mirror of
https://github.com/X11Libre/xserver.git
synced 2026-04-14 17:18:09 +00:00
0237462d32
In the `doListFontsAndAliases` function in dixfonts.c, when a font alias is encountered (`err == FontNameAlias`) as a result of `list_next_font_or_alias` call, the code allocates memory for `resolved` variable (`resolvedlen + 1` bytes) for storing target font name. In this case, if the `malloc(resolvedlen + 1)` call fails, `resolved` remains NULL. Later, when check (`else if (err == FontNameAlias)`) is TRUE, the code uses `memcpy` to copy nullable `resolved` into `tmp_pattern` without checking if `resolved` is NULL, so there is a potential null ptr dereference. This commit replaces `malloc` with `XNFalloc` for allocating memory for `resolved`. `XNFalloc` will internally check result of `malloc` and stop program execution if allocation was failed, preventing potential NULL dereferencing. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2114>