possible use after free in /dix/devices.c AttachDevice
I noticed a possible use after free in /dix/devices.c AttachDevice(ClientPtr client, DeviceIntPtr dev, DeviceIntPtr master)
if the following are true:
IsFloating(dev) && !master && !dev->enabled && dev->spriteInfo->paired == dev
free is here:
use is here:
I don't know when they are true, but it looks scary. Perhaps setting the dev->spriteInfo->sprite to NULL would reassure readers.