.2.3 From a9e02a9ea6dcf45d2c36d6f19a7761746dd85a87 Mon Sep 17 00:00:00 2001 From: emersion Date: Sat, 13 Oct 2018 11:01:38 +0200 Subject: tablet-v2: fix memory leak on OOM, fix resource version --- types/tablet_v2/wlr_tablet_v2_pad.c | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/types/tablet_v2/wlr_tablet_v2_pad.c b/types/tablet_v2/wlr_tablet_v2_pad.c index 185abfe8..578eef06 100644 --- a/types/tablet_v2/wlr_tablet_v2_pad.c +++ b/types/tablet_v2/wlr_tablet_v2_pad.c @@ -188,10 +188,9 @@ static void add_tablet_pad_group(struct wlr_tablet_v2_tablet_pad *pad, struct wlr_tablet_pad_client_v2 *client, struct wlr_tablet_pad_group *group, size_t index) { - int version = wl_resource_get_version(client->resource); - client->groups[index] = - wl_resource_create(client->client, &zwp_tablet_pad_group_v2_interface, - version, 0); + uint32_t version = wl_resource_get_version(client->resource); + client->groups[index] = wl_resource_create(client->client, + &zwp_tablet_pad_group_v2_interface, version, 0); if (!client->groups[index]) { wl_client_post_no_memory(client->client); return; @@ -228,15 +227,17 @@ static void add_tablet_pad_group(struct wlr_tablet_v2_tablet_pad *pad, } user_data->pad = client; user_data->index = strip; - client->strips[strip] = - wl_resource_create(client->client, &zwp_tablet_pad_strip_v2_interface, 1, 0); + client->strips[strip] = wl_resource_create(client->client, + &zwp_tablet_pad_strip_v2_interface, version, 0); if (!client->strips[strip]) { + free(user_data); wl_client_post_no_memory(client->client); return; } wl_resource_set_implementation(client->strips[strip], &tablet_pad_strip_impl, user_data, destroy_tablet_pad_strip_v2); - zwp_tablet_pad_group_v2_send_strip(client->groups[index], client->strips[strip]); + zwp_tablet_pad_group_v2_send_strip(client->groups[index], + client->strips[strip]); } client->ring_count = group->ring_count; @@ -250,15 +251,17 @@ static void add_tablet_pad_group(struct wlr_tablet_v2_tablet_pad *pad, } user_data->pad = client; user_data->index = ring; - client->rings[ring] = - wl_resource_create(client->client, &zwp_tablet_pad_ring_v2_interface, 1, 0); + client->rings[ring] = wl_resource_create(client->client, + &zwp_tablet_pad_ring_v2_interface, version, 0); if (!client->rings[ring]) { + free(user_data); wl_client_post_no_memory(client->client); return; } wl_resource_set_implementation(client->rings[ring], &tablet_pad_ring_impl, user_data, destroy_tablet_pad_ring_v2); - zwp_tablet_pad_group_v2_send_ring(client->groups[index], client->rings[ring]); + zwp_tablet_pad_group_v2_send_ring(client->groups[index], + client->rings[ring]); } zwp_tablet_pad_group_v2_send_done(client->groups[index]); -- cgit v1.2.3