In error cleanup path, check to see if realloc returned NULL, if so, free the still valid input pointer; otherwise the input is no longer valid, so ignore it and free the realloc output pointer. Avoids potential double free if you run out of memory at the exact right spot.
Introduced-by: commit d39dbde390f0f609c03dbd79f0bcc6a3486ca8a3 Signed-off-by: Alan Coopersmith <[email protected]> --- xdm/util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xdm/util.c b/xdm/util.c index 2e2cdd7..732ae35 100644 --- a/xdm/util.c +++ b/xdm/util.c @@ -233,8 +233,8 @@ parseArgs (char **argv, const char *string) save = malloc ((unsigned) (string - word + 1)); if (!newargv || !save) { LogOutOfMem ("parseArgs"); - free (argv); - free (newargv); + /* free whichever survived realloc() */ + free (newargv ? newargv : argv); free (save); return NULL; } else { -- 1.7.9.2 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel
