From c56e69bc850540f243ebb87c5bcc38713ef1862a Mon Sep 17 00:00:00 2001 From: Michael Tretter Date: Wed, 28 Sep 2022 12:17:29 +0200 Subject: [PATCH] ivi-shell: fix free in get_layers_under_surface If a controller requests the layers under a surface that has no views attached, Weston crashes since it tries to free the array that would be used to return the found layers, but has not been allocated before. Free the ppArray only if it was allocated in ivi_layout_get_layers_under_surface before and no layers were found. While at it, make it obvious that checking the length is an integer comparison by comparing it to 0. Signed-off-by: Michael Tretter --- ivi-shell/ivi-layout.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/ivi-shell/ivi-layout.c b/ivi-shell/ivi-layout.c index 2a7ff529..9e9ad338 100644 --- a/ivi-shell/ivi-layout.c +++ b/ivi-shell/ivi-layout.c @@ -1194,15 +1194,14 @@ ivi_layout_get_layers_under_surface(struct ivi_layout_surface *ivisurf, else length--; } + if (length == 0) { + free(*ppArray); + *ppArray = NULL; + } } *pLength = length; - if (!length) { - free(*ppArray); - *ppArray = NULL; - } - return IVI_SUCCEEDED; }