kdrive: protect against allocation failures and NULL pointers

Even if those situations shouldn't practically happen, it's better to have
some sanity checks just in case.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>

hw/kdrive/ephyr/ephyr.c

@@ -881,6 +881,8 @@ ephyrProcessExpose(xcb_generic_event_t *xev)
 {
     xcb_expose_event_t *expose = (xcb_expose_event_t *)xev;
     KdScreenInfo *screen = screen_from_window(expose->window);
+    if (!screen)
+        return;
     EphyrScrPriv *scrpriv = screen->driver;
 
     /* Wait for the last expose event in a series of cliprects
@@ -905,6 +907,9 @@ ephyrProcessMouseMotion(xcb_generic_event_t *xev)
     xcb_motion_notify_event_t *motion = (xcb_motion_notify_event_t *)xev;
     KdScreenInfo *screen = screen_from_window(motion->event);
 
+    if (!screen)
+        return;
+
     if (!ephyrMouse ||
         !((EphyrPointerPrivate *) ephyrMouse->driverPrivate)->enabled) {
         EPHYR_LOG("skipping mouse motion:%d\n", screen->pScreen->myNum);
@@ -1032,6 +1037,7 @@ ephyrProcessKeyRelease(xcb_generic_event_t *xev)
           || xcb_key_symbols_get_keysym(keysyms, key->detail, 0) == XK_Control_R)
          && (key->state & XCB_MOD_MASK_SHIFT)))) {
         KdScreenInfo *screen = screen_from_window(key->event);
+        assert(screen);
         EphyrScrPriv *scrpriv = screen->driver;
 
         if (grabbed_screen != -1) {
@@ -1266,6 +1272,9 @@ MouseInit(KdPointerInfo * pi)
 {
     pi->driverPrivate = (EphyrPointerPrivate *)
         calloc(1, sizeof(EphyrPointerPrivate));
+    if (!pi->driverPrivate)
+        return BadAlloc;
+
     ((EphyrPointerPrivate *) pi->driverPrivate)->enabled = FALSE;
     pi->nAxes = 3;
     pi->nButtons = 32;

hw/kdrive/ephyr/ephyrvideo.c

@@ -895,7 +895,6 @@ ephyrHostXVPutImage(KdScreenInfo * a_info,
     xcb_connection_t *conn = hostx_get_xcbconn();
     xcb_gcontext_t gc;
     Bool is_ok = TRUE;
-    xcb_rectangle_t *rects = NULL;
     int data_len, width, height;
     xcb_xv_query_image_attributes_cookie_t image_attr_cookie;
     xcb_xv_query_image_attributes_reply_t *image_attr_reply;
@@ -923,9 +922,10 @@ ephyrHostXVPutImage(KdScreenInfo * a_info,
     xcb_create_gc(conn, gc, scrpriv->win, 0, NULL);
 
     if (a_clip_rect_nums) {
-        int i = 0;
+        xcb_rectangle_t *rects = calloc(a_clip_rect_nums, sizeof(xcb_rectangle_t));
-        rects = calloc(a_clip_rect_nums, sizeof(xcb_rectangle_t));
+        if (!rects)
-        for (i=0; i < a_clip_rect_nums; i++) {
+            return FALSE;
+        for (int i=0; i < a_clip_rect_nums; i++) {
             rects[i].x = a_clip_rects[i].x1;
             rects[i].y = a_clip_rects[i].y1;
             rects[i].width = a_clip_rects[i].x2 - a_clip_rects[i].x1;

hw/kdrive/ephyr/hostx.c

@@ -249,7 +249,6 @@ hostx_get_output_geometry(const char *output,
                           int *width, int *height)
 {
     int i, name_len = 0, output_found = FALSE;
-    char *name = NULL;
     xcb_generic_error_t *error;
     xcb_randr_query_version_cookie_t version_c;
     xcb_randr_query_version_reply_t *version_r;
@@ -308,7 +307,9 @@ hostx_get_output_geometry(const char *output,
 
         /* Get output name */
         name_len = xcb_randr_get_output_info_name_length(output_info_r);
-        name = malloc(name_len + 1);
+        char *name = calloc(1, name_len + 1);
+        if (!name)
+            continue;
         strncpy(name, (char*)xcb_randr_get_output_info_name(output_info_r), name_len);
         name[name_len] = '\0';