From 7b7bcf92311db87a0292474dcf2ed9767f4a9abd Mon Sep 17 00:00:00 2001 From: Alan Coopersmith Date: Sun, 5 Oct 2025 15:38:35 -0700 Subject: [PATCH] Xi: avoid null dereference if wOtherInputMasks() returns NULL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The wOtherInputMasks(win) macro will return NULL if win->optional is NULL. Reported in #1817: xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:1390:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:1404:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:2293:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:3244:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘inputMasks’ xwayland-24.1.6/redhat-linux-build/../Xi/exevents.c:3338:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ Signed-off-by: Alan Coopersmith Part-of: --- Xi/exevents.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/Xi/exevents.c b/Xi/exevents.c index 0c2bc0e0f..ae4268696 100644 --- a/Xi/exevents.c +++ b/Xi/exevents.c @@ -1386,6 +1386,7 @@ RetrieveTouchDeliveryData(DeviceIntPtr dev, TouchPointInfoPtr ti, else evtype = GetXI2Type(ev->any.type); + BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE); nt_list_for_each_entry(iclients, wOtherInputMasks(*win)->inputClients, next) if (xi2mask_isset(iclients->xi2mask, dev, evtype)) @@ -1400,6 +1401,7 @@ RetrieveTouchDeliveryData(DeviceIntPtr dev, TouchPointInfoPtr ti, int xi_type = GetXIType(TouchGetPointerEventType(ev)); Mask xi_filter = event_get_filter_from_type(dev, xi_type); + BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE); nt_list_for_each_entry(iclients, wOtherInputMasks(*win)->inputClients, next) if (iclients->mask[dev->id] & xi_filter) @@ -2289,6 +2291,7 @@ RetrieveGestureDeliveryData(DeviceIntPtr dev, InternalEvent *ev, GestureListener listener->type == GESTURE_LISTENER_REGULAR */ evtype = GetXI2Type(ev->any.type); + BUG_RETURN_VAL(!wOtherInputMasks(*win), FALSE); nt_list_for_each_entry(iclients, wOtherInputMasks(*win)->inputClients, next) if (xi2mask_isset(iclients->xi2mask, dev, evtype)) break; @@ -3233,13 +3236,18 @@ DeviceEventSuppressForWindow(WindowPtr pWin, ClientPtr client, Mask mask, inputMasks->dontPropagateMask[maskndx] = mask; } else { - if (!inputMasks) - AddExtensionClient(pWin, client, 0, 0); - inputMasks = wOtherInputMasks(pWin); + if (!inputMasks) { + int ret = AddExtensionClient(pWin, client, 0, 0); + + if (ret != Success) + return ret; + inputMasks = wOtherInputMasks(pWin); + BUG_RETURN_VAL(!inputMasks, BadAlloc); + } inputMasks->dontPropagateMask[maskndx] = mask; } RecalculateDeviceDeliverableEvents(pWin); - if (ShouldFreeInputMasks(pWin, FALSE)) + if (inputMasks && ShouldFreeInputMasks(pWin, FALSE)) FreeResource(inputMasks->inputClients->resource, X11_RESTYPE_NONE); return Success; } @@ -3334,6 +3342,7 @@ XISetEventMask(DeviceIntPtr dev, WindowPtr win, ClientPtr client, if (len && !others) { if (AddExtensionClient(win, client, 0, 0) != Success) return BadAlloc; + BUG_RETURN_VAL(!wOtherInputMasks(win), BadAlloc); others = wOtherInputMasks(win)->inputClients; }