From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 88882] hud_context.c: possible NULL-pointer dereference Date: Fri, 30 Jan 2015 21:11:42 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1910080095==" Return-path: Received: from culpepper.freedesktop.org (unknown [131.252.210.165]) by gabe.freedesktop.org (Postfix) with ESMTP id 6D2A96E877 for ; Fri, 30 Jan 2015 13:11:42 -0800 (PST) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1910080095== Content-Type: multipart/alternative; boundary="1422652302.f3CAcadE0.27934"; charset="UTF-8" --1422652302.f3CAcadE0.27934 Date: Fri, 30 Jan 2015 21:11:42 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" https://bugs.freedesktop.org/show_bug.cgi?id=88882 Bug ID: 88882 Summary: hud_context.c: possible NULL-pointer dereference Product: Mesa Version: git Hardware: Other OS: All Status: NEW Severity: normal Priority: medium Component: Drivers/Gallium/radeonsi Assignee: dri-devel@lists.freedesktop.org Reporter: xypron.glpk@gmx.de QA Contact: dri-devel@lists.freedesktop.org In mesa/src/gallium/auxiliary/hud/hud_context.c we find the following code case ',': env++; y += height + hud->font.glyph_height * (pane->num_graphs + 2); if (pane && pane->num_graphs) { LIST_ADDTAIL(&pane->head, &hud->pane_list); pane = NULL; } break; pane is checked for being NULL. So obviously we expect NULL as possible value. But we use pane->num_graphs before the check. This is possibly a NULL-pointer dereference. The problem was indicated by cppcheck http://cppcheck.sourceforge.net/ Best regards Heinrich Schuchardt -- You are receiving this mail because: You are the assignee for the bug. --1422652302.f3CAcadE0.27934 Date: Fri, 30 Jan 2015 21:11:42 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8"
Bug ID 88882
Summary hud_context.c: possible NULL-pointer dereference
Product Mesa
Version git
Hardware Other
OS All
Status NEW
Severity normal
Priority medium
Component Drivers/Gallium/radeonsi
Assignee dri-devel@lists.freedesktop.org
Reporter xypron.glpk@gmx.de
QA Contact dri-devel@lists.freedesktop.org 

In
mesa/src/gallium/auxiliary/hud/hud_context.c
we find the following code

      case ',':
         env++;
         y += height + hud->font.glyph_height * (pane->num_graphs + 2);

         if (pane && pane->num_graphs) {
            LIST_ADDTAIL(&pane->head, &hud->pane_list);
            pane = NULL;
         }
         break;

pane is checked for being NULL. So obviously we expect NULL as possible value.
But we use pane->num_graphs before the check. This is possibly a NULL-pointer
dereference.

The problem was indicated by cppcheck
http://cppcheck.sourceforge.net/

Best regards

Heinrich Schuchardt

You are receiving this mail because:
  • You are the assignee for the bug.
--1422652302.f3CAcadE0.27934-- --===============1910080095== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHA6Ly9saXN0 cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9kcmktZGV2ZWwK --===============1910080095==--