[vlc-commits] kms: fix use-after-free on device string

[Alexandre Janniaux]

vlc | branch: master | Alexandre Janniaux <ajanni at videolabs.io> | Fri Apr 16 20:26:40 2021 +0200| [540437b0537b5eae85b4fc4bc6455097ea21b6b2] | committer: Alexandre Janniaux

kms: fix use-after-free on device string

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=540437b0537b5eae85b4fc4bc6455097ea21b6b2
---

 modules/video_output/kms.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/modules/video_output/kms.c b/modules/video_output/kms.c
index 9965f3a8ef..d1b6dbc7d6 100644
--- a/modules/video_output/kms.c
+++ b/modules/video_output/kms.c
@@ -525,12 +525,14 @@ static int OpenDisplay(vout_display_t *vd)
         free(psz_device);
         return VLC_EGENERIC;
     }
-    free(psz_device);
 
     drmSetClientCap(sys->drm_fd, DRM_CLIENT_CAP_UNIVERSAL_PLANES, 1);
 
     if (!ChromaNegotiation(vd))
+    {
+        free(psz_device);
         goto err_out;
+    }
 
     msg_Dbg(vd, "Using VLC chroma '%.4s', DRM chroma '%.4s'",
             (char*)&sys->vlc_fourcc, (char*)&sys->drm_fourcc);
@@ -538,8 +540,10 @@ static int OpenDisplay(vout_display_t *vd)
     ret = drmGetCap(sys->drm_fd, DRM_CAP_DUMB_BUFFER, &dumbRet);
     if (ret < 0 || !dumbRet) {
         msg_Err(vd, "Device '%s' does not support dumb buffers", psz_device);
+        free(psz_device);
         goto err_out;
     }
+    free(psz_device);
 
     modeRes = drmModeGetResources(sys->drm_fd);
     if (modeRes == NULL) {