aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMathias Tillman2015-08-23 22:56:13 -0500
committerChristian König2015-08-24 04:11:20 -0500
commit5c42b5e36a4a02e579ec5dcdc3a95ce58538224c (patch)
tree2938a5b0080f6e8faf8efbac47166494be153290 /xf86drm.c
parent1eba47a76365576447d6346868a074dca24de1bf (diff)
downloadexternal-libdrm-5c42b5e36a4a02e579ec5dcdc3a95ce58538224c.tar.gz
external-libdrm-5c42b5e36a4a02e579ec5dcdc3a95ce58538224c.tar.xz
external-libdrm-5c42b5e36a4a02e579ec5dcdc3a95ce58538224c.zip
drm: fix the usage after free
For readdir_r(), the next directory entry is returned in caller-allocted buffer (pointered by pent here). https://bugs.freedesktop.org/show_bug.cgi?id=91704 Signed-off-by: Mathias Tillman <master.homer@gmail.com> Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com>
Diffstat (limited to 'xf86drm.c')
-rw-r--r--xf86drm.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/xf86drm.c b/xf86drm.c
index 5e029694..a7cc6438 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int type)
2803 2803
2804 while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) { 2804 while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
2805 if (strncmp(ent->d_name, name, len) == 0) { 2805 if (strncmp(ent->d_name, name, len) == 0) {
2806 snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
2807 ent->d_name);
2808
2806 free(pent); 2809 free(pent);
2807 closedir(sysdir); 2810 closedir(sysdir);
2808 2811
2809 snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
2810 ent->d_name);
2811 return strdup(dev_name); 2812 return strdup(dev_name);
2812 } 2813 }
2813 } 2814 }