xfree86: parser: fix possible use-after-free xf86freeOutputClassList()

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>

hw/xfree86/common/xf86Configure.c

@@ -181,7 +181,9 @@ configureInputSection(void)
         }
     }
 
-    mouse = calloc(1, sizeof(XF86ConfInputRec));
+    if (!(mouse = calloc(1, sizeof(XF86ConfInputRec))))
+        return NULL;
+
     mouse->inp_identifier = XNFstrdup("Mouse0");
     mouse->inp_driver = XNFstrdup("mouse");
     mouse->inp_option_lst =
@@ -213,9 +215,9 @@ configureScreenSection(int screennum)
     ptr->scrn_device_str = tmp;
 
     for (i = 0; i < ARRAY_SIZE(depths); i++) {
-        XF86ConfDisplayPtr conf_display;
+        XF86ConfDisplayPtr conf_display = calloc(1, sizeof(XF86ConfDisplayRec));
-
+        if (!conf_display)
-        conf_display = calloc(1, sizeof(XF86ConfDisplayRec));
+            continue;
         conf_display->disp_depth = depths[i];
         conf_display->disp_black.red = conf_display->disp_white.red = -1;
         conf_display->disp_black.green = conf_display->disp_white.green = -1;
@@ -339,9 +341,8 @@ configureLayoutSection(void)
     ptr->lay_identifier = "X.org Configured";
 
     {
-        XF86ConfInputrefPtr iptr;
+        XF86ConfInputrefPtr iptr = calloc(1, sizeof(XF86ConfInputrefRec));
-
+        assert(iptr);
-        iptr = malloc(sizeof(XF86ConfInputrefRec));
         iptr->list.next = NULL;
         iptr->iref_option_lst = NULL;
         iptr->iref_inputdev_str = XNFstrdup("Mouse0");
@@ -353,9 +354,8 @@ configureLayoutSection(void)
     }
 
     {
-        XF86ConfInputrefPtr iptr;
+        XF86ConfInputrefPtr iptr = calloc(1, sizeof(XF86ConfInputrefRec));
-
+        assert(iptr);
-        iptr = malloc(sizeof(XF86ConfInputrefRec));
         iptr->list.next = NULL;
         iptr->iref_option_lst = NULL;
         iptr->iref_inputdev_str = XNFstrdup("Keyboard0");
@@ -367,10 +367,10 @@ configureLayoutSection(void)
     }
 
     for (scrnum = 0; scrnum < nDevToConfig; scrnum++) {
-        XF86ConfAdjacencyPtr aptr;
         char *tmp;
 
-        aptr = malloc(sizeof(XF86ConfAdjacencyRec));
+        XF86ConfAdjacencyPtr aptr = calloc(1, sizeof(XF86ConfAdjacencyRec));
+        assert(aptr);
         aptr->list.next = NULL;
         aptr->adj_x = 0;
         aptr->adj_y = 0;
@@ -412,9 +412,9 @@ configureModuleSection(void)
     elist = LoaderListDir("extensions", NULL);
     if (elist) {
         for (el = elist; *el; el++) {
-            XF86LoadPtr module;
+            XF86LoadPtr module = calloc(1, sizeof(XF86LoadRec));
-
+            if (!module)
-            module = calloc(1, sizeof(XF86LoadRec));
+                return ptr;
             module->load_name = *el;
             ptr->mod_load_lst = (XF86LoadPtr) xf86addListItem((glp) ptr->
                                                               mod_load_lst,
@@ -464,6 +464,7 @@ handle_detailed_input(struct detailed_monitor_section *det_mon, void *data)
         ptr->mon_modelname = realloc(ptr->mon_modelname,
                                      strlen((char *) (det_mon->section.name)) +
                                      1);
+        assert(ptr->mon_modelname);
         strcpy(ptr->mon_modelname, (char *) (det_mon->section.name));
         break;
     case DS_RANGES:
@@ -653,6 +654,7 @@ DoConfigure(void)
         XF86ConfMonitorPtr monitor_ptr;
         XF86ConfScreenPtr screen_ptr;
 
+        assert(xf86config);
         device_ptr = configureDeviceSection(screennum);
         xf86config->conf_device_lst = (XF86ConfDevicePtr) xf86addListItem((glp)
                                                                           xf86config->

hw/xfree86/common/xf86Events.c

@@ -615,7 +615,7 @@ removeInputHandler(IHPtr ih)
         p = InputHandlers;
         while (p && p->next != ih)
             p = p->next;
-        if (ih)
+        if (ih && p)
             p->next = ih->next;
     }
     free(ih);

hw/xfree86/common/xf86Option.c

@@ -898,13 +898,15 @@ xf86NameCmp(const char *s1, const char *s2)
 char *
 xf86NormalizeName(const char *s)
 {
-    char *ret, *q;
+    char *q;
     const char *p;
 
     if (s == NULL)
         return NULL;
 
-    ret = malloc(strlen(s) + 1);
+    char *ret = calloc(1, strlen(s) + 1);
+    if (!ret)
+        return NULL;
     for (p = s, q = ret; *p != 0; p++) {
         switch (*p) {
         case '_':

hw/xfree86/common/xf86platformBus.c

@@ -684,7 +684,7 @@ xf86platformAddDevice(const char *driver_name, int index)
         }
     }
 
-    if (i == xf86NumDrivers) {
+    if (!drvp) {
         ErrorF("can't find driver %s for hotplugged device\n", driver_name);
         return -1;
     }

hw/xfree86/ddc/ddc.c

@@ -45,6 +45,9 @@ find_start(unsigned int *ptr)
     unsigned int comp[9], test[9];
     int i, j;
 
+    if (!ptr)
+        return -1;
+
     for (i = 0; i < 9; i++) {
         comp[i] = *(ptr++);
         test[i] = 1;

hw/xfree86/dri/dri.c

@@ -105,6 +105,15 @@ drmServerInfo DRIDRMServerInfo;
  */
 #define DRI_MSG_VERBOSITY 1
 
+static inline DRIScreenPrivPtr DRI_SCREEN_PRIV(ScreenPtr pScreen) {
+    if (!dixPrivateKeyRegistered(&DRIScreenPrivKeyRec))
+        return NULL;
+    if (!pScreen)
+        return NULL;
+
+    return dixLookupPrivate(&(pScreen)->devPrivates, DRIScreenPrivKey);
+}
+
 static void
 DRIDrvMsg(int scrnIndex, MessageType type, const char *format, ...)
     _X_ATTRIBUTE_PRINTF(3,4);
@@ -286,6 +295,7 @@ static void
 dri_crtc_notify(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    assert(pDRIPriv);
 
     DRIClipNotifyAllDrawables(pScreen);
     xf86_unwrap_crtc_notify(pScreen, pDRIPriv->xf86_crtc_notify);
@@ -640,6 +650,8 @@ Bool
 DRIFinishScreenInit(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
     DRIInfoPtr pDRIInfo = pDRIPriv->pDriverInfo;
 
     /* Wrap DRI support */
@@ -865,6 +877,8 @@ Bool
 DRIOpenConnection(ScreenPtr pScreen, drm_handle_t * hSAREA, char **busIdString)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
 
     *hSAREA = pDRIPriv->hSAREA;
     *busIdString = pDRIPriv->pDriverInfo->busIdString;
@@ -876,6 +890,8 @@ Bool
 DRIAuthConnection(ScreenPtr pScreen, drm_magic_t magic)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
 
     if (drmAuthMagic(pDRIPriv->drmFD, magic))
         return FALSE;
@@ -895,6 +911,8 @@ DRIGetClientDriverName(ScreenPtr pScreen,
                        int *ddxDriverPatchVersion, char **clientDriverName)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
 
     *ddxDriverMajorVersion = pDRIPriv->pDriverInfo->ddxDriverMajorVersion;
     *ddxDriverMinorVersion = pDRIPriv->pDriverInfo->ddxDriverMinorVersion;
@@ -921,6 +939,8 @@ DRICreateContextPriv(ScreenPtr pScreen,
                      drm_context_t * pHWContext, DRIContextFlags flags)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return NULL;
 
     if (drmCreateContext(pDRIPriv->drmFD, pHWContext)) {
         return NULL;
@@ -933,10 +953,15 @@ DRIContextPrivPtr
 DRICreateContextPrivFromHandle(ScreenPtr pScreen,
                                drm_context_t hHWContext, DRIContextFlags flags)
 {
+    assert(pScreen);
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return NULL;
     DRIContextPrivPtr pDRIContextPriv;
     int contextPrivSize;
 
+    assert(pDRIPriv);
+
     contextPrivSize = sizeof(DRIContextPrivRec) +
         pDRIPriv->pDriverInfo->contextSize;
     if (!(pDRIContextPriv = calloc(1, contextPrivSize))) {
@@ -974,12 +999,12 @@ DRICreateContextPrivFromHandle(ScreenPtr pScreen,
 Bool
 DRIDestroyContextPriv(DRIContextPrivPtr pDRIContextPriv)
 {
-    DRIScreenPrivPtr pDRIPriv;
-
     if (!pDRIContextPriv)
         return TRUE;
 
-    pDRIPriv = DRI_SCREEN_PRIV(pDRIContextPriv->pScreen);
+    DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pDRIContextPriv->pScreen);
+    if (!pDRIPriv)
+        return FALSE;
 
     if (!(pDRIContextPriv->flags & DRI_CONTEXT_RESERVED)) {
         /* Don't delete reserved contexts from
@@ -1003,9 +1028,14 @@ static Bool
 DRICreateDummyContext(ScreenPtr pScreen, Bool needCtxPriv)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (pDRIPriv)
+        return FALSE;
+
     DRIContextPrivPtr pDRIContextPriv;
     void *contextStore;
 
+    assert(pDRIPriv);
+    assert(pDRIPriv->pSAREA);
     if (!(pDRIContextPriv =
           DRICreateContextPriv(pScreen, &pDRIPriv->pSAREA->dummy_context, 0))) {
         return FALSE;
@@ -1031,6 +1061,8 @@ static void
 DRIDestroyDummyContext(ScreenPtr pScreen, Bool hasCtxPriv)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
     DRIContextPrivPtr pDRIContextPriv = pDRIPriv->dummyCtxPriv;
     void *contextStore;
 
@@ -1053,6 +1085,8 @@ DRICreateContext(ScreenPtr pScreen, VisualPtr visual,
                  XID context, drm_context_t * pHWContext)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
     DRIContextPrivPtr pDRIContextPriv;
     void *contextStore;
 
@@ -1099,12 +1133,12 @@ Bool
 DRIContextPrivDelete(void *pResource, XID id)
 {
     DRIContextPrivPtr pDRIContextPriv = (DRIContextPrivPtr) pResource;
-    DRIScreenPrivPtr pDRIPriv;
+    DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pDRIContextPriv->pScreen);
-    void *contextStore;
+    if ((!pDRIPriv) || (!pDRIPriv->pDriverInfo))
+        return FALSE;
 
-    pDRIPriv = DRI_SCREEN_PRIV(pDRIContextPriv->pScreen);
     if (pDRIPriv->pDriverInfo->DestroyContext) {
-        contextStore = DRIGetContextStore(pDRIContextPriv);
+        void *contextStore = DRIGetContextStore(pDRIContextPriv);
         pDRIPriv->pDriverInfo->DestroyContext(pDRIContextPriv->pScreen,
                                               pDRIContextPriv->hwContext,
                                               (DRIContextType) (long)
@@ -1124,7 +1158,8 @@ DRIClipNotifyAllDrawables(ScreenPtr pScreen)
 {
     int i;
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
-
+    if (!pDRIPriv)
+        return;
     for (i = 0; i < pDRIPriv->pDriverInfo->maxDrawableTableEntry; i++) {
         pDRIPriv->pSAREA->drawableTable[i].stamp = DRIDrawableValidationStamp++;
     }
@@ -1134,6 +1169,8 @@ static void
 DRITransitionToSharedBuffers(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
     DRIInfoPtr pDRIInfo = pDRIPriv->pDriverInfo;
 
     DRIClipNotifyAllDrawables(pScreen);
@@ -1146,6 +1183,8 @@ static void
 DRITransitionToPrivateBuffers(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
     DRIInfoPtr pDRIInfo = pDRIPriv->pDriverInfo;
 
     DRIClipNotifyAllDrawables(pScreen);
@@ -1158,6 +1197,8 @@ static void
 DRITransitionTo3d(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
     DRIInfoPtr pDRIInfo = pDRIPriv->pDriverInfo;
 
     DRIClipNotifyAllDrawables(pScreen);
@@ -1170,6 +1211,8 @@ static void
 DRITransitionTo2d(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
     DRIInfoPtr pDRIInfo = pDRIPriv->pDriverInfo;
 
     DRIClipNotifyAllDrawables(pScreen);
@@ -1186,6 +1229,8 @@ DRIDCNTreeTraversal(WindowPtr pWin, void *data)
     if (pDRIDrawablePriv) {
         ScreenPtr pScreen = pWin->drawable.pScreen;
         DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+        if (!pDRIPriv)
+            return WT_WALKCHILDREN;
 
         if (RegionNumRects(&pWin->clipList) > 0) {
             WindowPtr *pDRIWindows = (WindowPtr *) data;
@@ -1211,7 +1256,7 @@ DRIDriverClipNotify(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
 
-    if (pDRIPriv->pDriverInfo->ClipNotify) {
+    if (pDRIPriv && pDRIPriv->pDriverInfo && pDRIPriv->pDriverInfo->ClipNotify) {
         WindowPtr *pDRIWindows = calloc(pDRIPriv->nrWindows, sizeof(WindowPtr));
         DRIInfoPtr pDRIInfo = pDRIPriv->pDriverInfo;
 
@@ -1231,6 +1276,8 @@ static void
 DRIIncreaseNumberVisible(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
 
     switch (++pDRIPriv->nrWindowsVisible) {
     case 1:
@@ -1250,6 +1297,8 @@ static void
 DRIDecreaseNumberVisible(ScreenPtr pScreen)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
 
     switch (--pDRIPriv->nrWindowsVisible) {
     case 0:
@@ -1270,6 +1319,9 @@ DRICreateDrawable(ScreenPtr pScreen, ClientPtr client, DrawablePtr pDrawable,
                   drm_drawable_t * hHWDrawable)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
+
     DRIDrawablePrivPtr pDRIDrawablePriv;
     WindowPtr pWin;
 
@@ -1338,13 +1390,15 @@ DRIDrawablePrivDestroy(WindowPtr pWin)
 {
     DRIDrawablePrivPtr pDRIDrawablePriv = DRI_DRAWABLE_PRIV_FROM_WINDOW(pWin);
     ScreenPtr pScreen;
-    DRIScreenPrivPtr pDRIPriv;
 
     if (!pDRIDrawablePriv)
         return;
 
     pScreen = pWin->drawable.pScreen;
-    pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+
+    DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
 
     if (pDRIDrawablePriv->drawableIndex != -1) {
         /* bump stamp to force outstanding 3D requests to resync */
@@ -1439,6 +1493,9 @@ DRIGetDrawableInfo(ScreenPtr pScreen,
                    int *numBackClipRects, drm_clip_rect_t ** pBackClipRects)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
+
     DRIDrawablePrivPtr pDRIDrawablePriv, pOldDrawPriv;
     WindowPtr pWin, pOldWin;
     int i;
@@ -1608,6 +1665,8 @@ DRIGetDeviceInfo(ScreenPtr pScreen,
                  int *fbStride, int *devPrivateSize, void **pDevPrivate)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return FALSE;
 
     *hFrameBuffer = pDRIPriv->pDriverInfo->hFrameBuffer;
     *fbOrigin = 0;
@@ -1684,6 +1743,8 @@ void
 DRIDoWakeupHandler(ScreenPtr pScreen, int result)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
 
     DRILock(pScreen, 0);
     if (pDRIPriv->pDriverInfo->driverSwapMethod == DRI_HIDE_X_CONTEXT) {
@@ -1701,6 +1762,8 @@ void
 DRIDoBlockHandler(ScreenPtr pScreen, void *timeout)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
 
     if (pDRIPriv->pDriverInfo->driverSwapMethod == DRI_HIDE_X_CONTEXT) {
         /* hide X context by swapping 2D component here */
@@ -1726,6 +1789,9 @@ DRISwapContext(int drmFD, void *oldctx, void *newctx)
     DRIContextPrivPtr newContext = (DRIContextPrivPtr) newctx;
     ScreenPtr pScreen = newContext->pScreen;
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
+
     void *oldContextStore = NULL;
     DRIContextType oldContextType;
     void *newContextStore = NULL;
@@ -1880,7 +1946,7 @@ DRIWindowExposures(WindowPtr pWin, RegionPtr prgn)
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
     DRIDrawablePrivPtr pDRIDrawablePriv = DRI_DRAWABLE_PRIV_FROM_WINDOW(pWin);
 
-    if (pDRIDrawablePriv) {
+    if (pDRIPriv && pDRIDrawablePriv) {
         (*pDRIPriv->pDriverInfo->InitBuffers) (pWin, prgn,
                                                pDRIDrawablePriv->drawableIndex);
     }
@@ -1908,6 +1974,8 @@ DRITreeTraversal(WindowPtr pWin, void *data)
     if (pDRIDrawablePriv) {
         ScreenPtr pScreen = pWin->drawable.pScreen;
         DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+        if (!pDRIPriv)
+            return WT_WALKCHILDREN;
 
         if (RegionNumRects(&(pWin->clipList)) > 0) {
             RegionPtr reg = (RegionPtr) data;
@@ -2146,24 +2214,24 @@ CARD32
 DRIGetDrawableIndex(WindowPtr pWin)
 {
     ScreenPtr pScreen = pWin->drawable.pScreen;
-    DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+
     DRIDrawablePrivPtr pDRIDrawablePriv = DRI_DRAWABLE_PRIV_FROM_WINDOW(pWin);
-    CARD32 index;
+    if (pDRIDrawablePriv)
+        return pDRIDrawablePriv->drawableIndex;
 
-    if (pDRIDrawablePriv) {
+    DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
-        index = pDRIDrawablePriv->drawableIndex;
+    if (pDRIPriv)
-    }
+        return pDRIPriv->pDriverInfo->ddxDrawableTableEntry;
-    else {
-        index = pDRIPriv->pDriverInfo->ddxDrawableTableEntry;
-    }
 
-    return index;
+    return 0;
 }
 
 unsigned int
 DRIGetDrawableStamp(ScreenPtr pScreen, CARD32 drawable_index)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return 0;
 
     return pDRIPriv->pSAREA->drawableTable[drawable_index].stamp;
 }
@@ -2172,6 +2240,8 @@ void
 DRIPrintDrawableLock(ScreenPtr pScreen, char *msg)
 {
     DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return;
 
     ErrorF("%s: %d\n", msg, pDRIPriv->pSAREA->drawable_lock.lock);
 }
@@ -2268,6 +2338,9 @@ DRIGetTexOffsetFuncs(ScreenPtr pScreen,
 DRIWrappedFuncsRec *
 DRIGetWrappedFuncs(ScreenPtr pScreen)
 {
+    DRIScreenPrivPtr pDRIPriv = DRI_SCREEN_PRIV(pScreen);
+    if (!pDRIPriv)
+        return NULL;
     return &(DRI_SCREEN_PRIV(pScreen)->wrap);
 }
 

hw/xfree86/dri/dristruct.h

@@ -58,10 +58,6 @@ struct _DRIContextPrivRec {
     void **pContextStore;
 };
 
-#define DRI_SCREEN_PRIV(pScreen) ((DRIScreenPrivPtr) \
-    (dixPrivateKeyRegistered(DRIScreenPrivKey) ?			\
-     dixLookupPrivate(&(pScreen)->devPrivates, DRIScreenPrivKey) : NULL))
-
 #define DRI_SCREEN_PRIV_FROM_INDEX(screenIndex) ((DRIScreenPrivPtr) \
     dixLookupPrivate(&screenInfo.screens[screenIndex]->devPrivates, \
 		     DRIScreenPrivKey))

hw/xfree86/int10/vbe.c

@@ -834,8 +834,6 @@ VBESetGetPaletteData(vbeInfoPtr pVbe, Bool set, int first, int num,
 VBEpmi *
 VBEGetVBEpmi(vbeInfoPtr pVbe)
 {
-    VBEpmi *pmi;
-
     /*
        Input:
        AH    := 4Fh     Super VGA support
@@ -859,7 +857,10 @@ VBEGetVBEpmi(vbeInfoPtr pVbe)
     if (R16(pVbe->pInt10->ax) != 0x4f)
         return NULL;
 
-    pmi = malloc(sizeof(VBEpmi));
+    VBEpmi *pmi = calloc(1, sizeof(VBEpmi));
+    if (!pmi)
+        return NULL;
+
     pmi->seg_tbl = R16(pVbe->pInt10->es);
     pmi->tbl_off = R16(pVbe->pInt10->di);
     pmi->tbl_len = R16(pVbe->pInt10->cx);
@@ -936,7 +937,8 @@ VBEVesaSaveRestore(vbeInfoPtr pVbe, vbeSaveRestorePtr vbe_sr,
                 vbe_sr->stateMode = -1; /* invalidate */
                 /* don't rely on the memory not being touched */
                 if (vbe_sr->pstate == NULL)
-                    vbe_sr->pstate = malloc(vbe_sr->stateSize);
+                    vbe_sr->pstate = calloc(1, vbe_sr->stateSize);
+                assert(vbe_sr->pstate);
                 memcpy(vbe_sr->pstate, vbe_sr->state, vbe_sr->stateSize);
             }
             ErrorF("VBESaveRestore done with success\n");

hw/xfree86/int10/vbeModes.c

@@ -405,6 +405,8 @@ VBESetModeParameters(ScrnInfoPtr pScrn, vbeInfoPtr pVbe)
                        "Attempting to use %dHz refresh for mode \"%s\" (%x)\n",
                        (int) pMode->VRefresh, pMode->name, data->mode);
             data->block = calloc(1, sizeof(VbeCRTCInfoBlock));
+            if (!data->block)
+                continue;
             data->block->HorizontalTotal = best->HTotal;
             data->block->HorizontalSyncStart = best->HSyncStart;
             data->block->HorizontalSyncEnd = best->HSyncEnd;

hw/xfree86/loader/loadmod.c

@@ -702,6 +702,8 @@ LoadModule(const char *module, void *options, const XF86ModReqInfo *modreq,
     if (!strcmp(m, "vbe"))
         m = name = strdup("int10");
 
+    assert(m);
+
     for (cim = compiled_in_modules; *cim; cim++)
         if (!strcmp(m, *cim)) {
             LogMessageVerb(X_INFO, 3, "Module \"%s\" already built-in\n", m);

hw/xfree86/modes/xf86RandR12.c

@@ -295,10 +295,10 @@ xf86ComputeCrtcPan(Bool transform_in_use,
          * dy = (F T0 - Q0) / U0
          * dy = (F P0 - V0) / W0
          */
-        double r[3];
+        double r[3] = { 0 };
-        double q[2], u[2], t[2], v[2], w[2], p[2];
+        double q[2], u[2], t[2], v[2], w[2] = { 0 }, p[2];
         double f;
-        struct pixman_f_vector d;
+        struct pixman_f_vector d = { 0 };
         int i;
 
         /* Get the un-normalized crtc coordinates again */

hw/xfree86/parser/Files.c

@@ -55,6 +55,8 @@
 #include <xorg-config.h>
 #endif
 
+#include <assert.h>
+
 #include <X11/Xos.h>
 #include "xf86Parser.h"
 #include "xf86tokens.h"
@@ -109,9 +111,9 @@ xf86parseFilesSection(void)
                 }
             }
             ptr->file_fontpath = realloc(ptr->file_fontpath, i);
+            assert(ptr->file_fontpath);
             if (j)
                 strcat(ptr->file_fontpath, ",");
-
             strcat(ptr->file_fontpath, str);
             free(xf86_lex_val.str);
             break;
@@ -121,7 +123,8 @@ xf86parseFilesSection(void)
             l = FALSE;
             str = xf86_lex_val.str;
             if (ptr->file_modulepath == NULL) {
-                ptr->file_modulepath = malloc(1);
+                ptr->file_modulepath = calloc(1, 1);
+                assert(ptr->file_modulepath);
                 ptr->file_modulepath[0] = '\0';
                 k = strlen(str) + 1;
             }
@@ -134,6 +137,7 @@ xf86parseFilesSection(void)
                 }
             }
             ptr->file_modulepath = realloc(ptr->file_modulepath, k);
+            assert(ptr->file_modulepath);
             if (l)
                 strcat(ptr->file_modulepath, ",");
 

hw/xfree86/parser/Flags.c

@@ -55,6 +55,8 @@
 #include <xorg-config.h>
 #endif
 
+#include <assert.h>
+
 #include "xf86Parser.h"
 #include "xf86tokens.h"
 #include "Configint.h"
@@ -200,6 +202,7 @@ addNewOption2(XF86OptionPtr head, char *name, char *_val, int used)
     }
     else
         new = calloc(1, sizeof(*new));
+    assert(new);
     new->opt_name = name;
     new->opt_val = _val;
     new->opt_used = used;
@@ -437,6 +440,7 @@ xf86parseOption(XF86OptionPtr head)
     name = xf86_lex_val.str;
     if ((token = xf86getSubToken(&comment)) == STRING) {
         option = xf86newOption(name, xf86_lex_val.str);
+        assert(option);
         option->opt_comment = comment;
         if ((token = xf86getToken(NULL)) == COMMENT) {
             option->opt_comment = xf86addComment(option->opt_comment, xf86_lex_val.str);
@@ -448,6 +452,7 @@ xf86parseOption(XF86OptionPtr head)
     }
     else {
         option = xf86newOption(name, NULL);
+        assert(option);
         option->opt_comment = comment;
         if (token == COMMENT) {
             option->opt_comment = xf86addComment(option->opt_comment, xf86_lex_val.str);

hw/xfree86/parser/Layout.c

@@ -450,9 +450,9 @@ xf86layoutAddInputDevices(XF86ConfigPtr config, XF86ConfLayoutPtr layout)
             }
 
             if (!iref) {
-                XF86ConfInputrefPtr iptr;
+                XF86ConfInputrefPtr iptr = calloc(1, sizeof(XF86ConfInputrefRec));
-
+                if (!iptr)
-                iptr = calloc(1, sizeof(XF86ConfInputrefRec));
+                    return -1;
                 iptr->iref_inputdev_str = input->inp_identifier;
                 layout->lay_input_lst = (XF86ConfInputrefPtr)
                     xf86addListItem((glp) layout->lay_input_lst, (glp) iptr);

hw/xfree86/parser/Module.c

@@ -56,6 +56,8 @@
 #include <xorg-config.h>
 #endif
 
+#include <assert.h>
+
 #include "xf86Parser.h"
 #include "xf86tokens.h"
 #include "Configint.h"
@@ -228,6 +230,7 @@ xf86addNewLoadDirective(XF86LoadPtr head, const char *name, int type,
     int token;
 
     new = calloc(1, sizeof(XF86LoadRec));
+    assert(new);
     new->load_name = name;
     new->load_type = type;
     new->load_opt = opts;

hw/xfree86/parser/OutputClass.c

@@ -57,10 +57,13 @@ xf86freeOutputClassList(XF86ConfOutputClassPtr ptr)
         TestFree(ptr->modulepath);
 
         xorg_list_for_each_entry_safe(group, next, &ptr->match_driver, entry) {
-            xorg_list_del(&group->entry);
+            for (list = group->values; *list; list++) {
-            for (list = group->values; *list; list++)
                 free(*list);
+                *list = NULL;
+            }
+            xorg_list_del(&group->entry);
             free(group);
+            group = NULL;
         }
 
         xf86optionListFree(ptr->option_lst);

hw/xfree86/parser/scan.c

@@ -569,7 +569,6 @@ static char *
 DoSubstitution(const char *template, const char *cmdline, const char *projroot,
                int *cmdlineUsed, int *envUsed, const char *XConfigFile)
 {
-    char *result;
     int i, l;
     static const char *env = NULL;
     static char *hostname = NULL;
@@ -582,7 +581,10 @@ DoSubstitution(const char *template, const char *cmdline, const char *projroot,
     if (envUsed)
         *envUsed = 0;
 
-    result = malloc(PATH_MAX + 1);
+    char *result = calloc(1, PATH_MAX + 1);
+    if (!result)
+        return NULL;
+
     l = 0;
     for (i = 0; template[i]; i++) {
         if (template[i] != '%') {

hw/xfree86/utils/gtf/gtf.c

@@ -294,7 +294,9 @@ vert_refresh(int h_pixels, int v_lines, float freq, int interlaced, int margins)
     float h_front_porch;
     float v_odd_front_porch_lines;
 
-    mode *m = (mode *) malloc(sizeof(mode));
+    mode *m = (mode *) calloc(1, sizeof(mode));
+    if (!m)
+        return NULL;
 
     /*  1. In order to give correct results, the number of horizontal
      *  pixels requested is first processed to ensure that it is divisible
@@ -604,6 +606,8 @@ parse_command_line(int argc, char *argv[])
     int n;
 
     options *o = (options *) calloc(1, sizeof(options));
+    if (!o)
+        goto bad_option;
 
     if (argc < 4)
         goto bad_option;

hw/xfree86/x86emu/ops2.c

@@ -38,6 +38,8 @@
 *
 ****************************************************************************/
 
+#include <assert.h>
+
 #include "x86emu/x86emui.h"
 
 #undef bswap_32
@@ -377,6 +379,7 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -390,6 +393,7 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -405,6 +409,7 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -418,6 +423,7 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -433,6 +439,7 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -446,6 +453,7 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -460,7 +468,10 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
+            assert(shiftreg);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & (0x1 << bit), F_CF);
         }
         else {
@@ -470,7 +481,9 @@ x86emuOp2_bt_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & (0x1 << bit), F_CF);
         }
         break;
@@ -507,6 +520,7 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shld_long(destval, *shiftreg, shift);
             store_data_long(destoffset, destval);
         }
@@ -522,6 +536,7 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shld_word(destval, *shiftreg, shift);
             store_data_word(destoffset, destval);
         }
@@ -539,6 +554,7 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shld_long(destval, *shiftreg, shift);
             store_data_long(destoffset, destval);
         }
@@ -554,6 +570,7 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shld_word(destval, *shiftreg, shift);
             store_data_word(destoffset, destval);
         }
@@ -571,6 +588,7 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shld_long(destval, *shiftreg, shift);
             store_data_long(destoffset, destval);
         }
@@ -586,6 +604,7 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shld_word(destval, *shiftreg, shift);
             store_data_word(destoffset, destval);
         }
@@ -601,6 +620,8 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             shift = fetch_byte_imm();
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shld_long(*destreg, *shiftreg, shift);
         }
         else {
@@ -613,6 +634,8 @@ x86emuOp2_shld_IMM(u8 X86EMU_UNUSED(op2))
             shift = fetch_byte_imm();
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shld_word(*destreg, *shiftreg, shift);
         }
         break;
@@ -646,6 +669,7 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shld_long(destval, *shiftreg, M.x86.R_CL);
             store_data_long(destoffset, destval);
         }
@@ -659,6 +683,7 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shld_word(destval, *shiftreg, M.x86.R_CL);
             store_data_word(destoffset, destval);
         }
@@ -674,6 +699,7 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shld_long(destval, *shiftreg, M.x86.R_CL);
             store_data_long(destoffset, destval);
         }
@@ -687,6 +713,7 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shld_word(destval, *shiftreg, M.x86.R_CL);
             store_data_word(destoffset, destval);
         }
@@ -702,6 +729,7 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shld_long(destval, *shiftreg, M.x86.R_CL);
             store_data_long(destoffset, destval);
         }
@@ -715,6 +743,7 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shld_word(destval, *shiftreg, M.x86.R_CL);
             store_data_word(destoffset, destval);
         }
@@ -728,6 +757,8 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shld_long(*destreg, *shiftreg, M.x86.R_CL);
         }
         else {
@@ -738,6 +769,8 @@ x86emuOp2_shld_CL(u8 X86EMU_UNUSED(op2))
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shld_word(*destreg, *shiftreg, M.x86.R_CL);
         }
         break;
@@ -800,6 +833,7 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -815,6 +849,7 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -832,6 +867,7 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -847,6 +883,7 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -864,7 +901,9 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
+            assert(shiftreg);
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
             mask = (0x1 << bit);
@@ -879,6 +918,7 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -893,8 +933,10 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             u32 mask;
 
             srcreg = DECODE_RM_LONG_REGISTER(rl);
+            assert(srcreg);
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
+            assert(shiftreg);
             TRACE_AND_STEP();
             bit = *shiftreg & 0x1F;
             mask = (0x1 << bit);
@@ -909,8 +951,10 @@ x86emuOp2_bts_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             mask = (u16) (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             *srcreg |= mask;
         }
@@ -948,6 +992,7 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shrd_long(destval, *shiftreg, shift);
             store_data_long(destoffset, destval);
         }
@@ -963,6 +1008,7 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shrd_word(destval, *shiftreg, shift);
             store_data_word(destoffset, destval);
         }
@@ -980,6 +1026,7 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shrd_long(destval, *shiftreg, shift);
             store_data_long(destoffset, destval);
         }
@@ -995,6 +1042,7 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shrd_word(destval, *shiftreg, shift);
             store_data_word(destoffset, destval);
         }
@@ -1012,6 +1060,7 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shrd_long(destval, *shiftreg, shift);
             store_data_long(destoffset, destval);
         }
@@ -1027,6 +1076,7 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shrd_word(destval, *shiftreg, shift);
             store_data_word(destoffset, destval);
         }
@@ -1042,6 +1092,8 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             shift = fetch_byte_imm();
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shrd_long(*destreg, *shiftreg, shift);
         }
         else {
@@ -1054,6 +1106,8 @@ x86emuOp2_shrd_IMM(u8 X86EMU_UNUSED(op2))
             shift = fetch_byte_imm();
             DECODE_PRINTF2("%d\n", shift);
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shrd_word(*destreg, *shiftreg, shift);
         }
         break;
@@ -1087,6 +1141,7 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shrd_long(destval, *shiftreg, M.x86.R_CL);
             store_data_long(destoffset, destval);
         }
@@ -1100,6 +1155,7 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shrd_word(destval, *shiftreg, M.x86.R_CL);
             store_data_word(destoffset, destval);
         }
@@ -1115,6 +1171,7 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shrd_long(destval, *shiftreg, M.x86.R_CL);
             store_data_long(destoffset, destval);
         }
@@ -1128,6 +1185,7 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shrd_word(destval, *shiftreg, M.x86.R_CL);
             store_data_word(destoffset, destval);
         }
@@ -1143,6 +1201,7 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_long(destoffset);
+            assert(shiftreg);
             destval = shrd_long(destval, *shiftreg, M.x86.R_CL);
             store_data_long(destoffset, destval);
         }
@@ -1156,6 +1215,7 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
             destval = fetch_data_word(destoffset);
+            assert(shiftreg);
             destval = shrd_word(destval, *shiftreg, M.x86.R_CL);
             store_data_word(destoffset, destval);
         }
@@ -1169,6 +1229,8 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shrd_long(*destreg, *shiftreg, M.x86.R_CL);
         }
         else {
@@ -1179,6 +1241,8 @@ x86emuOp2_shrd_CL(u8 X86EMU_UNUSED(op2))
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             DECODE_PRINTF(",CL\n");
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(shiftreg);
             *destreg = shrd_word(*destreg, *shiftreg, M.x86.R_CL);
         }
         break;
@@ -1256,6 +1320,7 @@ x86emuOp2_imul_R_RM(u8 X86EMU_UNUSED(op2))
             srcoffset = decode_rm01_address(rl);
             srcval = fetch_data_long(srcoffset);
             TRACE_AND_STEP();
+            assert(destreg);
             imul_long_direct(&res_lo, &res_hi, (s32) * destreg, (s32) srcval);
             if (res_hi != 0) {
                 SET_FLAG(F_CF);
@@ -1277,6 +1342,7 @@ x86emuOp2_imul_R_RM(u8 X86EMU_UNUSED(op2))
             srcoffset = decode_rm01_address(rl);
             srcval = fetch_data_word(srcoffset);
             TRACE_AND_STEP();
+            assert(destreg);
             res = (s16) * destreg * (s16) srcval;
             if (res > 0xFFFF) {
                 SET_FLAG(F_CF);
@@ -1342,6 +1408,8 @@ x86emuOp2_imul_R_RM(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             srcreg = DECODE_RM_LONG_REGISTER(rl);
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(srcreg);
             imul_long_direct(&res_lo, &res_hi, (s32) * destreg, (s32) * srcreg);
             if (res_hi != 0) {
                 SET_FLAG(F_CF);
@@ -1360,6 +1428,8 @@ x86emuOp2_imul_R_RM(u8 X86EMU_UNUSED(op2))
             destreg = DECODE_RM_WORD_REGISTER(rh);
             DECODE_PRINTF(",");
             srcreg = DECODE_RM_WORD_REGISTER(rl);
+            assert(destreg);
+            assert(srcreg);
             res = (s16) * destreg * (s16) * srcreg;
             if (res > 0xFFFF) {
                 SET_FLAG(F_CF);
@@ -1398,6 +1468,7 @@ x86emuOp2_lss_R_IMM(u8 X86EMU_UNUSED(op2))
         srcoffset = decode_rm00_address(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(dstreg);
         *dstreg = fetch_data_word(srcoffset);
         M.x86.R_SS = fetch_data_word(srcoffset + 2);
         break;
@@ -1407,6 +1478,7 @@ x86emuOp2_lss_R_IMM(u8 X86EMU_UNUSED(op2))
         srcoffset = decode_rm01_address(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(dstreg);
         *dstreg = fetch_data_word(srcoffset);
         M.x86.R_SS = fetch_data_word(srcoffset + 2);
         break;
@@ -1451,6 +1523,7 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -1466,6 +1539,7 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -1483,6 +1557,7 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -1498,6 +1573,7 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -1515,6 +1591,7 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -1530,6 +1607,7 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -1547,8 +1625,10 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             mask = (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             *srcreg &= ~mask;
         }
@@ -1560,8 +1640,10 @@ x86emuOp2_btr_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             mask = (u16) (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             *srcreg &= ~mask;
         }
@@ -1592,6 +1674,7 @@ x86emuOp2_lfs_R_IMM(u8 X86EMU_UNUSED(op2))
         srcoffset = decode_rm00_address(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(dstreg);
         *dstreg = fetch_data_word(srcoffset);
         M.x86.R_FS = fetch_data_word(srcoffset + 2);
         break;
@@ -1601,6 +1684,7 @@ x86emuOp2_lfs_R_IMM(u8 X86EMU_UNUSED(op2))
         srcoffset = decode_rm01_address(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(dstreg);
         *dstreg = fetch_data_word(srcoffset);
         M.x86.R_FS = fetch_data_word(srcoffset + 2);
         break;
@@ -1610,6 +1694,7 @@ x86emuOp2_lfs_R_IMM(u8 X86EMU_UNUSED(op2))
         srcoffset = decode_rm10_address(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(dstreg);
         *dstreg = fetch_data_word(srcoffset);
         M.x86.R_FS = fetch_data_word(srcoffset + 2);
         break;
@@ -1651,6 +1736,7 @@ x86emuOp2_lgs_R_IMM(u8 X86EMU_UNUSED(op2))
         srcoffset = decode_rm01_address(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(dstreg);
         *dstreg = fetch_data_word(srcoffset);
         M.x86.R_GS = fetch_data_word(srcoffset + 2);
         break;
@@ -1722,6 +1808,7 @@ x86emuOp2_movzx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = fetch_data_byte(srcoffset);
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         else {
@@ -1734,6 +1821,7 @@ x86emuOp2_movzx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = fetch_data_byte(srcoffset);
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         break;
@@ -1773,6 +1861,8 @@ x86emuOp2_movzx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcreg = DECODE_RM_BYTE_REGISTER(rl);
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
+            assert(srcreg);
             *destreg = *srcreg;
         }
         else {
@@ -1784,6 +1874,8 @@ x86emuOp2_movzx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcreg = DECODE_RM_BYTE_REGISTER(rl);
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(srcreg);
+            assert(destreg);
             *destreg = *srcreg;
         }
         break;
@@ -1816,6 +1908,7 @@ x86emuOp2_movzx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcval = fetch_data_word(srcoffset);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
         *destreg = srcval;
         break;
     case 1:
@@ -1825,6 +1918,7 @@ x86emuOp2_movzx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcval = fetch_data_word(srcoffset);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
         *destreg = srcval;
         break;
     case 2:
@@ -1834,6 +1928,8 @@ x86emuOp2_movzx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcval = fetch_data_word(srcoffset);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
+        assert(srcreg);
         *destreg = srcval;
         break;
     case 3:                    /* register to register */
@@ -1842,6 +1938,8 @@ x86emuOp2_movzx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcreg = DECODE_RM_WORD_REGISTER(rl);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
+        assert(srcreg);
         *destreg = *srcreg;
         break;
     }
@@ -2057,6 +2155,7 @@ x86emuOp2_btX_I(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             bit = shift & 0x1F;
             mask = (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             switch (rh) {
             case 5:
@@ -2083,6 +2182,7 @@ x86emuOp2_btX_I(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             bit = shift & 0xF;
             mask = (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             switch (rh) {
             case 5:
@@ -2128,6 +2228,7 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -2143,6 +2244,7 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -2160,6 +2262,7 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -2175,6 +2278,7 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -2192,6 +2296,7 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             disp = (s16) * shiftreg >> 5;
             srcval = fetch_data_long(srcoffset + disp);
@@ -2207,6 +2312,7 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             disp = (s16) * shiftreg >> 4;
             srcval = fetch_data_word(srcoffset + disp);
@@ -2224,8 +2330,10 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0x1F;
             mask = (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             *srcreg ^= mask;
         }
@@ -2237,8 +2345,10 @@ x86emuOp2_btc_R(u8 X86EMU_UNUSED(op2))
             DECODE_PRINTF(",");
             shiftreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
+            assert(shiftreg);
             bit = *shiftreg & 0xF;
             mask = (u16) (0x1 << bit);
+            assert(srcreg);
             CONDITIONAL_SET_FLAG(*srcreg & mask, F_CF);
             *srcreg ^= mask;
         }
@@ -2272,6 +2382,7 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_long(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 32; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2285,6 +2396,7 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_word(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 16; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2300,6 +2412,7 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_long(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 32; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2313,6 +2426,7 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_word(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 16; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2328,6 +2442,7 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_long(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 32; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2341,6 +2456,7 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_word(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 16; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2348,25 +2464,27 @@ x86emuOp2_bsf(u8 X86EMU_UNUSED(op2))
         break;
     case 3:                    /* register to register */
         if (M.x86.mode & SYSMODE_PREFIX_DATA) {
-            u32 srcval, *dstreg;
+            u32* dec = DECODE_RM_LONG_REGISTER(rl);
-
+            assert(dec);
-            srcval = *DECODE_RM_LONG_REGISTER(rl);
+            u32 srcval = *dec;
             DECODE_PRINTF(",");
-            dstreg = DECODE_RM_LONG_REGISTER(rh);
+            u32 *dstreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 32; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
         }
         else {
-            u16 srcval, *dstreg;
+            u16 *dec = DECODE_RM_WORD_REGISTER(rl);
-
+            assert(dec);
-            srcval = *DECODE_RM_WORD_REGISTER(rl);
+            u16 srcval = *DECODE_RM_WORD_REGISTER(rl);
             DECODE_PRINTF(",");
-            dstreg = DECODE_RM_WORD_REGISTER(rh);
+            u16 *dstreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 0; *dstreg < 16; (*dstreg)++)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2401,6 +2519,7 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_long(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 31; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2414,6 +2533,7 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_word(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 15; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2429,6 +2549,7 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_long(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 31; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2442,6 +2563,7 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_word(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 15; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2457,6 +2579,7 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_long(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 31; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2470,6 +2593,7 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
             TRACE_AND_STEP();
             srcval = fetch_data_word(srcoffset);
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 15; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2477,25 +2601,27 @@ x86emuOp2_bsr(u8 X86EMU_UNUSED(op2))
         break;
     case 3:                    /* register to register */
         if (M.x86.mode & SYSMODE_PREFIX_DATA) {
-            u32 srcval, *dstreg;
+            u32 *dec = DECODE_RM_LONG_REGISTER(rl);
-
+            assert(dec);
-            srcval = *DECODE_RM_LONG_REGISTER(rl);
+            u32 srcval = *dec;
             DECODE_PRINTF(",");
-            dstreg = DECODE_RM_LONG_REGISTER(rh);
+            u32 *dstreg = DECODE_RM_LONG_REGISTER(rh);
             TRACE_AND_STEP();
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 31; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
         }
         else {
-            u16 srcval, *dstreg;
+            u16 *dec = DECODE_RM_WORD_REGISTER(rl);
-
+            assert(dec);
-            srcval = *DECODE_RM_WORD_REGISTER(rl);
+            u16 srcval = *dec;
             DECODE_PRINTF(",");
-            dstreg = DECODE_RM_WORD_REGISTER(rh);
+            u16 *dstreg = DECODE_RM_WORD_REGISTER(rh);
             TRACE_AND_STEP();
             CONDITIONAL_SET_FLAG(srcval == 0, F_ZF);
+            assert(dstreg);
             for (*dstreg = 15; *dstreg > 0; (*dstreg)--)
                 if ((srcval >> *dstreg) & 1)
                     break;
@@ -2543,6 +2669,7 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = (s16) ((s8) fetch_data_byte(srcoffset));
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         break;
@@ -2557,6 +2684,7 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = (s32) ((s8) fetch_data_byte(srcoffset));
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         else {
@@ -2569,6 +2697,7 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = (s16) ((s8) fetch_data_byte(srcoffset));
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         break;
@@ -2583,6 +2712,7 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = (s32) ((s8) fetch_data_byte(srcoffset));
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         else {
@@ -2595,6 +2725,7 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             srcval = (s16) ((s8) fetch_data_byte(srcoffset));
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
+            assert(destreg);
             *destreg = srcval;
         }
         break;
@@ -2604,8 +2735,10 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             u8 *srcreg;
 
             destreg = DECODE_RM_LONG_REGISTER(rh);
+            assert(destreg);
             DECODE_PRINTF(",");
             srcreg = DECODE_RM_BYTE_REGISTER(rl);
+            assert(srcreg);
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
             *destreg = (s32) ((s8) * srcreg);
@@ -2615,8 +2748,10 @@ x86emuOp2_movsx_byte_R_RM(u8 X86EMU_UNUSED(op2))
             u8 *srcreg;
 
             destreg = DECODE_RM_WORD_REGISTER(rh);
+            assert(destreg);
             DECODE_PRINTF(",");
             srcreg = DECODE_RM_BYTE_REGISTER(rl);
+            assert(srcreg);
             DECODE_PRINTF("\n");
             TRACE_AND_STEP();
             *destreg = (s16) ((s8) * srcreg);
@@ -2651,6 +2786,7 @@ x86emuOp2_movsx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcval = (s32) ((s16) fetch_data_word(srcoffset));
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
         *destreg = srcval;
         break;
     case 1:
@@ -2660,6 +2796,7 @@ x86emuOp2_movsx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcval = (s32) ((s16) fetch_data_word(srcoffset));
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
         *destreg = srcval;
         break;
     case 2:
@@ -2669,12 +2806,15 @@ x86emuOp2_movsx_word_R_RM(u8 X86EMU_UNUSED(op2))
         srcval = (s32) ((s16) fetch_data_word(srcoffset));
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
+        assert(destreg);
         *destreg = srcval;
         break;
     case 3:                    /* register to register */
         destreg = DECODE_RM_LONG_REGISTER(rh);
+        assert(destreg);
         DECODE_PRINTF(",");
         srcreg = DECODE_RM_WORD_REGISTER(rl);
+        assert(srcreg);
         DECODE_PRINTF("\n");
         TRACE_AND_STEP();
         *destreg = (s32) ((s16) * srcreg);