Bug#692030: xorg-server: Possible memory/resource leaks

[Niels Thykier <niels@thykier.net>]

Package: xorg-server
Version: 2:1.12.4-1
Severity: minor
Tags: upstream

Hi,

I noticed (thanks to cppcheck) a number of possible leaks in xorg-server.

I have tried to manually verify each of them and produce a possible
plug for them.  I haven't actually used the changes here and would
appreciate someone with more knowledge of Xorg-server's internals
having a look at them (hench the lack of a "patch" tag).

cppcheck do find a few more leaks than the ones I have listed, but
some were false-positives and a few of them I wasn't sure how to deal
with.

~Niels

--- xorg-server-1.12.4.orig/glx/glxdri.c
+++ xorg-server-1.12.4/glx/glxdri.c
@@ -635,8 +635,10 @@
     for (i = 0; i < pScreen->numVisuals; i++, visual++)
         if (visual->vid == glxConfig->visualID)
             break;
-    if (i == pScreen->numVisuals)
+    if (i == pScreen->numVisuals) {
+        free(context);
         return NULL;
+    }
 
     context->hwContextID = FakeClientID(0);
 
only in patch2:
unchanged:
--- xorg-server-1.12.4.orig/glx/glxdri2.c
+++ xorg-server-1.12.4/glx/glxdri2.c
@@ -701,6 +701,7 @@
                      &screen->fd, &driverName, &deviceName)) {
         LogMessage(X_INFO,
                    "AIGLX: Screen %d is not DRI2 capable\n", pScreen->myNum);
+        free(screen);
         return NULL;
     }
 
only in patch2:
unchanged:
--- xorg-server-1.12.4.orig/hw/dmx/dmxfont.c
+++ xorg-server-1.12.4/hw/dmx/dmxfont.c
@@ -405,6 +405,7 @@
             free(goodfps);
             return FALSE;
         }
+        free(goodfps);
     }
 
     /* Find requested font on back-end server */
only in patch2:
unchanged:
--- xorg-server-1.12.4.orig/hw/dmx/config/dmxcompat.c
+++ xorg-server-1.12.4/hw/dmx/config/dmxcompat.c
@@ -228,5 +228,7 @@
             break;
         }
     }
+    if (filename)
+      fclose(str);
     return entry;
 }
only in patch2:
unchanged:
--- xorg-server-1.12.4.orig/hw/dmx/glxProxy/glxcmds.c
+++ xorg-server-1.12.4/hw/dmx/glxProxy/glxcmds.c
@@ -1978,6 +1978,7 @@
         }
         else {
             client->errorValue = (visual ? visual : fbconfigId);
+            free(pGlxPixmap->be_xids);
             free(pGlxPixmap);
             return BadValue;
         }
@@ -1986,6 +1987,7 @@
     }
 
     if (!(AddResource(glxpixmapId, __glXPixmapRes, pGlxPixmap))) {
+        free(pGlxPixmap->be_xids);
         free(pGlxPixmap);
         return BadAlloc;
     }
only in patch2:
unchanged:
--- xorg-server-1.12.4.orig/hw/xfree86/common/xf86sbusBus.c
+++ xorg-server-1.12.4/hw/xfree86/common/xf86sbusBus.c
@@ -641,11 +641,12 @@
     int i, index;
     sbusCmapPtr cmap;
     struct fbcmap fbcmap;
-    unsigned char *data = malloc(numColors * 3);
+    unsigned char *data;
 
     cmap = SBUSCMAPPTR(pScrn->pScreen);
     if (!cmap)
         return;
+    data  = malloc(numColors * 3);
     fbcmap.count = 0;
     fbcmap.index = indices[0];
     fbcmap.red = data;
only in patch2:
unchanged:
--- xorg-server-1.12.4.orig/hw/xfree86/os-support/bus/Sbus.c
+++ xorg-server-1.12.4/hw/xfree86/os-support/bus/Sbus.c
@@ -617,8 +617,10 @@
         return 0;
     strcpy(name, pathName);
     name[i + 1] = 0;
-    if (name[0] != '/')
+    if (name[0] != '/') {
+        free(name);
         return 0;
+    }
     p = strchr(name + 1, '/');
     if (p)
         *p = 0;
@@ -629,8 +631,10 @@
         *regstr++ = 0;
     else
         regstr = p;
-    if (name + 1 == regstr)
+    if (name + 1 == regstr) {
+        free(name);
         return 0;
+    }
     promGetSibling(0);
     i = promWalkPathname2Node(name + 1, regstr, promRootNode, 0);
     free(name);