xserver/Xext
Alan Coopersmith 295b22cc6b panoramix: avoid null dereference in PanoramiXConsolidate()
Reported in #1817:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def5]
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘root’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:819:12: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:820:5: danger: ‘root’ could be NULL: unchecked value from (1)
818|
819|       root = malloc(sizeof(PanoramiXRes));
820|->     root->type = XRT_WINDOW;
821|       defmap = malloc(sizeof(PanoramiXRes));
822|       defmap->type = XRT_COLORMAP;
Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]

xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘defmap’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:821:14: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:822:5: danger: ‘defmap’ could be NULL: unchecked value from (1)
820|       root->type = XRT_WINDOW;
821|       defmap = malloc(sizeof(PanoramiXRes));
822|->     defmap->type = XRT_COLORMAP;
823|       saver = malloc(sizeof(PanoramiXRes));
824|       saver->type = XRT_WINDOW;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘saver’
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:823:13: acquire_memory: this call could return NULL
xwayland-24.1.6/redhat-linux-build/../Xext/panoramiX.c:824:5: danger: ‘saver’ could be NULL: unchecked value from (1)
822|       defmap->type = XRT_COLORMAP;
823|       saver = malloc(sizeof(PanoramiXRes));
824|->     saver->type = XRT_WINDOW;
825|
826|       FOR_NSCREENS(i) {

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2065>
(cherry picked from commit 23c103d41f)
(cherry picked from commit 6edd79e5f5)
2026-03-24 16:05:35 +01:00
..
bigreq.c dix: unexport global variables 2024-03-09 17:23:43 +00:00
dpms.c dpms: Add support for DPMSInfoNotify event from DPMS 1.2 (xorgproto) 2023-12-18 16:35:51 +03:00
dpmsproc.h dpms: Consolidate a bunch of stuff into Xext/dpms.c 2017-03-27 15:59:47 -04:00
geext.c More missing version checks in SProcs 2021-08-08 12:43:01 +00:00
geext.h Move extension initialisation prototypes into extinit.h 2012-07-09 23:06:41 -07:00
geint.h xge: Hide some implementation details 2015-07-08 16:40:58 -04:00
hashtable.c dix: Fix undefined shift in ht_generic_hash 2019-10-15 14:06:30 -04:00
hashtable.h Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
meson.build Drop Xorg DDX 2024-04-12 10:40:05 +02:00
panoramiX.c panoramix: avoid null dereference in PanoramiXConsolidate() 2026-03-24 16:05:35 +01:00
panoramiX.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
panoramiXh.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
panoramiXprocs.c dix: Call SourceValidate before GetImage 2019-10-30 16:26:01 +00:00
panoramiXsrv.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
panoramiXSwap.c dispatch: Mark swapped dispatch as _X_COLD 2017-03-01 10:16:20 -05:00
saver.c Xext: free the screen saver resource when replacing it 2022-12-14 11:02:40 +10:00
security.c dix: unexport CloseDownClient() 2024-03-13 00:47:36 +00:00
securitysrv.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
shape.c dispatch: Mark swapped dispatch as _X_COLD 2017-03-01 10:16:20 -05:00
shm.c os, shm: fcntl()'s third argument is integer, not pointer 2020-12-18 09:36:30 -05:00
shmint.h xext: Fix shmint.h to not use headers outside of sdk_HEADERS 2013-11-14 10:22:15 +09:00
sleepuntil.c os: Don't crash in AttendClient if the client is gone 2019-11-19 10:15:05 -08:00
sleepuntil.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
sync.c sync: Apply changes last in SyncChangeAlarmAttributes() 2025-02-25 19:38:11 +01:00
syncsdk.h xsync: Add resource inside of SyncCreate, export SyncCreate 2019-04-17 14:01:17 -07:00
syncsrv.h sync: Convert from "CARD64" to int64_t. 2017-09-20 13:19:27 -04:00
vidmode.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
xace.c xace: drop duplicate export of XaceHooks from .c source 2024-03-03 22:34:26 +00:00
xace.h xace: Remove the audit hooks and tune dispatch 2016-06-10 13:26:19 -04:00
xacestr.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
xcmisc.c dispatch: Mark swapped dispatch as _X_COLD 2017-03-01 10:16:20 -05:00
xf86bigfont.c xf86bigfont: fix -Wimplicit-function-declaration error 2026-03-24 16:05:35 +01:00
xf86bigfontsrv.h Move extension initialisation prototypes into extinit.h 2012-07-09 23:06:41 -07:00
xres.c include: drop obsolete registry.h 2024-03-03 23:20:06 +00:00
xselinux.h include: unpexport SELINUX_* consts from include/global.h 2024-03-25 19:40:04 +00:00
xselinux_ext.c os: move SELinux enforcement state to the extension 2024-03-25 19:40:04 +00:00
xselinux_hooks.c Xext: fix missing include of <errno.h> 2024-03-21 17:32:30 +01:00
xselinux_label.c include: drop obsolete registry.h 2024-03-03 23:20:06 +00:00
xselinuxint.h include: drop obsolete registry.h 2024-03-03 23:20:06 +00:00
xtest.c dix: initialize the XTest sendEventsProc for all devices 2024-01-09 00:45:31 +00:00
xvdisp.c Unvalidated lengths 2017-10-10 23:33:34 +02:00
xvdisp.h Fix swapped Xv dispatch under Xinerama. 2007-12-02 14:15:36 -05:00
xvdix.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
xvmain.c Xext: free the XvRTVideoNotify when turning off from the same client 2022-12-14 11:02:06 +10:00
xvmc.c dispatch: Mark swapped dispatch as _X_COLD 2017-03-01 10:16:20 -05:00
xvmcext.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00