mirrors/wayland
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wayland/wayland.git synced 2025-10-31 22:25:25 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

server: Fix shm_create_pool size fail path fd leak

Browse source 
If the client passed a size <= 0 to shm_create_pool, it would
go to err_free, which wouldn't close the fd, and thus leave it opened.

We can also move the size check before the struct wl_shm_pool
malloc, so in case the client passes a wrong size, it won't
do an unnecessary malloc and then free.
Reviewed-by: Bryce Harrington <bryce@osg.samsung.com>
Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
This commit is contained in:
Sergi Granell 2016-02-18 23:59:29 +01:00 • committed by Bryce Harrington
parent ba2ee84113
commit 5fe7e7ca78
1 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/wayland-shm.c
View file

@ -230,17 +230,17 @@ shm_create_pool(struct wl_client *client, struct wl_resource *resource,
{ {
struct wl_shm_pool *pool; struct wl_shm_pool *pool;
pool = malloc(sizeof *pool);
if (pool == NULL) {
wl_client_post_no_memory(client);
goto err_close;
}
if (size <= 0) { if (size <= 0) {
wl_resource_post_error(resource, wl_resource_post_error(resource,
WL_SHM_ERROR_INVALID_STRIDE, WL_SHM_ERROR_INVALID_STRIDE,
"invalid size (%d)", size); "invalid size (%d)", size);
goto err_free; goto err_close;
}
pool = malloc(sizeof *pool);
if (pool == NULL) {
wl_client_post_no_memory(client);
goto err_close;
} }
pool->refcount = 1; pool->refcount = 1;
@ -251,7 +251,7 @@ shm_create_pool(struct wl_client *client, struct wl_resource *resource,
wl_resource_post_error(resource, wl_resource_post_error(resource,
WL_SHM_ERROR_INVALID_FD, WL_SHM_ERROR_INVALID_FD,
"failed mmap fd %d", fd); "failed mmap fd %d", fd);
goto err_close; goto err_free;
} }
close(fd); close(fd);
@ -270,10 +270,10 @@ shm_create_pool(struct wl_client *client, struct wl_resource *resource,
return; return;
err_close:
close(fd);
err_free: err_free:
free(pool); free(pool);
err_close:
close(fd);
} }
static const struct wl_shm_interface shm_interface = { static const struct wl_shm_interface shm_interface = {