xfree86: Fix null pointer dereference

[Hans de Goede]

Hi,

On 09/23/2016 03:33 PM, Eric Engestrom wrote:
> On Fri, Sep 23, 2016 at 03:12:18PM +0300, Hans de Goede wrote:
>> Hi,
>>
>> On 01/13/2016 07:47 AM, Kyle Guinn wrote:
>>> Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=93675
>>>
>>> Signed-off-by: Kyle Guinn <elyk03 at gmail.com>
>>
>> Thanks for the patch, I've queued this up at:
>>
>> https://cgit.freedesktop.org/~jwrdegoede/xserver
>>
>> For a 1.19 bug-fix pull-req I'm preparing at.
>>
>> Note I've simplified the patch to:
>>
>> -    if (d) {
>> +    if (d && d->pI2CBus) {
>>
>> Instead of the nested ifs you used, still many thanks
>> for tracking this crashed down!
>
> I find this better too, but if you do that you need to move
>
>     if (unalloc)
>         free(d);
>
> out of that `if (d && d->pI2CBus)` :)

Good one, thanks for catching that.

Regards,

Hans

>>> ---
>>>  hw/xfree86/i2c/xf86i2c.c | 22 ++++++++++++----------
>>>  1 file changed, 12 insertions(+), 10 deletions(-)
>>>
>>> diff --git a/hw/xfree86/i2c/xf86i2c.c b/hw/xfree86/i2c/xf86i2c.c
>>> index 2a8b8df..62b647c 100644
>>> --- a/hw/xfree86/i2c/xf86i2c.c
>>> +++ b/hw/xfree86/i2c/xf86i2c.c
>>> @@ -615,19 +615,21 @@ void
>>>  xf86DestroyI2CDevRec(I2CDevPtr d, Bool unalloc)
>>>  {
>>>      if (d) {
>>> -        I2CDevPtr *p;
>>> +        if (d->pI2CBus) {
>>> +            I2CDevPtr *p;
>>>
>>> -        /* Remove this from the list of active I2C devices. */
>>> +            /* Remove this from the list of active I2C devices. */
>>>
>>> -        for (p = &d->pI2CBus->FirstDev; *p != NULL; p = &(*p)->NextDev)
>>> -            if (*p == d) {
>>> -                *p = (*p)->NextDev;
>>> -                break;
>>> -            }
>>> +            for (p = &d->pI2CBus->FirstDev; *p != NULL; p = &(*p)->NextDev)
>>> +                if (*p == d) {
>>> +                    *p = (*p)->NextDev;
>>> +                    break;
>>> +                }
>>>
>>> -        xf86DrvMsg(d->pI2CBus->scrnIndex, X_INFO,
>>> -                   "I2C device \"%s:%s\" removed.\n",
>>> -                   d->pI2CBus->BusName, d->DevName);
>>> +            xf86DrvMsg(d->pI2CBus->scrnIndex, X_INFO,
>>> +                       "I2C device \"%s:%s\" removed.\n",
>>> +                       d->pI2CBus->BusName, d->DevName);
>>> +        }
>>>
>>>          if (unalloc)
>>>              free(d);
>>>
> _______________________________________________
> xorg-devel at lists.x.org: X.Org development
> Archives: http://lists.x.org/archives/xorg-devel
> Info: https://lists.x.org/mailman/listinfo/xorg-devel
>