On Mon, 2011-03-28 at 16:14 +0300, Tiago Vignatti wrote:
> count = 0;
> while (idp) {
> - if (!configDevice(&gdp[count], idp->inactive_device, FALSE)) {
> - free(gdp);
> - return FALSE;
> - }
> + if (!configDevice(&gdp[count], idp->inactive_device, FALSE))
> + goto bail;
> count++;
> idp = (XF86ConfInactivePtr)idp->list.next;
> }
Since count is reset to 0 at the start of this loop, if configDevice()
fails at the first iteration for example, only slp[0].screen will be
freed in the "bail" part, while we might have allocated more than one
element in the allocation loop.
Moreover the count variable is first used in
while (adjp) {
And then in
while (idp) {
So it is counting different things I guess. The count of "adjp" needs to
be remembered I think, with special care for the 0 case:
if (!count)
{
slp[0].screen = xnfcalloc(1, sizeof(confScreenRec));
Nicolas
_______________________________________________
[email protected]: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
