Check for NULL pointer (which can be returned for multiple reasons)
before trying to dereference it to add privates. To avoid memory leak
in error path, delay malloc of privates until we're ready to add them.
In case we do return NULL up through SyncInitDeviceIdleTime, handle the
possibility of getting NULL passed back down to SyncRemoveDeviceIdleTime.
As reported by parfait 1.1:
Error: Null pointer dereference (CWE 476)
Read from null pointer 'idle_time_counter'
at line 2764 of xserver/Xext/sync.c in function
'init_system_idle_counter'.
Function 'SyncCreateSystemCounter' may return constant 'NULL' at line
952, called at line 2756.
Null pointer introduced at line 952 in function
'SyncCreateSystemCounter'.
Signed-off-by: Alan Coopersmith <alan.coopersm...@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutte...@who-t.net>
---
Xext/sync.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/Xext/sync.c b/Xext/sync.c
index 4d11992..9ae5b39 100644
--- a/Xext/sync.c
+++ b/Xext/sync.c
@@ -2747,7 +2747,6 @@ init_system_idle_counter(const char *name, int deviceid)
{
CARD64 resolution;
XSyncValue idle;
- IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
SyncCounter *idle_time_counter;
IdleTimeQueryValue(NULL, &idle);
@@ -2758,10 +2757,14 @@ init_system_idle_counter(const char *name, int deviceid)
IdleTimeQueryValue,
IdleTimeBracketValues);
- priv->deviceid = deviceid;
- priv->value_less = priv->value_greater = NULL;
+ if (idle_time_counter != NULL) {
+ IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
- idle_time_counter->pSysCounterInfo->private = priv;
+ priv->value_less = priv->value_greater = NULL;
+ priv->deviceid = deviceid;
+
+ idle_time_counter->pSysCounterInfo->private = priv;
+ }
return idle_time_counter;
}
@@ -2786,6 +2789,6 @@ void SyncRemoveDeviceIdleTime(SyncCounter *counter)
/* FreeAllResources() frees all system counters before the devices are
shut down, check if there are any left before freeing the device's
counter */
- if (!xorg_list_is_empty(&SysCounterList))
+ if (counter && !xorg_list_is_empty(&SysCounterList))
xorg_list_del(&counter->pSysCounterInfo->entry);
}
--
1.7.9.2
_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: http://lists.x.org/mailman/listinfo/xorg-devel
