[PATCH:libX11] If XGetImage fails to create image, don't dereference it to bounds check

Alan Coopersmith alan.coopersmith at oracle.com
Tue Mar 6 21:47:27 UTC 2018


Reported by gcc 7.3:

GetImage.c:110:25: warning: potential null pointer dereference [-Wnull-dereference]
  if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
                    ~~~~~^~~~~~~~

Introduced by 8ea762f94f4c942d898fdeb590a1630c83235c17 in Xlib 1.6.4

Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
---
 src/GetImage.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/GetImage.c b/src/GetImage.c
index ff32d589..44a576a1 100644
--- a/src/GetImage.c
+++ b/src/GetImage.c
@@ -105,14 +105,16 @@ XImage *XGetImage (
 	    planes = 1;
 	}
 
-	if (!image)
+	if (!image) {
 	    Xfree(data);
-	if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
-	    INT_MAX / image->height <= image->bytes_per_line ||
-	    INT_MAX / planes <= image->height * image->bytes_per_line ||
-	    nbytes < planes * image->height * image->bytes_per_line) {
-	    XDestroyImage(image);
-	    image = NULL;
+	} else {
+            if (planes < 1 || image->height < 1 || image->bytes_per_line < 1 ||
+                INT_MAX / image->height <= image->bytes_per_line ||
+                INT_MAX / planes <= image->height * image->bytes_per_line ||
+                nbytes < planes * image->height * image->bytes_per_line) {
+                XDestroyImage(image);
+                image = NULL;
+            }
 	}
 	UnlockDisplay(dpy);
 	SyncHandle();
-- 
2.15.0



More information about the xorg-devel mailing list