diff options
author | Mathias Tillman | 2015-08-23 22:56:13 -0500 |
---|---|---|
committer | Christian König | 2015-08-24 04:11:20 -0500 |
commit | 5c42b5e36a4a02e579ec5dcdc3a95ce58538224c (patch) | |
tree | 2938a5b0080f6e8faf8efbac47166494be153290 /xf86drm.c | |
parent | 1eba47a76365576447d6346868a074dca24de1bf (diff) | |
download | external-libdrm-5c42b5e36a4a02e579ec5dcdc3a95ce58538224c.tar.gz external-libdrm-5c42b5e36a4a02e579ec5dcdc3a95ce58538224c.tar.xz external-libdrm-5c42b5e36a4a02e579ec5dcdc3a95ce58538224c.zip |
drm: fix the usage after free
For readdir_r(), the next directory entry is returned in caller-allocted
buffer (pointered by pent here).
https://bugs.freedesktop.org/show_bug.cgi?id=91704
Signed-off-by: Mathias Tillman <master.homer@gmail.com>
Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Diffstat (limited to 'xf86drm.c')
-rw-r--r-- | xf86drm.c | 5 |
1 files changed, 3 insertions, 2 deletions
@@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int type) | |||
2803 | 2803 | ||
2804 | while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) { | 2804 | while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) { |
2805 | if (strncmp(ent->d_name, name, len) == 0) { | 2805 | if (strncmp(ent->d_name, name, len) == 0) { |
2806 | snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s", | ||
2807 | ent->d_name); | ||
2808 | |||
2806 | free(pent); | 2809 | free(pent); |
2807 | closedir(sysdir); | 2810 | closedir(sysdir); |
2808 | 2811 | ||
2809 | snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s", | ||
2810 | ent->d_name); | ||
2811 | return strdup(dev_name); | 2812 | return strdup(dev_name); |
2812 | } | 2813 | } |
2813 | } | 2814 | } |