exaDriverInit: Fail if pScreenInfo or a member of it is invalid.

EXA may attempt to use the invalid value and crash otherwise.

1 files changed, 39 insertions, 0 deletions

diff --git a/exa/exa.c b/exa/exa.c
index c5b5a666a..8e22b8927 100644
--- a/exa/exa.c
+++ b/exa/exa.c
@@ -569,6 +569,45 @@ exaDriverInit (ScreenPtr		pScreen,
     PictureScreenPtr ps;
 #endif
 
+    if (!pScreenInfo)
+	return FALSE;
+
+    if (!pScreenInfo->memoryBase) {
+	LogMessage(X_ERROR, "EXA(%d): ExaDriverRec::memoryBase must be "
+		   "non-zero\n", pScreen->myNum);
+	return FALSE;
+    }
+
+    if (!pScreenInfo->memorySize) {
+	LogMessage(X_ERROR, "EXA(%d): ExaDriverRec::memorySize must be "
+		   "non-zero\n", pScreen->myNum);
+	return FALSE;
+    }
+
+    if (pScreenInfo->offScreenBase > pScreenInfo->memorySize) {
+	LogMessage(X_ERROR, "EXA(%d): ExaDriverRec::offScreenBase must be <= "
+		   "ExaDriverRec::memorySize\n", pScreen->myNum);
+	return FALSE;
+    }
+
+    if (!pScreenInfo->PrepareSolid) {
+	LogMessage(X_ERROR, "EXA(%d): ExaDriverRec::PrepareSolid must be "
+		   "non-NULL\n", pScreen->myNum);
+	return FALSE;
+    }
+
+    if (!pScreenInfo->PrepareCopy) {
+	LogMessage(X_ERROR, "EXA(%d): ExaDriverRec::PrepareCopy must be "
+		   "non-NULL\n", pScreen->myNum);
+	return FALSE;
+    }
+
+    if (!pScreenInfo->WaitMarker) {
+	LogMessage(X_ERROR, "EXA(%d): ExaDriverRec::WaitMarker must be "
+		   "non-NULL\n", pScreen->myNum);
+	return FALSE;
+    }
+
     if (pScreenInfo->exa_major != EXA_VERSION_MAJOR ||
 	pScreenInfo->exa_minor > EXA_VERSION_MINOR)
     {