Skip to content

render: picture.c avoid use of uninitialised values #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sunweaver wants to merge 7 commits into from
Closed

render: picture.c avoid use of uninitialised values #327

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c49ad39
render: free already allocated formats in PictureInit failure case
jcristau Feb 14, 2017
90fafd4
render: Propagate allocation failure from createSourcePicture()
sunweaver Feb 14, 2017
b5ff545
render / NXpicture.c: Propagate allocation failure from createSourceP…
sunweaver Feb 14, 2017
5f3ce5a
render: Fix leak of filter params
sunweaver Feb 14, 2017
280b7b6
render / NXpicture.c: Fix leak of filter params
sunweaver Feb 14, 2017
6336231
render: fix ChangePicture when Xinerama is active (v2) (X.org bug #49…
sunweaver Feb 14, 2017
7d5b450
Xserver/render/picture.c: Avoid 'may be used uninitialized in this fu…
sunweaver Feb 14, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions nx-X11/programs/Xserver/Xext/panoramiXsrv.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ extern unsigned long XRT_WINDOW;
extern unsigned long XRT_PIXMAP;
extern unsigned long XRT_GC;
extern unsigned long XRT_COLORMAP;
extern unsigned long XRT_PICTURE;

extern void XineramaGetImageData(
DrawablePtr *pDrawables,
Expand Down
9 changes: 7 additions & 2 deletions nx-X11/programs/Xserver/hw/nxagent/NXpicture.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ PicturePtr CreatePicture (Picture pid,
static PicturePtr createSourcePicture(void);
int FreePicture (void *value, XID pid);

#define XORG_TOO_OLD
#include "../../render/picture.c"


Expand Down Expand Up @@ -349,6 +350,9 @@ static PicturePtr createSourcePicture(void)

nxagentPicturePriv(pPicture) -> picture = 0;
}
else {
return 0;
}

pPicture->pDrawable = 0;
pPicture->pFormat = 0;
Expand All @@ -368,8 +372,9 @@ FreePicture (void * value,
{
nxagentDestroyPicture(pPicture);

if (pPicture->transform)
free (pPicture->transform);
free (pPicture->transform);
free (pPicture->filter_params);

if (!pPicture->pDrawable) {
if (pPicture->pSourcePict) {
if (pPicture->pSourcePict->type != SourcePictTypeSolidFill)
Expand Down
114 changes: 101 additions & 13 deletions nx-X11/programs/Xserver/render/picture.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,10 @@
#include "picturestr.h"
#endif

#ifdef PANORAMIX
#include "panoramiXsrv.h"
#endif

int PictureScreenPrivateIndex = -1;
int PictureWindowPrivateIndex;
int PictureGeneration;
Expand Down Expand Up @@ -660,6 +664,9 @@ PictureInit (ScreenPtr pScreen, PictFormatPtr formats, int nformats)
{
if (!AddResource (formats[n].id, PictFormatType, (void *) (formats+n)))
{
int i;
for (i = 0; i < n; i++)
FreeResource(formats[i].id, RT_NONE);
free (formats);
return FALSE;
}
Expand Down Expand Up @@ -981,6 +988,8 @@ static PicturePtr createSourcePicture(void)
{
PicturePtr pPicture;
pPicture = (PicturePtr) malloc(sizeof(PictureRec));
if (!pPicture)
return 0;
pPicture->pDrawable = 0;
pPicture->pFormat = 0;
pPicture->pNext = 0;
Expand Down Expand Up @@ -1153,6 +1162,75 @@ CreateConicalGradientPicture (Picture pid, xPointFixed *center, xFixed angle,
return pPicture;
}

static int
cpAlphaMap(void **result, XID id, ScreenPtr screen, ClientPtr client, Mask mode)
{
#ifdef PANORAMIX
if (!noPanoramiXExtension) {
PanoramiXRes *res;
#ifdef XORG_TOO_OLD
res = (void*) SecurityLookupIDByType(client,
id,
XRT_PICTURE,
mode);

if (!res)
return BadPicture;
#else
int err = dixLookupResourceByType((void **)&res, id, XRT_PICTURE,
client, mode);
if (err != Success)
return err;
#endif /* XORG_TOO_OLD */
id = res->info[screen->myNum].id;
}
#endif /* PANORAMIX */

#ifdef XORG_TOO_OLD
result = (void*) SecurityLookupIDByType(client, id, PictureType, mode);
if (result)
return Success;
else
return BadAccess;
#else
return dixLookupResourceByType(result, id, PictureType, client, mode);
#endif /* XORG_TOO_OLD */
}

static int
cpClipMask(void **result, XID id, ScreenPtr screen, ClientPtr client, Mask mode)
{
#ifdef PANORAMIX
if (!noPanoramiXExtension) {
PanoramiXRes *res;
#ifdef XORG_TOO_OLD
res = (void*) SecurityLookupIDByType(client,
id,
XRT_PIXMAP,
mode);

if (!res)
return BadAccess;
#else
int err = dixLookupResourceByType((void **)&res, id, XRT_PIXMAP,
client, mode);
if (err != Success)
return err;
#endif /* XORG_TOO_OLD */
id = res->info[screen->myNum].id;
}
#endif /* PANORAMIX */
#ifdef XORG_TOO_OLD
result = (void*) SecurityLookupIDByType(client, id, RT_PIXMAP, mode);
if (result)
return Success;
else
return BadAccess;
#else
return dixLookupResourceByType(result, id, RT_PIXMAP, client, mode);
#endif
}

#define NEXT_VAL(_type) (vlist ? (_type) *vlist++ : (_type) ulist++->val)

#define NEXT_PTR(_type) ((_type) ulist++->ptr)
Expand Down Expand Up @@ -1197,7 +1275,7 @@ ChangePicture (PicturePtr pPicture,
break;
case CPAlphaMap:
{
PicturePtr pAlpha;
PicturePtr pAlpha = NULL;

if (vlist)
{
Expand All @@ -1207,11 +1285,15 @@ ChangePicture (PicturePtr pPicture,
pAlpha = 0;
else
{
pAlpha = (PicturePtr) SecurityLookupIDByType(client,
pid,
PictureType,
SecurityWriteAccess|SecurityReadAccess);
if (!pAlpha)
error = cpAlphaMap((void **) &pAlpha, pid, pScreen,
client,
#ifdef XORG_TOO_OLD
SecurityWriteAccess|SecurityReadAccess
#else
DixReadAccess
#endif
);
if (error != Success)
{
client->errorValue = pid;
error = BadPixmap;
Expand Down Expand Up @@ -1252,7 +1334,7 @@ ChangePicture (PicturePtr pPicture,
case CPClipMask:
{
Pixmap pid;
PixmapPtr pPixmap;
PixmapPtr pPixmap = NULL;
int clipType;
if (!pScreen)
return BadDrawable;
Expand All @@ -1268,10 +1350,15 @@ ChangePicture (PicturePtr pPicture,
else
{
clipType = CT_PIXMAP;
pPixmap = (PixmapPtr)SecurityLookupIDByType(client,
pid,
RT_PIXMAP,
SecurityReadAccess);
error = cpClipMask((void **) &pPixmap, pid, pScreen,
client,
#ifdef XORG_TOO_OLD
SecurityReadAccess
#else
DixReadAccess
#endif /* XORG_TOO_OLD */
);

if (!pPixmap)
{
client->errorValue = pid;
Expand Down Expand Up @@ -1610,8 +1697,9 @@ FreePicture (void * value,

if (--pPicture->refcnt == 0)
{
if (pPicture->transform)
free (pPicture->transform);
free (pPicture->transform);
free (pPicture->filter_params);

if (!pPicture->pDrawable) {
if (pPicture->pSourcePict) {
if (pPicture->pSourcePict->type != SourcePictTypeSolidFill)
Expand Down