summaryrefslogtreecommitdiffstats
path: root/server
diff options
context:
space:
mode:
authorMarc-André Lureau <marcandre.lureau@gmail.com>2014-10-24 15:08:35 +0200
committerMarc-André Lureau <marcandre.lureau@gmail.com>2014-11-25 15:37:45 +0100
commitc9685014e73025df416674b4c039079f4fe73faf (patch)
treeaf17765cc35e84b412fa1147a7a6d267c1f7657f /server
parent697f3214fd16adcd524456003619f7f44ddd031b (diff)
downloadspice-c9685014e73025df416674b4c039079f4fe73faf.tar.gz
spice-c9685014e73025df416674b4c039079f4fe73faf.tar.xz
spice-c9685014e73025df416674b4c039079f4fe73faf.zip
Validate RedDrawable before allocating drawable
Avoid unnecessary allocation (and possibly leaking) if the RedDrawable is not valid. Related to: rhbz#1135372
Diffstat (limited to 'server')
-rw-r--r--server/red_worker.c23
1 files changed, 12 insertions, 11 deletions
diff --git a/server/red_worker.c b/server/red_worker.c
index e177b683..9f184955 100644
--- a/server/red_worker.c
+++ b/server/red_worker.c
@@ -4068,6 +4068,17 @@ static Drawable *get_drawable(RedWorker *worker, uint8_t effect, RedDrawable *re
struct timespec time;
int x;
+ VALIDATE_SURFACE_RETVAL(worker, red_drawable->surface_id, NULL)
+ if (!validate_drawable_bbox(worker, red_drawable)) {
+ rendering_incorrect(__func__);
+ return NULL;
+ }
+ for (x = 0; x < 3; ++x) {
+ if (red_drawable->surfaces_dest[x] != -1) {
+ VALIDATE_SURFACE_RETVAL(worker, red_drawable->surfaces_dest[x], NULL)
+ }
+ }
+
while (!(drawable = alloc_drawable(worker))) {
free_one_drawable(worker, FALSE);
}
@@ -4093,17 +4104,7 @@ static Drawable *get_drawable(RedWorker *worker, uint8_t effect, RedDrawable *re
drawable->group_id = group_id;
drawable->surface_id = red_drawable->surface_id;
- VALIDATE_SURFACE_RETVAL(worker, drawable->surface_id, NULL)
- for (x = 0; x < 3; ++x) {
- drawable->surfaces_dest[x] = red_drawable->surfaces_dest[x];
- if (drawable->surfaces_dest[x] != -1) {
- VALIDATE_SURFACE_RETVAL(worker, drawable->surfaces_dest[x], NULL)
- }
- }
- if (!validate_drawable_bbox(worker, red_drawable)) {
- rendering_incorrect(__func__);
- return NULL;
- }
+ memcpy(drawable->surfaces_dest, red_drawable->surfaces_dest, sizeof(drawable->surfaces_dest));
ring_init(&drawable->pipes);
ring_init(&drawable->glz_ring);