frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle failure to create counter in init_system_idle_counter 

Check for NULL pointer (which can be returned for multiple reasons)
before trying to dereference it to add privates.   To avoid memory leak
in error path, delay malloc of privates until we're ready to add them.

In case we do return NULL up through SyncInitDeviceIdleTime, handle the
possibility of getting NULL passed back down to SyncRemoveDeviceIdleTime.

As reported by parfait 1.1:
Error: Null pointer dereference (CWE 476)
   Read from null pointer 'idle_time_counter'
        at line 2764 of xserver/Xext/sync.c in function 'init_system_idle_counter'.
          Function 'SyncCreateSystemCounter' may return constant 'NULL' at line 952, called at line 2756.
          Null pointer introduced at line 952 in function 'SyncCreateSystemCounter'.

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
This commit is contained in:
Alan Coopersmith 2013-01-27 10:06:42 -08:00
parent 7fe5e6dfa5
commit f4a9332ad1
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Xext/sync.c
View File

@ -2747,7 +2747,6 @@ init_system_idle_counter(const char *name, int deviceid)
{
CARD64 resolution;
XSyncValue idle;
IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
SyncCounter *idle_time_counter;
IdleTimeQueryValue(NULL, &idle);
@ -2758,10 +2757,14 @@ init_system_idle_counter(const char *name, int deviceid)
IdleTimeQueryValue,
IdleTimeBracketValues);
priv->deviceid = deviceid;
priv->value_less = priv->value_greater = NULL;
if (idle_time_counter != NULL) {
IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
idle_time_counter->pSysCounterInfo->private = priv;
priv->value_less = priv->value_greater = NULL;
priv->deviceid = deviceid;
idle_time_counter->pSysCounterInfo->private = priv;
}
return idle_time_counter;
}
@ -2786,6 +2789,6 @@ void SyncRemoveDeviceIdleTime(SyncCounter *counter)
/* FreeAllResources() frees all system counters before the devices are
shut down, check if there are any left before freeing the device's
counter */
if (!xorg_list_is_empty(&SysCounterList))
if (counter && !xorg_list_is_empty(&SysCounterList))
xorg_list_del(&counter->pSysCounterInfo->entry);
}