compositor-fbdev: Avoid dereferencing a pointer in freed memory
authorRob Bradford <rob@linux.intel.com>
Fri, 26 Jul 2013 15:29:38 +0000 (16:29 +0100)
committerKristian Høgsberg <krh@bitplanet.net>
Tue, 30 Jul 2013 18:04:11 +0000 (11:04 -0700)
fbdev_output_destroy will free the memory passed into in and since we
want to pass the device name into fbdev_output_create we need to save
this to an intermediate value

src/compositor-fbdev.c

index 9c3d17e..36631f3 100644 (file)
@@ -673,6 +673,7 @@ fbdev_output_reenable(struct fbdev_compositor *compositor,
        struct fbdev_output *output = to_fbdev_output(base);
        struct fbdev_screeninfo new_screen_info;
        int fb_fd;
+       const char *device;
 
        weston_log("Re-enabling fbdev output.\n");
 
@@ -697,8 +698,9 @@ fbdev_output_reenable(struct fbdev_compositor *compositor,
                /* Remove and re-add the output so that resources depending on
                 * the frame buffer X/Y resolution (such as the shadow buffer)
                 * are re-initialised. */
+               device = output->device;
                fbdev_output_destroy(base);
-               fbdev_output_create(compositor, output->device);
+               fbdev_output_create(compositor, device);
 
                return 0;
        }