From 49bdf601435d9b5b29661d0bd2d07db48b46c271 Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Sat, 12 Oct 2024 16:38:55 -0700
Subject: [PATCH] render: avoid NULL pointer dereference if PictureFindVisual
 returns NULL

Found by Oracle Parfait 13.3:
   Null pointer dereference [null-pointer-deref]:
      Read from null pointer pVisual
        at line 257 of dix/colormap.c in function 'CreateColormap'.
          Null pointer introduced at line 412 of render/picture.c in
	   function 'PictureFindVisual'.
          Constant 'NULL' passed into function CreateColormap, argument
	   pVisual, from call at line 431 in function
	   'PictureInitIndexedFormat'.
          Function PictureFindVisual may return constant 'NULL' at
	   line 412, called at line 429.

Fixes: d4a101d4e ("Integration of DAMAGE-XFIXES branch to trunk")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
---
 render/picture.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/render/picture.c b/render/picture.c
index 0d3bb521c..1126eb97e 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -429,6 +429,9 @@ PictureInitIndexedFormat(ScreenPtr pScreen, PictFormatPtr format)
     else {
         VisualPtr pVisual = PictureFindVisual(pScreen, format->index.vid);
 
+        if (pVisual == NULL)
+            return FALSE;
+
         if (CreateColormap(FakeClientID(0), pScreen, pVisual,
                            &format->index.pColormap, AllocNone, 0)
             != Success)