Description of problem:
Coverity points out

120  	        if (qxl->guest_primary.qxl_stride > 0) {
121  	            qemu_free_displaysurface(vga->ds);

(4) Event alloc_fn: 	Storage is returned from allocation function "qemu_create_displaysurface_from(int, int, int, int, uint8_t *)". [details]
(5) Event leaked_storage: 	Ignoring storage allocated by "qemu_create_displaysurface_from(qxl->guest_primary.surface.width, qxl->guest_primary.surface.height, qxl->guest_primary.bits_pp, qxl->guest_primary.abs_stride, qxl->guest_primary.data)" leaks it.

122  	            qemu_create_displaysurface_from(qxl->guest_primary.surface.width,
123  	                                            qxl->guest_primary.surface.height,
124  	                                            qxl->guest_primary.bits_pp,
125  	                                            qxl->guest_primary.abs_stride,
126  	                                            qxl->guest_primary.data);
127  	        } else {
128  	            qemu_resize_displaysurface(vga->ds,
129  	                    qxl->guest_primary.surface.width,
130  	                    qxl->guest_primary.surface.height);
131  	        }
132  	        dpy_resize(vga->ds);

Not only does this leak the memory allocated by qemu_create_displaysurface_from() in line 122, it also keeps vga->ds pointing to the memory freed by qemu_free_displaysurface() in line 121, then passes it to dpy_resize() in line 132.

Version-Release number of selected component (if applicable):
qemu-kvm-0.12.1.2-2.340.el6

How reproducible:
Not tried; bug found by static analysis

Steps to Reproduce:
Non known

Actual results:
Memory leak, and use-after-free with unknown impact.

Expected results:
No leak, no use after free.