[v3] No need to check for NULL, FreeCursor deals with that and this matches dix.
XFixes: Fix cursor reference when calling, XFixesGetCursorImage or XFixesGetCursorImageAndName. These two calls save a pointer to the current cursor during DisplayCursor(), but the cursor can be destroyed leaving a dangling reference. This patch wraps this using the cursor reference counters to ensure the cursor isn't deleted during it's use. This bug was fixed in RedHat's bugzilla database 18 months ago. https://bugzilla.redhat.com/show_bug.cgi?id=1357694 Signed-off-by: Alan Hourihane <[email protected]> --- xfixes/cursor.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xfixes/cursor.c b/xfixes/cursor.c index 09cf2fa69..869fff09d 100644 --- a/xfixes/cursor.c +++ b/xfixes/cursor.c @@ -154,7 +154,8 @@ CursorDisplayCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor) CursorEventPtr e; UpdateCurrentTimeIf(); - CursorCurrent[pDev->id] = pCursor; + FreeCursor(CursorCurrent[pDev->id], (Cursor) 0); + CursorCurrent[pDev->id] = RefCursor(pCursor); for (e = cursorEvents; e; e = e->next) { if ((e->eventMask & XFixesDisplayCursorNotifyMask)) { xXFixesCursorNotifyEvent ev = { -- 2.13.6 _______________________________________________ [email protected]: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: https://lists.x.org/mailman/listinfo/xorg-devel
