Peter Hutterer 93cafb0828 Xext: dynamically allocate the PanoramiXDepths[j].vids array ...

Control flow is:
   PanoramiXMaybeAddDepth() allocates an array size 240 (pDepth->numVisuals)
   PanoramiXMaybeAddVisual() finds up to 270 matches (pScreen->numVisuals)
   and writes those into the previously allocated array.

This caused invalid reads/writes followed by eventually a double-free abort.

Reproduced with xorg-integration-tests server test
XineramaTest.ScreenCrossing/* (and a bunch of others).

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Keith Packard <keithp@keithp.com>

2018-07-19 11:52:14 +10:00

..

bigreq.c

…

dpms.c

…

dpmsproc.h

…

geext.c

…

geext.h

…

geint.h

…

hashtable.c

…

hashtable.h

…

Makefile.am

…

meson.build

…

panoramiX.c

…

panoramiX.h

…

panoramiXh.h

…

panoramiXprocs.c

…

panoramiXsrv.h

…

panoramiXSwap.c

…

saver.c

…

security.c

…

securitysrv.h

…

shape.c

…

shm.c

…

shmint.h

…

sleepuntil.c

…

sleepuntil.h

…

sync.c

…

syncsdk.h

…

syncsrv.h

…

vidmode.c

…

xace.c

…

xace.h

…

xacestr.h

…

xcmisc.c

…

xf86bigfont.c

…

xf86bigfontsrv.h

…

xres.c

…

xselinux_ext.c

…

xselinux_hooks.c

…

xselinux_label.c

…

xselinux.h

…

xselinuxint.h

…

xtest.c

…

xvdisp.c

…

xvdisp.h

…

xvdix.h

…

xvmain.c

…

xvmc.c

…

xvmcext.h

…