xfree86: Fix null pointer dereference

[Hans de Goede]

Hi,

On 01/13/2016 07:47 AM, Kyle Guinn wrote:
> Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=93675
>
> Signed-off-by: Kyle Guinn <elyk03 at gmail.com>

Thanks for the patch, I've queued this up at:

https://cgit.freedesktop.org/~jwrdegoede/xserver

For a 1.19 bug-fix pull-req I'm preparing at.

Note I've simplified the patch to:

-    if (d) {
+    if (d && d->pI2CBus) {

Instead of the nested ifs you used, still many thanks
for tracking this crashed down!

Regards,

Hans



> ---
>  hw/xfree86/i2c/xf86i2c.c | 22 ++++++++++++----------
>  1 file changed, 12 insertions(+), 10 deletions(-)
>
> diff --git a/hw/xfree86/i2c/xf86i2c.c b/hw/xfree86/i2c/xf86i2c.c
> index 2a8b8df..62b647c 100644
> --- a/hw/xfree86/i2c/xf86i2c.c
> +++ b/hw/xfree86/i2c/xf86i2c.c
> @@ -615,19 +615,21 @@ void
>  xf86DestroyI2CDevRec(I2CDevPtr d, Bool unalloc)
>  {
>      if (d) {
> -        I2CDevPtr *p;
> +        if (d->pI2CBus) {
> +            I2CDevPtr *p;
>
> -        /* Remove this from the list of active I2C devices. */
> +            /* Remove this from the list of active I2C devices. */
>
> -        for (p = &d->pI2CBus->FirstDev; *p != NULL; p = &(*p)->NextDev)
> -            if (*p == d) {
> -                *p = (*p)->NextDev;
> -                break;
> -            }
> +            for (p = &d->pI2CBus->FirstDev; *p != NULL; p = &(*p)->NextDev)
> +                if (*p == d) {
> +                    *p = (*p)->NextDev;
> +                    break;
> +                }
>
> -        xf86DrvMsg(d->pI2CBus->scrnIndex, X_INFO,
> -                   "I2C device \"%s:%s\" removed.\n",
> -                   d->pI2CBus->BusName, d->DevName);
> +            xf86DrvMsg(d->pI2CBus->scrnIndex, X_INFO,
> +                       "I2C device \"%s:%s\" removed.\n",
> +                       d->pI2CBus->BusName, d->DevName);
> +        }
>
>          if (unalloc)
>              free(d);
>