summaryrefslogtreecommitdiffstats
path: root/external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch
diff options
context:
space:
mode:
authorToshikazuOhiwa <toshikazu_ohiwa@mail.toyota.co.jp>2020-03-30 09:24:26 +0900
committerToshikazuOhiwa <toshikazu_ohiwa@mail.toyota.co.jp>2020-03-30 09:24:26 +0900
commit5b80bfd7bffd4c20d80b7c70a7130529e9a755dd (patch)
treeb4bb18dcd1487dbf1ea8127e5671b7bb2eded033 /external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch
parent706ad73eb02caf8532deaf5d38995bd258725cb8 (diff)
agl-basesystem
Diffstat (limited to 'external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch')
-rw-r--r--external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch20
1 files changed, 20 insertions, 0 deletions
diff --git a/external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch b/external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch
new file mode 100644
index 00000000..07754731
--- /dev/null
+++ b/external/meta-openembedded/meta-oe/recipes-graphics/xorg-driver/xf86-input-tslib/double-free-crash.patch
@@ -0,0 +1,20 @@
+xorg-server-1.7.3/hw/xfree86/common/xf86Helper.c contains this code
+causing a double free crash on chvt or exit:
+
+ /* This should *really* be handled in drv->UnInit(dev) call instead, but
+ * if the driver forgets about it make sure we free it or at least crash
+ * with flying colors */
+ if (pInp->private)
+ xfree(pInp->private);
+Index: xf86-input-tslib-0.0.6/src/tslib.c
+===================================================================
+--- xf86-input-tslib-0.0.6.orig/src/tslib.c
++++ xf86-input-tslib-0.0.6/src/tslib.c
+@@ -435,6 +435,7 @@ xf86TslibUninit(InputDriverPtr drv, Inpu
+ xf86TslibControlProc(pInfo->dev, DEVICE_OFF);
+ ts_close(priv->ts);
+ xfree(pInfo->private);
++ pInfo->private = NULL;
+ xf86DeleteInput(pInfo, 0);
+ }
+