Bug Summary

File:Xi/xichangecursor.c
Location:line 93, column 21
Description:Dereference of null pointer

Annotated Source Code

1/*
2 * Copyright 2007-2008 Peter Hutterer
3 *
4 * Permission is hereby granted, free of charge, to any person obtaining a
5 * copy of this software and associated documentation files (the "Software"),
6 * to deal in the Software without restriction, including without limitation
7 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
8 * and/or sell copies of the Software, and to permit persons to whom the
9 * Software is furnished to do so, subject to the following conditions:
10 *
11 * The above copyright notice and this permission notice (including the next
12 * paragraph) shall be included in all copies or substantial portions of the
13 * Software.
14 *
15 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
18 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
20 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
21 * DEALINGS IN THE SOFTWARE.
22 *
23 * Author: Peter Hutterer, University of South Australia, NICTA
24 */
25
26/***********************************************************************
27 *
28 * Request to change a given device pointer's cursor.
29 *
30 */
31
32#ifdef HAVE_DIX_CONFIG_H1
33#include <dix-config.h>
34#endif
35
36#include <X11/X.h> /* for inputstr.h */
37#include <X11/Xproto.h> /* Request macro */
38#include "inputstr.h" /* DeviceIntPtr */
39#include "windowstr.h" /* window structure */
40#include "scrnintstr.h" /* screen structure */
41#include <X11/extensions/XI.h>
42#include <X11/extensions/XI2proto.h>
43#include "extnsionst.h"
44#include "exevents.h"
45#include "exglobals.h"
46#include "input.h"
47
48#include "xichangecursor.h"
49
50/***********************************************************************
51 *
52 * This procedure allows a client to set one pointer's cursor.
53 *
54 */
55
56int
57SProcXIChangeCursor(ClientPtr client)
58{
59 REQUEST(xXIChangeCursorReq)xXIChangeCursorReq *stuff = (xXIChangeCursorReq *)client->
requestBuffer
;
60 REQUEST_SIZE_MATCH(xXIChangeCursorReq)if ((sizeof(xXIChangeCursorReq) >> 2) != client->req_len
) return(16)
;
61 swaps(&stuff->length)do { if (sizeof(*(&stuff->length)) != 2) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->length) &
1) && ((uintptr_t)(&stuff->length) & 1) ==
0) *(&stuff->length) = lswaps(*(&stuff->length
)); else swap_uint16((uint16_t *)(&stuff->length)); } while
(0)
;
62 swapl(&stuff->win)do { if (sizeof(*(&stuff->win)) != 4) wrong_size(); if
(__builtin_constant_p((uintptr_t)(&stuff->win) & 3
) && ((uintptr_t)(&stuff->win) & 3) == 0) *
(&stuff->win) = lswapl(*(&stuff->win)); else swap_uint32
((uint32_t *)(&stuff->win)); } while (0)
;
63 swapl(&stuff->cursor)do { if (sizeof(*(&stuff->cursor)) != 4) wrong_size();
if (__builtin_constant_p((uintptr_t)(&stuff->cursor) &
3) && ((uintptr_t)(&stuff->cursor) & 3) ==
0) *(&stuff->cursor) = lswapl(*(&stuff->cursor
)); else swap_uint32((uint32_t *)(&stuff->cursor)); } while
(0)
;
64 swaps(&stuff->deviceid)do { if (sizeof(*(&stuff->deviceid)) != 2) wrong_size(
); if (__builtin_constant_p((uintptr_t)(&stuff->deviceid
) & 1) && ((uintptr_t)(&stuff->deviceid) &
1) == 0) *(&stuff->deviceid) = lswaps(*(&stuff->
deviceid)); else swap_uint16((uint16_t *)(&stuff->deviceid
)); } while (0)
;
65 return (ProcXIChangeCursor(client));
1
Calling 'ProcXIChangeCursor'
66}
67
68int
69ProcXIChangeCursor(ClientPtr client)
70{
71 int rc;
72 WindowPtr pWin = NULL((void*)0);
2
'pWin' initialized to a null pointer value
73 DeviceIntPtr pDev = NULL((void*)0);
74 CursorPtr pCursor = NULL((void*)0);
75
76 REQUEST(xXIChangeCursorReq)xXIChangeCursorReq *stuff = (xXIChangeCursorReq *)client->
requestBuffer
;
77 REQUEST_SIZE_MATCH(xXIChangeCursorReq)if ((sizeof(xXIChangeCursorReq) >> 2) != client->req_len
) return(16)
;
78
79 rc = dixLookupDevice(&pDev, stuff->deviceid, client, DixSetAttrAccess(1<<5));
80 if (rc != Success0)
3
Assuming 'rc' is equal to 0
4
Taking false branch
81 return rc;
82
83 if (!IsMaster(pDev) || !IsPointerDevice(pDev))
5
Taking false branch
84 return BadDevice;
85
86 if (stuff->win != None0L) {
6
Taking false branch
87 rc = dixLookupWindow(&pWin, stuff->win, client, DixSetAttrAccess(1<<5));
88 if (rc != Success0)
89 return rc;
90 }
91
92 if (stuff->cursor == None0L) {
7
Taking true branch
93 if (pWin == pWin->drawable.pScreen->root)
8
Dereference of null pointer
94 pCursor = rootCursor;
95 else
96 pCursor = (CursorPtr) None0L;
97 }
98 else {
99 rc = dixLookupResourceByType((void **) &pCursor, stuff->cursor,
100 RT_CURSOR((RESTYPE)5), client, DixUseAccess(1<<24));
101 if (rc != Success0)
102 return rc;
103 }
104
105 ChangeWindowDeviceCursor(pWin, pDev, pCursor);
106
107 return Success0;
108}