| xorg-server-1.7.3/hw/xfree86/common/xf86Helper.c contains this code |
| causing a double free crash on chvt or exit: |
| |
| /* This should *really* be handled in drv->UnInit(dev) call instead, but |
| * if the driver forgets about it make sure we free it or at least crash |
| * with flying colors */ |
| if (pInp->private) |
| xfree(pInp->private); |
| Index: xf86-input-tslib-0.0.6/src/tslib.c |
| =================================================================== |
| --- xf86-input-tslib-0.0.6.orig/src/tslib.c |
| +++ xf86-input-tslib-0.0.6/src/tslib.c |
| @@ -435,6 +435,7 @@ xf86TslibUninit(InputDriverPtr drv, Inpu |
| xf86TslibControlProc(pInfo->dev, DEVICE_OFF); |
| ts_close(priv->ts); |
| xfree(pInfo->private); |
| + pInfo->private = NULL; |
| xf86DeleteInput(pInfo, 0); |
| } |
| |