LookupClientResourceComplex is used by DRI1 code to find and free a DRI
drawable in a callback, however when the DRI code returns this->value
is now pointing at freed memory. It seemed easiest to store the value
to a temporary and return it afterwards.
Another option might be a new FreeClientResourceComplex or one that
also returns the id, so we can free it using an alternative means.
found using valgrind, any comments?
---
dix/resource.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/dix/resource.c b/dix/resource.c
index 73bc3a9..e8bdfec 100644
--- a/dix/resource.c
+++ b/dix/resource.c
@@ -717,8 +717,10 @@ LookupClientResourceComplex(
for (i = 0; i < clientTable[client->index].buckets; i++) {
for (this = resources[i]; this; this = this->next) {
if (!type || this->type == type) {
- if((*func)(this->value, this->id, cdata))
- return this->value;
+ /* workaround func freeing the type as DRI1 does */
+ pointer value = this->value;
+ if((*func)(value, this->id, cdata))
+ return value;
}
}
}
--
1.6.2.2
_______________________________________________
xorg-devel mailing list
[email protected]
http://lists.x.org/mailman/listinfo/xorg-devel
