1From 8a368d808fec166b5fb3dfe6312aab22c7ee20af Mon Sep 17 00:00:00 2001 2From: Hodong <hodong@yozmos.com> 3Date: Thu, 20 Jan 2022 00:57:41 +0900 4Subject: [PATCH] Fix two memory leaks in _XFreeX11XCBStructure() 5 6Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8a368d808fec166b5fb3dfe6312aab22c7ee20af] 7CVE: CVE-2022-3555 8Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> 9 10Fix two memory leaks in _XFreeX11XCBStructure() 11 12Even when XCloseDisplay() was called, some memory was leaked. 13 14XCloseDisplay() calls _XFreeDisplayStructure(), which calls 15_XFreeX11XCBStructure(). 16 17However, _XFreeX11XCBStructure() did not destroy the condition variables, 18resulting in the leaking of some 40 bytes. 19 20Signed-off-by: default avatarHodong <hodong@yozmos.com> 21--- 22 src/xcb_disp.c | 2 ++ 23 1 file changed, 2 insertions(+) 24 25diff --git a/src/xcb_disp.c b/src/xcb_disp.c 26index 70a602f..e9becee 100644 27--- a/src/xcb_disp.c 28+++ b/src/xcb_disp.c 29@@ -102,6 +102,8 @@ void _XFreeX11XCBStructure(Display *dpy) 30 dpy->xcb->pending_requests = tmp->next; 31 free(tmp); 32 } 33+ xcondition_clear(dpy->xcb->event_notify); 34+ xcondition_clear(dpy->xcb->reply_notify); 35 xcondition_free(dpy->xcb->event_notify); 36 xcondition_free(dpy->xcb->reply_notify); 37 Xfree(dpy->xcb); 38-- 392.25.1 40 41