Xext: panoramix: extra safety checks

Even though risk of being actually hit is minimal, better having some extra
safety checks instead of segfaulting, just in case.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>

Xext/panoramiX.c

@@ -806,7 +806,6 @@ extern void
 PanoramiXConsolidate(void)
 {
     int i;
-    PanoramiXRes *root, *defmap, *saver;
     ScreenPtr pScreen = screenInfo.screens[0];
     DepthPtr pDepth = pScreen->allowedDepths;
     VisualPtr pVisual = pScreen->visuals;
@@ -820,11 +819,23 @@ PanoramiXConsolidate(void)
     for (i = 0; i < pScreen->numVisuals; i++)
         PanoramiXMaybeAddVisual(pVisual++);
 
-    root = malloc(sizeof(PanoramiXRes));
+    PanoramiXRes *root = calloc(1, sizeof(PanoramiXRes));
+    if (!root)
+        return;
+
     root->type = XRT_WINDOW;
-    defmap = malloc(sizeof(PanoramiXRes));
+    PanoramiXRes *defmap = calloc(1, sizeof(PanoramiXRes));
+    if (!defmap) {
+        free(root);
+        return;
+    }
     defmap->type = XRT_COLORMAP;
-    saver = malloc(sizeof(PanoramiXRes));
+    PanoramiXRes *saver = calloc(1, sizeof(PanoramiXRes));
+    if (!saver) {
+        free(root);
+        free(defmap);
+        return;
+    }
     saver->type = XRT_WINDOW;
 
     FOR_NSCREENS(i) {
@@ -1253,12 +1264,16 @@ XineramaGetImageData(DrawablePtr *pDrawables,
                     for (j = 0, index = (pitch * y) + x, index2 = 0; j < h;
                          j++, index += pitch, index2 += ScratchPitch) {
                         if (w) {
-                            if (!shift)
+                            if (!shift) {
+                                assert(ScratchMem);
                                 memcpy(data + index, ScratchMem + index2, w);
-                            else
+                            }
+                            else {
+                                assert(ScratchMem);
                                 CopyBits(data + index, shift,
                                          ScratchMem + index2, w);
                             }
+                        }
 
                         if (leftover) {
                             data[index + w] |=
@@ -1277,6 +1292,7 @@ XineramaGetImageData(DrawablePtr *pDrawables,
                     w *= j;
 
                     for (j = 0; j < h; j++) {
+                        assert(ScratchMem);
                         memcpy(data + (pitch * (y + j)) + x,
                                ScratchMem + (ScratchPitch * j), w);
                     }

Xext/panoramiXprocs.c

@@ -1098,7 +1098,7 @@ PanoramiXCopyArea(ClientPtr client)
     if ((dst->type == XRT_PIXMAP) && (src->type == XRT_WINDOW)) {
         DrawablePtr drawables[MAXSCREENS];
         DrawablePtr pDst;
-        GCPtr pGC;
+        GCPtr pGC = NULL;
         char *data;
         int pitch, rc;
 
@@ -1136,7 +1136,7 @@ PanoramiXCopyArea(ClientPtr client)
         }
         free(data);
 
-        if (pGC->graphicsExposures) {
+        if (pGC && pGC->graphicsExposures) {
             RegionRec rgn;
             int dx, dy;
             BoxRec sourceBox;

Xext/shape.c

@@ -938,7 +938,7 @@ ProcShapeGetRectangles(ClientPtr client)
     REQUEST(xShapeGetRectanglesReq);
     WindowPtr pWin;
     xShapeGetRectanglesReply rep;
-    xRectangle *rects;
+    xRectangle *rects = NULL;
     int nrects, i, rc;
     RegionPtr region;
 
@@ -991,8 +991,9 @@ ProcShapeGetRectangles(ClientPtr client)
 
         nrects = RegionNumRects(region);
         box = RegionRects(region);
-        rects = xallocarray(nrects, sizeof(xRectangle));
+        if (nrects) {
-        if (!rects && nrects)
+            rects = calloc(nrects, sizeof(xRectangle));
+            if (!rects)
                 return BadAlloc;
             for (i = 0; i < nrects; i++, box++) {
                 rects[i].x = box->x1;
@@ -1001,6 +1002,7 @@ ProcShapeGetRectangles(ClientPtr client)
                 rects[i].height = box->y2 - box->y1;
             }
         }
+    }
     rep = (xShapeGetRectanglesReply) {
         .type = X_Reply,
         .ordering = YXBanded,

Xext/shm.c

@@ -1536,6 +1536,8 @@ ShmExtensionInit(void)
         for (i = 0; i < screenInfo.numScreens; i++) {
             ShmScrPrivateRec *screen_priv =
                 ShmInitScreenPriv(screenInfo.screens[i]);
+            if (!screen_priv)
+                continue;
             if (!screen_priv->shmFuncs)
                 screen_priv->shmFuncs = &miFuncs;
             if (!screen_priv->shmFuncs->CreatePixmap)

Xext/sync.c

@@ -2647,16 +2647,15 @@ typedef struct {
 static void
 IdleTimeQueryValue(void *pCounter, int64_t *pValue_return)
 {
-    int deviceid;
+    int deviceid = XIAllDevices;
     CARD32 idle;
 
     if (pCounter) {
         SyncCounter *counter = pCounter;
         IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+        if (priv)
             deviceid = priv->deviceid;
     }
-    else
-        deviceid = XIAllDevices;
     idle = GetTimeInMillis() - LastEventTime(deviceid).milliseconds;
     *pValue_return = idle;
 }
@@ -2666,6 +2665,8 @@ IdleTimeBlockHandler(void *pCounter, void *wt)
 {
     SyncCounter *counter = pCounter;
     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+    if (!priv)
+        return;
     int64_t *less = priv->value_less;
     int64_t *greater = priv->value_greater;
     int64_t idle, old_idle;
@@ -2756,6 +2757,8 @@ IdleTimeWakeupHandler(void *pCounter, int rc)
 {
     SyncCounter *counter = pCounter;
     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+    if (!priv)
+        return;
     int64_t *less = priv->value_less;
     int64_t *greater = priv->value_greater;
     int64_t idle;
@@ -2789,6 +2792,8 @@ IdleTimeBracketValues(void *pCounter, int64_t *pbracket_less,
 {
     SyncCounter *counter = pCounter;
     IdleCounterPriv *priv = SysCounterGetPrivate(counter);
+    if (!priv)
+        return;
     int64_t *less = priv->value_less;
     int64_t *greater = priv->value_greater;
     Bool registered = (less || greater);
@@ -2818,20 +2823,24 @@ init_system_idle_counter(const char *name, int deviceid)
 
     IdleTimeQueryValue(NULL, &idle);
 
+    IdleCounterPriv *priv = calloc(1, sizeof(IdleCounterPriv));
+    if (!priv)
+        return NULL;
+
     idle_time_counter = SyncCreateSystemCounter(name, idle, resolution,
                                                 XSyncCounterUnrestricted,
                                                 IdleTimeQueryValue,
                                                 IdleTimeBracketValues);
 
-    if (idle_time_counter != NULL) {
+    if (!idle_time_counter) {
-        IdleCounterPriv *priv = malloc(sizeof(IdleCounterPriv));
+        free(priv);
+        return NULL;
+    }
 
     priv->value_less = priv->value_greater = NULL;
     priv->deviceid = deviceid;
 
     idle_time_counter->pSysCounterInfo->private = priv;
-    }
-
     return idle_time_counter;
 }
 

Xext/vidmode.c

@@ -739,7 +739,7 @@ ProcVidModeModModeLine(ClientPtr client)
     xXF86VidModeModModeLineReq newstuff;
     ScreenPtr pScreen;
     VidModePtr pVidMode;
-    DisplayModePtr mode, modetmp;
+    DisplayModePtr mode;
     int len, dotClock;
     int ver;
 
@@ -805,7 +805,10 @@ ProcVidModeModModeLine(ClientPtr client)
     if (!pVidMode->GetCurrentModeline(pScreen, &mode, &dotClock))
         return BadValue;
 
-    modetmp = VidModeCreateMode();
+    DisplayModePtr modetmp = VidModeCreateMode();
+    if (!modetmp)
+        return BadAlloc;
+
     VidModeCopyMode(mode, modetmp);
 
     VidModeSetModeValue(modetmp, VIDMODE_H_DISPLAY, stuff->hdisplay);
@@ -949,6 +952,9 @@ ProcVidModeValidateModeLine(ClientPtr client)
         return BadValue;
 
     modetmp = VidModeCreateMode();
+    if (!modetmp)
+        return BadAlloc;
+
     VidModeCopyMode(mode, modetmp);
 
     VidModeSetModeValue(modetmp, VIDMODE_H_DISPLAY, stuff->hdisplay);
@@ -1370,7 +1376,7 @@ ProcVidModeGetDotClocks(ClientPtr client)
         swapl(&rep.flags);
     }
     WriteToClient(client, sizeof(xXF86VidModeGetDotClocksReply), &rep);
-    if (!ClockProg) {
+    if (!ClockProg && Clocks) {
         for (n = 0; n < numClocks; n++) {
             dotclock = Clocks[n];
             if (client->swapped) {

Xext/xres.c

@@ -136,11 +136,13 @@ static void
 DestroyFragments(struct xorg_list *frags)
 {
     FragmentList *it, *tmp;
+    if (!xorg_list_is_empty(frags)) {
         xorg_list_for_each_entry_safe(it, tmp, frags, l) {
             xorg_list_del(&it->l);
             free(it);
         }
     }
+}
 
 /** @brief Constructs a context record for ConstructClientId* functions
            to use */

Xext/xselinux_ext.c

@@ -313,6 +313,8 @@ SELinuxPopulateItem(SELinuxListItemRec * i, PrivateRec ** privPtr, CARD32 id,
     SELinuxObjectRec *obj = dixLookupPrivate(privPtr, objectKey);
     SELinuxObjectRec *data = dixLookupPrivate(privPtr, dataKey);
 
+    if (!i)
+        return BadValue;
     if (avc_sid_to_context_raw(obj->sid, &i->octx) < 0)
         return BadValue;
     if (avc_sid_to_context_raw(data->sid, &i->dctx) < 0)
@@ -331,6 +333,9 @@ SELinuxFreeItems(SELinuxListItemRec * items, int count)
 {
     int k;
 
+    if (!items)
+        return;
+
     for (k = 0; k < count; k++) {
         freecon(items[k].octx);
         freecon(items[k].dctx);
@@ -348,6 +353,9 @@ SELinuxSendItemsToClient(ClientPtr client, SELinuxListItemRec * items,
         goto out;
     }
 
+    if (!buf) // silence analyzer warning
+        goto sendreply;
+
     /* Fill in the buffer */
     for (k = 0; k < count; k++) {
         buf[pos] = items[k].id;
@@ -371,6 +379,7 @@ SELinuxSendItemsToClient(ClientPtr client, SELinuxListItemRec * items,
         pos += items[k].dctx_len;
     }
 
+sendreply: ;
     /* Send reply to client */
     SELinuxListItemsReply rep = {
         .type = X_Reply,

Xext/xtest.c

@@ -385,7 +385,7 @@ ProcXTestFakeInput(ClientPtr client)
     switch (type) {
     case KeyPress:
     case KeyRelease:
-        if (!dev->key)
+        if ((!dev) || (!dev->key))
             return BadDevice;
 
         if (ev->u.u.detail < dev->key->xkbInfo->desc->min_key_code ||
@@ -397,7 +397,7 @@ ProcXTestFakeInput(ClientPtr client)
         need_ptr_update = 0;
         break;
     case MotionNotify:
-        if (!dev->valuator)
+        if (!dev || !dev->valuator)
             return BadDevice;
 
         if (!(extension || ev->u.keyButtonPointer.root == None)) {
@@ -428,7 +428,7 @@ ProcXTestFakeInput(ClientPtr client)
         break;
     case ButtonPress:
     case ButtonRelease:
-        if (!dev->button)
+        if (!dev || !dev->button)
             return BadDevice;
 
         if (!ev->u.u.detail || ev->u.u.detail > dev->button->numButtons) {
@@ -442,7 +442,7 @@ ProcXTestFakeInput(ClientPtr client)
 
     valuator_mask_set_range(&mask, firstValuator, numValuators, valuators);
 
-    if (dev->sendEventsProc)
+    if (dev && dev->sendEventsProc)
         (*dev->sendEventsProc) (dev, type, ev->u.u.detail, flags, &mask);
 
     if (need_ptr_update)