ICWrap.c dereferences the xim parameter passed in from client code without a NULL check. I have seen mplayer trigger this resulting in a segfault. In this case mplayer had called XOpenIM and NULL was returned which was later passed into XCreateIC.
Patch originally by Drew Moseley <drew_mose...@mentor.com>. Signed-off-by: Ross Burton <ross.bur...@intel.com> --- src/xlibi18n/ICWrap.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/xlibi18n/ICWrap.c b/src/xlibi18n/ICWrap.c index 8c1b4a0..69f080d 100644 --- a/src/xlibi18n/ICWrap.c +++ b/src/xlibi18n/ICWrap.c @@ -169,7 +169,7 @@ XSetIMValues(XIM im, ...) va_list var; int total_count; XIMArg *args; - char *ret; + char *ret = NULL; /* * so count the stuff dangling here @@ -185,7 +185,8 @@ XSetIMValues(XIM im, ...) _XIMVaToNestedList(var, total_count, &args); va_end(var); - ret = (*im->methods->set_values) (im, args); + if (im && im->methods) + ret = (*im->methods->set_values) (im, args); Xfree(args); return ret; } @@ -196,7 +197,7 @@ XGetIMValues(XIM im, ...) va_list var; int total_count; XIMArg *args; - char *ret; + char *ret = NULL; /* * so count the stuff dangling here @@ -212,7 +213,8 @@ XGetIMValues(XIM im, ...) _XIMVaToNestedList(var, total_count, &args); va_end(var); - ret = (*im->methods->get_values) (im, args); + if (im && im->methods) + ret = (*im->methods->get_values) (im, args); Xfree(args); return ret; } @@ -228,7 +230,7 @@ XCreateIC(XIM im, ...) va_list var; int total_count; XIMArg *args; - XIC ic; + XIC ic = NULL; /* * so count the stuff dangling here @@ -244,7 +246,8 @@ XCreateIC(XIM im, ...) _XIMVaToNestedList(var, total_count, &args); va_end(var); - ic = (XIC) (*im->methods->create_ic) (im, args); + if (im && im->methods) + ic = (XIC) (*im->methods->create_ic) (im, args); Xfree(args); if (ic) { ic->core.next = im->core.ic_chain; -- 2.1.4 _______________________________________________ xorg-devel@lists.x.org: X.Org development Archives: http://lists.x.org/archives/xorg-devel Info: http://lists.x.org/mailman/listinfo/xorg-devel