Bug Summary

File:glx/single2.c
Location:line 174, column 13
Description:Value stored to 'nitems' is never read

Annotated Source Code

1/*
2 * SGI FREE SOFTWARE LICENSE B (Version 2.0, Sept. 18, 2008)
3 * Copyright (C) 1991-2000 Silicon Graphics, Inc. All Rights Reserved.
4 *
5 * Permission is hereby granted, free of charge, to any person obtaining a
6 * copy of this software and associated documentation files (the "Software"),
7 * to deal in the Software without restriction, including without limitation
8 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
9 * and/or sell copies of the Software, and to permit persons to whom the
10 * Software is furnished to do so, subject to the following conditions:
11 *
12 * The above copyright notice including the dates of first publication and
13 * either this permission notice or a reference to
14 * http://oss.sgi.com/projects/FreeB/
15 * shall be included in all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
18 * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * SILICON GRAPHICS, INC. BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
21 * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
22 * OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 * SOFTWARE.
24 *
25 * Except as contained in this notice, the name of Silicon Graphics, Inc.
26 * shall not be used in advertising or otherwise to promote the sale, use or
27 * other dealings in this Software without prior written authorization from
28 * Silicon Graphics, Inc.
29 */
30
31#ifdef HAVE_DIX_CONFIG_H1
32#include <dix-config.h>
33#endif
34
35#include <string.h>
36#include <stdio.h>
37#include <stdlib.h>
38
39#include "glxserver.h"
40#include "glxutil.h"
41#include "glxext.h"
42#include "indirect_dispatch.h"
43#include "unpack.h"
44
45int
46__glXDisp_FeedbackBuffer(__GLXclientState * cl, GLbyte * pc)
47{
48 ClientPtr client = cl->client;
49 GLsizei size;
50 GLenum type;
51 __GLXcontext *cx;
52 int error;
53
54 REQUEST_FIXED_SIZE(xGLXSingleReq, 8)if (((sizeof(xGLXSingleReq) >> 2) > client->req_len
) || (((8) >> 2) >= client->req_len) || ((((uint64_t
) sizeof(xGLXSingleReq) + (8) + 3) >> 2) != (uint64_t) client
->req_len)) return(16)
;
55
56 cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc)(((xGLXSingleReq*)pc)->contextTag), &error);
57 if (!cx) {
58 return error;
59 }
60
61 pc += __GLX_SINGLE_HDR_SIZE8;
62 size = *(GLsizei *) (pc + 0);
63 type = *(GLenum *) (pc + 4);
64 if (cx->feedbackBufSize < size) {
65 cx->feedbackBuf = reallocarrayxreallocarray(cx->feedbackBuf,
66 (size_t) size, __GLX_SIZE_FLOAT324);
67 if (!cx->feedbackBuf) {
68 cl->client->errorValue = size;
69 return BadAlloc11;
70 }
71 cx->feedbackBufSize = size;
72 }
73 glFeedbackBuffer(size, type, cx->feedbackBuf);
74 return Success0;
75}
76
77int
78__glXDisp_SelectBuffer(__GLXclientState * cl, GLbyte * pc)
79{
80 ClientPtr client = cl->client;
81 __GLXcontext *cx;
82 GLsizei size;
83 int error;
84
85 REQUEST_FIXED_SIZE(xGLXSingleReq, 4)if (((sizeof(xGLXSingleReq) >> 2) > client->req_len
) || (((4) >> 2) >= client->req_len) || ((((uint64_t
) sizeof(xGLXSingleReq) + (4) + 3) >> 2) != (uint64_t) client
->req_len)) return(16)
;
86
87 cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc)(((xGLXSingleReq*)pc)->contextTag), &error);
88 if (!cx) {
89 return error;
90 }
91
92 pc += __GLX_SINGLE_HDR_SIZE8;
93 size = *(GLsizei *) (pc + 0);
94 if (cx->selectBufSize < size) {
95 cx->selectBuf = reallocarrayxreallocarray(cx->selectBuf,
96 (size_t) size, __GLX_SIZE_CARD324);
97 if (!cx->selectBuf) {
98 cl->client->errorValue = size;
99 return BadAlloc11;
100 }
101 cx->selectBufSize = size;
102 }
103 glSelectBuffer(size, cx->selectBuf);
104 return Success0;
105}
106
107int
108__glXDisp_RenderMode(__GLXclientState * cl, GLbyte * pc)
109{
110 ClientPtr client = cl->client;
111 xGLXRenderModeReply reply;
112 __GLXcontext *cx;
113 GLint nitems = 0, retBytes = 0, retval, newModeCheck;
114 GLubyte *retBuffer = NULL((void*)0);
115 GLenum newMode;
116 int error;
117
118 REQUEST_FIXED_SIZE(xGLXSingleReq, 4)if (((sizeof(xGLXSingleReq) >> 2) > client->req_len
) || (((4) >> 2) >= client->req_len) || ((((uint64_t
) sizeof(xGLXSingleReq) + (4) + 3) >> 2) != (uint64_t) client
->req_len)) return(16)
;
119
120 cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc)(((xGLXSingleReq*)pc)->contextTag), &error);
121 if (!cx) {
122 return error;
123 }
124
125 pc += __GLX_SINGLE_HDR_SIZE8;
126 newMode = *(GLenum *) pc;
127 retval = glRenderMode(newMode);
128
129 /* Check that render mode worked */
130 glGetIntegerv(GL_RENDER_MODE0x0C40, &newModeCheck);
131 if (newModeCheck != newMode) {
132 /* Render mode change failed. Bail */
133 newMode = newModeCheck;
134 goto noChangeAllowed;
135 }
136
137 /*
138 ** Render mode might have still failed if we get here. But in this
139 ** case we can't really tell, nor does it matter. If it did fail, it
140 ** will return 0, and thus we won't send any data across the wire.
141 */
142
143 switch (cx->renderMode) {
144 case GL_RENDER0x1C00:
145 cx->renderMode = newMode;
146 break;
147 case GL_FEEDBACK0x1C01:
148 if (retval < 0) {
149 /* Overflow happened. Copy the entire buffer */
150 nitems = cx->feedbackBufSize;
151 }
152 else {
153 nitems = retval;
154 }
155 retBytes = nitems * __GLX_SIZE_FLOAT324;
156 retBuffer = (GLubyte *) cx->feedbackBuf;
157 cx->renderMode = newMode;
158 break;
159 case GL_SELECT0x1C02:
160 if (retval < 0) {
161 /* Overflow happened. Copy the entire buffer */
162 nitems = cx->selectBufSize;
163 }
164 else {
165 GLuint *bp = cx->selectBuf;
166 GLint i;
167
168 /*
169 ** Figure out how many bytes of data need to be sent. Parse
170 ** the selection buffer to determine this fact as the
171 ** return value is the number of hits, not the number of
172 ** items in the buffer.
173 */
174 nitems = 0;
Value stored to 'nitems' is never read
175 i = retval;
176 while (--i >= 0) {
177 GLuint n;
178
179 /* Parse select data for this hit */
180 n = *bp;
181 bp += 3 + n;
182 }
183 nitems = bp - cx->selectBuf;
184 }
185 retBytes = nitems * __GLX_SIZE_CARD324;
186 retBuffer = (GLubyte *) cx->selectBuf;
187 cx->renderMode = newMode;
188 break;
189 }
190
191 /*
192 ** First reply is the number of elements returned in the feedback or
193 ** selection array, as per the API for glRenderMode itself.
194 */
195 noChangeAllowed:;
196 reply = (xGLXRenderModeReply) {
197 .type = X_Reply1,
198 .sequenceNumber = client->sequence,
199 .length = nitems,
200 .retval = retval,
201 .size = nitems,
202 .newMode = newMode
203 };
204 WriteToClient(client, sz_xGLXRenderModeReply32, &reply);
205 if (retBytes) {
206 WriteToClient(client, retBytes, retBuffer);
207 }
208 return Success0;
209}
210
211int
212__glXDisp_Flush(__GLXclientState * cl, GLbyte * pc)
213{
214 ClientPtr client = cl->client;
215 __GLXcontext *cx;
216 int error;
217
218 REQUEST_SIZE_MATCH(xGLXSingleReq)if ((sizeof(xGLXSingleReq) >> 2) != client->req_len)
return(16)
;
219
220 cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc)(((xGLXSingleReq*)pc)->contextTag), &error);
221 if (!cx) {
222 return error;
223 }
224
225 glFlush();
226 return Success0;
227}
228
229int
230__glXDisp_Finish(__GLXclientState * cl, GLbyte * pc)
231{
232 ClientPtr client = cl->client;
233 __GLXcontext *cx;
234 int error;
235
236 REQUEST_SIZE_MATCH(xGLXSingleReq)if ((sizeof(xGLXSingleReq) >> 2) != client->req_len)
return(16)
;
237
238 cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc)(((xGLXSingleReq*)pc)->contextTag), &error);
239 if (!cx) {
240 return error;
241 }
242
243 /* Do a local glFinish */
244 glFinish();
245
246 /* Send empty reply packet to indicate finish is finished */
247 client = cl->client;
248 __GLX_BEGIN_REPLY(0)__glXReply.length = (((0)+3) & (GLuint)~3) >> 2; __glXReply
.type = 1; __glXReply.sequenceNumber = client->sequence;
;
249 __GLX_SEND_HEADER()WriteToClient (client, 32, &__glXReply);;
250 return Success0;
251}
252
253#define SEPARATOR" " " "
254
255char *
256__glXcombine_strings(const char *cext_string, const char *sext_string)
257{
258 size_t clen, slen;
259 char *combo_string, *token, *s1;
260 const char *s2, *end;
261
262 /* safeguard to prevent potentially fatal errors in the string functions */
263 if (!cext_string)
264 cext_string = "";
265 if (!sext_string)
266 sext_string = "";
267
268 /*
269 ** String can't be longer than min(cstring, sstring)
270 ** pull tokens out of shortest string
271 ** include space in combo_string for final separator and null terminator
272 */
273 clen = strlen(cext_string);
274 slen = strlen(sext_string);
275 if (clen > slen) {
276 combo_string = (char *) malloc(slen + 2);
277 s1 = (char *) malloc(slen + 2);
278 if (s1)
279 strcpy(s1, sext_string)__builtin___strcpy_chk (s1, sext_string, __builtin_object_size
(s1, 2 > 1 ? 1 : 0))
;
280 s2 = cext_string;
281 }
282 else {
283 combo_string = (char *) malloc(clen + 2);
284 s1 = (char *) malloc(clen + 2);
285 if (s1)
286 strcpy(s1, cext_string)__builtin___strcpy_chk (s1, cext_string, __builtin_object_size
(s1, 2 > 1 ? 1 : 0))
;
287 s2 = sext_string;
288 }
289 if (!combo_string || !s1) {
290 free(combo_string);
291 free(s1);
292 return NULL((void*)0);
293 }
294 combo_string[0] = '\0';
295
296 /* Get first extension token */
297 token = strtok(s1, SEPARATOR" ");
298 while (token != NULL((void*)0)) {
299
300 /*
301 ** if token in second string then save it
302 ** beware of extension names which are prefixes of other extension names
303 */
304 const char *p = s2;
305
306 end = p + strlen(p);
307 while (p < end) {
308 size_t n = strcspn(p, SEPARATOR" ");
309
310 if ((strlen(token) == n) && (strncmp(token, p, n) == 0)) {
311 combo_string = strcat(combo_string, token)__builtin___strcat_chk (combo_string, token, __builtin_object_size
(combo_string, 2 > 1 ? 1 : 0))
;
312 combo_string = strcat(combo_string, SEPARATOR)__builtin___strcat_chk (combo_string, " ", __builtin_object_size
(combo_string, 2 > 1 ? 1 : 0))
;
313 }
314 p += (n + 1);
315 }
316
317 /* Get next extension token */
318 token = strtok(NULL((void*)0), SEPARATOR" ");
319 }
320 free(s1);
321 return combo_string;
322}
323
324int
325DoGetString(__GLXclientState * cl, GLbyte * pc, GLboolean need_swap)
326{
327 ClientPtr client = cl->client;
328 __GLXcontext *cx;
329 GLenum name;
330 const char *string;
331
332 __GLX_DECLARE_SWAP_VARIABLESGLbyte sw;
333 int error;
334 char *buf = NULL((void*)0), *buf1 = NULL((void*)0);
335 GLint length = 0;
336
337 REQUEST_FIXED_SIZE(xGLXSingleReq, 4)if (((sizeof(xGLXSingleReq) >> 2) > client->req_len
) || (((4) >> 2) >= client->req_len) || ((((uint64_t
) sizeof(xGLXSingleReq) + (4) + 3) >> 2) != (uint64_t) client
->req_len)) return(16)
;
338
339 /* If the client has the opposite byte order, swap the contextTag and
340 * the name.
341 */
342 if (need_swap) {
343 __GLX_SWAP_INT(pc + 4)sw = ((GLbyte *)(pc + 4))[0]; ((GLbyte *)(pc + 4))[0] = ((GLbyte
*)(pc + 4))[3]; ((GLbyte *)(pc + 4))[3] = sw; sw = ((GLbyte *
)(pc + 4))[1]; ((GLbyte *)(pc + 4))[1] = ((GLbyte *)(pc + 4))
[2]; ((GLbyte *)(pc + 4))[2] = sw;
;
344 __GLX_SWAP_INT(pc + __GLX_SINGLE_HDR_SIZE)sw = ((GLbyte *)(pc + 8))[0]; ((GLbyte *)(pc + 8))[0] = ((GLbyte
*)(pc + 8))[3]; ((GLbyte *)(pc + 8))[3] = sw; sw = ((GLbyte *
)(pc + 8))[1]; ((GLbyte *)(pc + 8))[1] = ((GLbyte *)(pc + 8))
[2]; ((GLbyte *)(pc + 8))[2] = sw;
;
345 }
346
347 cx = __glXForceCurrent(cl, __GLX_GET_SINGLE_CONTEXT_TAG(pc)(((xGLXSingleReq*)pc)->contextTag), &error);
348 if (!cx) {
349 return error;
350 }
351
352 pc += __GLX_SINGLE_HDR_SIZE8;
353 name = *(GLenum *) (pc + 0);
354 string = (const char *) glGetString(name);
355
356 if (string == NULL((void*)0))
357 string = "";
358
359 /*
360 ** Restrict extensions to those that are supported by both the
361 ** implementation and the connection. That is, return the
362 ** intersection of client, server, and core extension strings.
363 */
364 if (name == GL_EXTENSIONS0x1F03) {
365 buf1 = __glXcombine_strings(string, cl->GLClientextensions);
366 buf = __glXcombine_strings(buf1, cx->pGlxScreen->GLextensions);
367 free(buf1);
368 string = buf;
369 }
370 else if (name == GL_VERSION0x1F02) {
371 if (atof(string) > atof(GLServerVersion)) {
372 if (asprintf(&buf, "%s (%s)", GLServerVersion, string) == -1) {
373 string = GLServerVersion;
374 }
375 else {
376 string = buf;
377 }
378 }
379 }
380 if (string) {
381 length = strlen((const char *) string) + 1;
382 }
383
384 __GLX_BEGIN_REPLY(length)__glXReply.length = (((length)+3) & (GLuint)~3) >> 2
; __glXReply.type = 1; __glXReply.sequenceNumber = client->
sequence;
;
385 __GLX_PUT_SIZE(length)__glXReply.size = (length);;
386
387 if (need_swap) {
388 __GLX_SWAP_REPLY_SIZE()sw = ((GLbyte *)(&__glXReply.size))[0]; ((GLbyte *)(&
__glXReply.size))[0] = ((GLbyte *)(&__glXReply.size))[3];
((GLbyte *)(&__glXReply.size))[3] = sw; sw = ((GLbyte *)
(&__glXReply.size))[1]; ((GLbyte *)(&__glXReply.size)
)[1] = ((GLbyte *)(&__glXReply.size))[2]; ((GLbyte *)(&
__glXReply.size))[2] = sw;
;
389 __GLX_SWAP_REPLY_HEADER()sw = ((GLbyte *)(&__glXReply.sequenceNumber))[0]; ((GLbyte
*)(&__glXReply.sequenceNumber))[0] = ((GLbyte *)(&__glXReply
.sequenceNumber))[1]; ((GLbyte *)(&__glXReply.sequenceNumber
))[1] = sw;; sw = ((GLbyte *)(&__glXReply.length))[0]; ((
GLbyte *)(&__glXReply.length))[0] = ((GLbyte *)(&__glXReply
.length))[3]; ((GLbyte *)(&__glXReply.length))[3] = sw; sw
= ((GLbyte *)(&__glXReply.length))[1]; ((GLbyte *)(&
__glXReply.length))[1] = ((GLbyte *)(&__glXReply.length))
[2]; ((GLbyte *)(&__glXReply.length))[2] = sw;;
;
390 }
391
392 __GLX_SEND_HEADER()WriteToClient (client, 32, &__glXReply);;
393 WriteToClient(client, length, string);
394 free(buf);
395
396 return Success0;
397}
398
399int
400__glXDisp_GetString(__GLXclientState * cl, GLbyte * pc)
401{
402 return DoGetString(cl, pc, GL_FALSE0x0);
403}