mirror of
https://github.com/X11Libre/xserver.git
synced 2026-03-27 16:39:06 +00:00
dd5c2595a4
In the doListFontsWithInfo function in dixfonts.c, when a font alias is encountered (err == FontNameAlias), the code saves the current state and allocates memory for c->savedName. If the malloc(namelen + 1) call fails, c->savedName remains NULL, but c->haveSaved is still set to TRUE. Later, when a font is successfully resolved (err == Successful), the code uses c->savedName without checking if it is NULL, so there is potential null ptr dereference. XNFalloc will check result of malloc and stop program execution if allocation was failed. Found by Linux Verification Center (linuxtesting.org) with SVACE. Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1842 Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2062>