frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL 

The comments in that function say "This only happens if master is a
slave device. don't do that" but static analysis doesn't respect that.

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestptr
        at line 274 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 273 of Xi/xichangehierarchy.c in function
	   'remove_master'.
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer XTestkeybd
        at line 279 of Xi/xichangehierarchy.c in function 'remove_master'.
          Null pointer introduced at line 691 of Xext/xtest.c in function
	   'GetXTestDevice'.
          Function GetXTestDevice may return constant 'NULL' at line 691,
	   called at line 278 of Xi/xichangehierarchy.c in function
	   'remove_master'.

Fixes: 0814f511d ("input: store the master device's ID in the devPrivate for XTest devices.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
This commit is contained in:
Alan Coopersmith 2024-10-12 16:12:13 -07:00 committed by Enrico Weigelt, metux IT consult
parent 1d7b5e2957
commit 284ad8e473
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Xi/xichangehierarchy.c
View File

@ -263,11 +263,13 @@ remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES])
goto unwind;
XTestptr = GetXTestDevice(ptr);
BUG_RETURN_VAL(XTestptr == NULL, BadDevice);
rc = dixLookupDevice(&XTestptr, XTestptr->id, client, DixDestroyAccess);
if (rc != Success)
goto unwind;
XTestkeybd = GetXTestDevice(keybd);
BUG_RETURN_VAL(XTestkeybd == NULL, BadDevice);
rc = dixLookupDevice(&XTestkeybd, XTestkeybd->id, client, DixDestroyAccess);
if (rc != Success)
goto unwind;