[vlc-commits] control/globalhotkeys: xcb: fix p_sys->p_map population

[Filip Roséen]

vlc | branch: master | Filip Roséen <filip at atch.se> | Sat Mar 18 18:00:33 2017 +0100| [0ad2356a5febddbd5e013d830543974216560d73] | committer: Hugo Beauzée-Luyssen

control/globalhotkeys: xcb: fix p_sys->p_map population

As described in #18136, certain configurations end up causing a
double-free in xcb.c:Close due to the same value returned from
xcb_key_symbols_get_keycode appearing multiple times in p_sys->p_map.

The code responsible for clean-up assumes that every value refers to a
separate allocated resource, whereas Mapping potentially populates
p_sys->p_map with the same value several times.

These changes make sure that initialization vs clean-up is in harmony.

fixes: #18136

Signed-off-by: Hugo Beauzée-Luyssen <hugo at beauzee.fr>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=0ad2356a5febddbd5e013d830543974216560d73
---

 modules/control/globalhotkeys/xcb.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/modules/control/globalhotkeys/xcb.c b/modules/control/globalhotkeys/xcb.c
index 42fb9f4..f083b81 100644
--- a/modules/control/globalhotkeys/xcb.c
+++ b/modules/control/globalhotkeys/xcb.c
@@ -308,11 +308,6 @@ static bool Mapping( intf_thread_t *p_intf )
         if( i_vlc_key == KEY_UNSET )
             continue;
 
-        xcb_keycode_t *p_keys = xcb_key_symbols_get_keycode(
-                p_sys->p_symbols, GetX11Key( i_vlc_key & ~KEY_MODIFIER ) );
-        if( !p_keys )
-            continue;
-
         const unsigned i_modifier = GetX11Modifier( p_sys->p_connection,
                 p_sys->p_symbols, i_vlc_key & KEY_MODIFIER );
 
@@ -325,6 +320,12 @@ static bool Mapping( intf_thread_t *p_intf )
             if( i != 0 && i_ignored == 0)
                 continue;
 
+            xcb_keycode_t *p_keys = xcb_key_symbols_get_keycode(
+                p_sys->p_symbols, GetX11Key( i_vlc_key & ~KEY_MODIFIER ) );
+
+            if( !p_keys )
+                break;
+
             hotkey_mapping_t *p_map = realloc( p_sys->p_map,
                               sizeof(*p_sys->p_map) * (p_sys->i_map+1) );
             if( !p_map )