Commit 1e84fda2 authored by Michel Dänzer's avatar Michel Dänzer Committed by Michel Dänzer

xfree86: Take second reference for SavedCursor in xf86CursorSetCursor

The same pointer is kept in CurrentCursor as well, therefore two
RefCursor calls are needed.

Fixes use-after-free after switching VTs.

Closes: #1067
(cherry picked from commit 919f1f46)
parent 8c3c8bda
......@@ -334,6 +334,9 @@ xf86CursorSetCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCurs,
ScreenPriv->HotY = cursor->bits->yhot;
if (!infoPtr->pScrn->vtSema) {
cursor = RefCursor(cursor);
if (ScreenPriv->SavedCursor)
FreeCursor(ScreenPriv->SavedCursor, None);
ScreenPriv->SavedCursor = cursor;
return;
}
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment