From 48bc30c5413a1be0039fa77affcbbb4fe677479f Mon Sep 17 00:00:00 2001
From: Alan Coopersmith <alan.coopersmith@oracle.com>
Date: Tue, 29 Jan 2013 10:24:32 +1000
Subject: Xext: avoid null-pointer dereference in XTestFakeInput (#59937)

dv is still NULL at this point, so return firstValuator instead (which is
the same value dv->firstValuator would be once initialized)

X.Org Bug 59937 <http://bugs.freedesktop.org/show_bug.cgi?id=59937>

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xext/xtest.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'Xext/xtest.c')

diff --git a/Xext/xtest.c b/Xext/xtest.c
index 2abdc7f58..6519b9c82 100644
--- a/Xext/xtest.c
+++ b/Xext/xtest.c
@@ -156,7 +156,6 @@ ProcXTestFakeInput(ClientPtr client)
     DeviceIntPtr dev = NULL;
     WindowPtr root;
     Bool extension = FALSE;
-    deviceValuator *dv = NULL;
     ValuatorMask mask;
     int valuators[MAX_VALUATORS] = { 0 };
     int numValuators = 0;
@@ -241,14 +240,14 @@ ProcXTestFakeInput(ClientPtr client)
         }
 
         if (nev > 1 && !dev->valuator) {
-            client->errorValue = dv->first_valuator;
+            client->errorValue = firstValuator;
             return BadValue;
         }
 
         /* check validity of valuator events */
         base = firstValuator;
         for (n = 1; n < nev; n++) {
-            dv = (deviceValuator *) (ev + n);
+            deviceValuator *dv = (deviceValuator *) (ev + n);
             if (dv->type != DeviceValuator) {
                 client->errorValue = dv->type;
                 return BadValue;
-- 
cgit v1.2.3