diff options
Diffstat (limited to 'recipes/xorg-driver/xf86-input-tslib/double-free-crash.patch')
| -rw-r--r-- | recipes/xorg-driver/xf86-input-tslib/double-free-crash.patch | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/recipes/xorg-driver/xf86-input-tslib/double-free-crash.patch b/recipes/xorg-driver/xf86-input-tslib/double-free-crash.patch new file mode 100644 index 0000000000..07754731dd --- /dev/null +++ b/recipes/xorg-driver/xf86-input-tslib/double-free-crash.patch @@ -0,0 +1,20 @@ +xorg-server-1.7.3/hw/xfree86/common/xf86Helper.c contains this code +causing a double free crash on chvt or exit: + + /* This should *really* be handled in drv->UnInit(dev) call instead, but + * if the driver forgets about it make sure we free it or at least crash + * with flying colors */ + if (pInp->private) + xfree(pInp->private); +Index: xf86-input-tslib-0.0.6/src/tslib.c +=================================================================== +--- xf86-input-tslib-0.0.6.orig/src/tslib.c ++++ xf86-input-tslib-0.0.6/src/tslib.c +@@ -435,6 +435,7 @@ xf86TslibUninit(InputDriverPtr drv, Inpu + xf86TslibControlProc(pInfo->dev, DEVICE_OFF); + ts_close(priv->ts); + xfree(pInfo->private); ++ pInfo->private = NULL; + xf86DeleteInput(pInfo, 0); + } + |