Julien Cristau wrote:
> On Mon, Nov 29, 2010 at 20:57:47 -0800, Alan Coopersmith wrote:
>
>> diff --git a/dix/devices.c b/dix/devices.c
>> index 708860a..db38c1a 100644
>> --- a/dix/devices.c
>> +++ b/dix/devices.c
>> @@ -2524,9 +2524,10 @@ AllocDevicePair (ClientPtr client, char* name,
>> if (!pointer)
>> return BadAlloc;
>>
>> - pointer->name = calloc(strlen(name) + strlen(" pointer") + 1,
>> sizeof(char));
>> - strcpy(pointer->name, name);
>> - strcat(pointer->name, " pointer");
>> + if (Xasprintf(&pointer->name, "%s pointer", name) == -1) {
>> + RemoveDevice(pointer, FALSE);
>> + return BadAlloc;
>> + }
>>
>
> I think you need to set pointer->name to NULL before calling
> RemoveDevice, as that will call CloseDevice which does free(dev->name).
>
>> pointer->public.processInputProc = ProcessOtherEvent;
>> pointer->public.realInputProc = ProcessOtherEvent;
>> @@ -2547,9 +2548,11 @@ AllocDevicePair (ClientPtr client, char* name,
>> return BadAlloc;
>> }
>>
>> - keyboard->name = calloc(strlen(name) + strlen(" keyboard") + 1,
>> sizeof(char));
>> - strcpy(keyboard->name, name);
>> - strcat(keyboard->name, " keyboard");
>> + if (Xasprintf(&pointer->name, "%s keyboard", name) == -1) {
>
> &keyboard->name
>
>> + RemoveDevice(pointer, FALSE);
>> + RemoveDevice(keyboard, FALSE);
>> + return BadAlloc;
>> + }
>>
>> keyboard->public.processInputProc = ProcessOtherEvent;
>> keyboard->public.realInputProc = ProcessOtherEvent;
Good catches - fixes coming in v2.
--
-Alan Coopersmith- [email protected]
Oracle Solaris Platform Engineering: X Window System
_______________________________________________
[email protected]: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
