ProcRRSetCrtcConfigs uses 'configs' without being initialized

If the client sends invalid data for this request, the server will jump to 'sendReply' and call RRFreeCrtcConfigs, passing it the uninitialized 'configs' and 'num_configs' values. Signed-off-by: Keith Packard <[email protected]> Reviewed-by: Aaron Plattner <[email protected]>
juergbi · Dec 7, 2010 · b0f4bd6 · b0f4bd6
1 parent 752c368
commit b0f4bd6
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
@@ -1682,9 +1682,9 @@ ProcRRSetCrtcConfigs (ClientPtr client)
     rrScrPrivPtr	    scr_priv;
     xRRCrtcConfig	    *x_configs;
     RRScreenConfigRec	    screen_config;
-    RRCrtcConfigPtr	    configs;
+    RRCrtcConfigPtr	    configs = NULL;
     RROutput		    *output_ids;
-    int			    num_configs;
+    int			    num_configs = 0;
     int			    rc, i;
     int			    extra_len;
     int			    num_output_ids;