geemili
/
drm
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm: fix the usage after free 

For readdir_r(), the next directory entry is returned in caller-allocted
buffer (pointered by pent here).

https://bugs.freedesktop.org/show_bug.cgi?id=91704

Signed-off-by: Mathias Tillman <master.homer@gmail.com>
Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
main
Mathias Tillman 2015-08-24 11:56:13 +08:00 committed by Christian König
parent 1eba47a763
commit 5c42b5e36a
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
xf86drm.c
View File

@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int type)
while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
if (strncmp(ent->d_name, name, len) == 0) {
snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
ent->d_name);
free(pent);
closedir(sysdir);
snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
ent->d_name);
return strdup(dev_name);
}
}