diff options
| author | Alan Coopersmith <alan.coopersmith@oracle.com> | 2024-10-12 16:12:13 -0700 |
|---|---|---|
| committer | Marge Bot <emma+marge@anholt.net> | 2024-10-28 05:38:25 +0000 |
| commit | d10589cc09c68ad09bebd3a4155c44d1b8f2614b (patch) | |
| tree | a16882ba17dabf5050fe0abd08b5ce8393a87466 /Xi | |
| parent | fa711c486a2c2c958c71d7bd8ac0efe552558717 (diff) | |
Xi: avoid NULL pointer dereference if GetXTestDevice returns NULL
The comments in that function say "This only happens if master is a
slave device. don't do that" but static analysis doesn't respect that.
Found by Oracle Parfait 13.3:
Null pointer dereference [null-pointer-deref]:
Read from null pointer XTestptr
at line 274 of Xi/xichangehierarchy.c in function 'remove_master'.
Null pointer introduced at line 691 of Xext/xtest.c in function
'GetXTestDevice'.
Function GetXTestDevice may return constant 'NULL' at line 691,
called at line 273 of Xi/xichangehierarchy.c in function
'remove_master'.
Null pointer dereference [null-pointer-deref]:
Read from null pointer XTestkeybd
at line 279 of Xi/xichangehierarchy.c in function 'remove_master'.
Null pointer introduced at line 691 of Xext/xtest.c in function
'GetXTestDevice'.
Function GetXTestDevice may return constant 'NULL' at line 691,
called at line 278 of Xi/xichangehierarchy.c in function
'remove_master'.
Fixes: 0814f511d ("input: store the master device's ID in the devPrivate for XTest devices.")
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1730>
Diffstat (limited to 'Xi')
| -rw-r--r-- | Xi/xichangehierarchy.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c index c89cafbd5..cd4c1f5f0 100644 --- a/Xi/xichangehierarchy.c +++ b/Xi/xichangehierarchy.c @@ -271,11 +271,13 @@ remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES]) goto unwind; XTestptr = GetXTestDevice(ptr); + BUG_RETURN_VAL(XTestptr == NULL, BadDevice); rc = dixLookupDevice(&XTestptr, XTestptr->id, client, DixDestroyAccess); if (rc != Success) goto unwind; XTestkeybd = GetXTestDevice(keybd); + BUG_RETURN_VAL(XTestkeybd == NULL, BadDevice); rc = dixLookupDevice(&XTestkeybd, XTestkeybd->id, client, DixDestroyAccess); if (rc != Success) goto unwind; |