Bug 88882

Summary: hud_context.c: possible NULL-pointer dereference
Product: Mesa Reporter: Heinrich Schuchardt <xypron.glpk>
Component: Drivers/Gallium/radeonsiAssignee: Default DRI bug account <dri-devel>
Status: RESOLVED FIXED QA Contact: Default DRI bug account <dri-devel>
Severity: normal    
Priority: medium    
Version: git   
Hardware: Other   
OS: All   
Whiteboard:
i915 platform: i915 features:

Description Heinrich Schuchardt 2015-01-30 21:11:42 UTC 
In
mesa/src/gallium/auxiliary/hud/hud_context.c
we find the following code

      case ',':
         env++;
         y += height + hud->font.glyph_height * (pane->num_graphs + 2);

         if (pane && pane->num_graphs) {
            LIST_ADDTAIL(&pane->head, &hud->pane_list);
            pane = NULL;
         }
         break;

pane is checked for being NULL. So obviously we expect NULL as possible value.
But we use pane->num_graphs before the check. This is possibly a NULL-pointer dereference.

The problem was indicated by cppcheck
http://cppcheck.sourceforge.net/

Best regards

Heinrich Schuchardt
Comment 1 Marek Olšák 2015-10-17 17:07:07 UTC 
Fixed by 006fcc0da674ca18ebf07771e3c309997ab32798.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.