Since we are going to write into the buffer, we should make sure the allocation didn't fail.
Reported-by: Julien Cristau <[email protected]> Signed-off-by: Emilio Pozuelo Monfort <[email protected]> --- src/XIQueryDevice.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/XIQueryDevice.c b/src/XIQueryDevice.c index e3b0c9f..a877d78 100644 --- a/src/XIQueryDevice.c +++ b/src/XIQueryDevice.c @@ -66,17 +66,18 @@ XIQueryDevice(Display *dpy, int deviceid, int *ndevices_return) { *ndevices_return = reply.num_devices; info = Xmalloc((reply.num_devices + 1) * sizeof(XIDeviceInfo)); + buf = Xmalloc(reply.length * 4); } else { *ndevices_return = 0; info = NULL; + buf = NULL; } - if (!info) + if (!info || !buf) goto error; - buf = Xmalloc(reply.length * 4); _XRead(dpy, buf, reply.length * 4); ptr = buf; end = buf + reply.length * 4; @@ -135,9 +136,9 @@ error_loop: Xfree(info[i].name); Xfree(info[i].classes); } +error: Xfree(info); Xfree(buf); -error: UnlockDisplay(dpy); error_unlocked: SyncHandle(); -- 2.9.3 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: https://lists.x.org/mailman/listinfo/xorg-devel
