* [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
@ 2020-10-30 10:23 ` AlexChen
0 siblings, 0 replies; 8+ messages in thread
From: AlexChen @ 2020-10-30 10:23 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-arm, QEMU, qemu-trivial
In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
being check if it is valid, which may lead to NULL pointer dereference.
So move the assignment to surface after checking that the omap_lcd is valid.
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
---
hw/display/omap_lcdc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/display/omap_lcdc.c b/hw/display/omap_lcdc.c
index fa4a381db6..2941c5c67c 100644
--- a/hw/display/omap_lcdc.c
+++ b/hw/display/omap_lcdc.c
@@ -78,7 +78,7 @@ static void omap_lcd_interrupts(struct omap_lcd_panel_s *s)
static void omap_update_display(void *opaque)
{
struct omap_lcd_panel_s *omap_lcd = (struct omap_lcd_panel_s *) opaque;
- DisplaySurface *surface = qemu_console_surface(omap_lcd->con);
+ DisplaySurface *surface;
draw_line_func draw_line;
int size, height, first, last;
int width, linesize, step, bpp, frame_offset;
@@ -89,6 +89,7 @@ static void omap_update_display(void *opaque)
return;
}
+ surface = qemu_console_surface(omap_lcd->con);
frame_offset = 0;
if (omap_lcd->plm != 2) {
cpu_physical_memory_read(
--
2.19.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
@ 2020-10-30 10:23 ` AlexChen
0 siblings, 0 replies; 8+ messages in thread
From: AlexChen @ 2020-10-30 10:23 UTC (permalink / raw)
To: peter.maydell; +Cc: qemu-trivial, qemu-arm, QEMU
In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
being check if it is valid, which may lead to NULL pointer dereference.
So move the assignment to surface after checking that the omap_lcd is valid.
Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
---
hw/display/omap_lcdc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/display/omap_lcdc.c b/hw/display/omap_lcdc.c
index fa4a381db6..2941c5c67c 100644
--- a/hw/display/omap_lcdc.c
+++ b/hw/display/omap_lcdc.c
@@ -78,7 +78,7 @@ static void omap_lcd_interrupts(struct omap_lcd_panel_s *s)
static void omap_update_display(void *opaque)
{
struct omap_lcd_panel_s *omap_lcd = (struct omap_lcd_panel_s *) opaque;
- DisplaySurface *surface = qemu_console_surface(omap_lcd->con);
+ DisplaySurface *surface;
draw_line_func draw_line;
int size, height, first, last;
int width, linesize, step, bpp, frame_offset;
@@ -89,6 +89,7 @@ static void omap_update_display(void *opaque)
return;
}
+ surface = qemu_console_surface(omap_lcd->con);
frame_offset = 0;
if (omap_lcd->plm != 2) {
cpu_physical_memory_read(
--
2.19.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
2020-10-30 10:23 ` AlexChen
@ 2020-10-30 14:29 ` Peter Maydell
-1 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2020-10-30 14:29 UTC (permalink / raw)
To: AlexChen; +Cc: qemu-arm, QEMU, QEMU Trivial
On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
>
> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
> being check if it is valid, which may lead to NULL pointer dereference.
> So move the assignment to surface after checking that the omap_lcd is valid.
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Alex Chen <alex.chen@huawei.com>
> ---
> hw/display/omap_lcdc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Applied to target-arm.next, thanks.
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
@ 2020-10-30 14:29 ` Peter Maydell
0 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2020-10-30 14:29 UTC (permalink / raw)
To: AlexChen; +Cc: QEMU Trivial, qemu-arm, QEMU
On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
>
> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
> being check if it is valid, which may lead to NULL pointer dereference.
> So move the assignment to surface after checking that the omap_lcd is valid.
>
> Reported-by: Euler Robot <euler.robot@huawei.com>
> Signed-off-by: Alex Chen <alex.chen@huawei.com>
> ---
> hw/display/omap_lcdc.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Applied to target-arm.next, thanks.
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
2020-10-30 14:29 ` Peter Maydell
@ 2020-10-30 14:35 ` Peter Maydell
-1 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2020-10-30 14:35 UTC (permalink / raw)
To: AlexChen; +Cc: qemu-arm, QEMU, QEMU Trivial
On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
> >
> > In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
> > being check if it is valid, which may lead to NULL pointer dereference.
> > So move the assignment to surface after checking that the omap_lcd is valid.
> >
> > Reported-by: Euler Robot <euler.robot@huawei.com>
> > Signed-off-by: Alex Chen <alex.chen@huawei.com>
> > ---
> > hw/display/omap_lcdc.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> Applied to target-arm.next, thanks.
Whoops, spoke too soon. This doesn't compile:
../../hw/display/omap_lcdc.c: In function ‘omap_update_display’:
../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used
uninitialized in this function [-Werror=maybe-uninitialized]
!surface_bits_per_pixel(surface)) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
because the early exit check
if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable ||
!surface_bits_per_pixel(surface)) {
return;
}
uses 'surface' and this patch moves the initialization of that
variable down below its first use.
thanks
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
@ 2020-10-30 14:35 ` Peter Maydell
0 siblings, 0 replies; 8+ messages in thread
From: Peter Maydell @ 2020-10-30 14:35 UTC (permalink / raw)
To: AlexChen; +Cc: QEMU Trivial, qemu-arm, QEMU
On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
>
> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
> >
> > In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
> > being check if it is valid, which may lead to NULL pointer dereference.
> > So move the assignment to surface after checking that the omap_lcd is valid.
> >
> > Reported-by: Euler Robot <euler.robot@huawei.com>
> > Signed-off-by: Alex Chen <alex.chen@huawei.com>
> > ---
> > hw/display/omap_lcdc.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> Applied to target-arm.next, thanks.
Whoops, spoke too soon. This doesn't compile:
../../hw/display/omap_lcdc.c: In function ‘omap_update_display’:
../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used
uninitialized in this function [-Werror=maybe-uninitialized]
!surface_bits_per_pixel(surface)) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
because the early exit check
if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable ||
!surface_bits_per_pixel(surface)) {
return;
}
uses 'surface' and this patch moves the initialization of that
variable down below its first use.
thanks
-- PMM
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
2020-10-30 14:35 ` Peter Maydell
@ 2020-10-31 3:01 ` AlexChen
-1 siblings, 0 replies; 8+ messages in thread
From: AlexChen @ 2020-10-31 3:01 UTC (permalink / raw)
To: Peter Maydell; +Cc: qemu-arm, QEMU, QEMU Trivial
On 2020/10/30 22:35, Peter Maydell wrote:
> On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
>>
>> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
>>>
>>> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
>>> being check if it is valid, which may lead to NULL pointer dereference.
>>> So move the assignment to surface after checking that the omap_lcd is valid.
>>>
>>> Reported-by: Euler Robot <euler.robot@huawei.com>
>>> Signed-off-by: Alex Chen <alex.chen@huawei.com>
>>> ---
>>> hw/display/omap_lcdc.c | 3 ++-
>>> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>> Applied to target-arm.next, thanks.
>
> Whoops, spoke too soon. This doesn't compile:
>
> ../../hw/display/omap_lcdc.c: In function ‘omap_update_display’:
> ../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used
> uninitialized in this function [-Werror=maybe-uninitialized]
> !surface_bits_per_pixel(surface)) {
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
> because the early exit check
> if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable ||
> !surface_bits_per_pixel(surface)) {
> return;
> }
>
> uses 'surface' and this patch moves the initialization of that
> variable down below its first use.
>
Oh, I apologize for this compilation error, I will fix it in my patch v2.
Thanks,
Alex
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference
@ 2020-10-31 3:01 ` AlexChen
0 siblings, 0 replies; 8+ messages in thread
From: AlexChen @ 2020-10-31 3:01 UTC (permalink / raw)
To: Peter Maydell; +Cc: QEMU Trivial, qemu-arm, QEMU
On 2020/10/30 22:35, Peter Maydell wrote:
> On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote:
>>
>> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote:
>>>
>>> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before
>>> being check if it is valid, which may lead to NULL pointer dereference.
>>> So move the assignment to surface after checking that the omap_lcd is valid.
>>>
>>> Reported-by: Euler Robot <euler.robot@huawei.com>
>>> Signed-off-by: Alex Chen <alex.chen@huawei.com>
>>> ---
>>> hw/display/omap_lcdc.c | 3 ++-
>>> 1 file changed, 2 insertions(+), 1 deletion(-)
>
>> Applied to target-arm.next, thanks.
>
> Whoops, spoke too soon. This doesn't compile:
>
> ../../hw/display/omap_lcdc.c: In function ‘omap_update_display’:
> ../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used
> uninitialized in this function [-Werror=maybe-uninitialized]
> !surface_bits_per_pixel(surface)) {
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>
> because the early exit check
> if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable ||
> !surface_bits_per_pixel(surface)) {
> return;
> }
>
> uses 'surface' and this patch moves the initialization of that
> variable down below its first use.
>
Oh, I apologize for this compilation error, I will fix it in my patch v2.
Thanks,
Alex
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2020-10-31 3:01 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-10-30 10:23 [PATCH] hw/display/omap_lcdc: Fix potential NULL pointer dereference AlexChen
2020-10-30 10:23 ` AlexChen
2020-10-30 14:29 ` Peter Maydell
2020-10-30 14:29 ` Peter Maydell
2020-10-30 14:35 ` Peter Maydell
2020-10-30 14:35 ` Peter Maydell
2020-10-31 3:01 ` AlexChen
2020-10-31 3:01 ` AlexChen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.