Bug Summary

File:XGetFCtl.c
Location:line 263, column 54
Description:The right operand of '+' is a garbage value

Annotated Source Code

1/************************************************************
2
3Copyright 1989, 1998 The Open Group
4
5Permission to use, copy, modify, distribute, and sell this software and its
6documentation for any purpose is hereby granted without fee, provided that
7the above copyright notice appear in all copies and that both that
8copyright notice and this permission notice appear in supporting
9documentation.
10
11The above copyright notice and this permission notice shall be included in
12all copies or substantial portions of the Software.
13
14THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
18AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
19CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
20
21Except as contained in this notice, the name of The Open Group shall not be
22used in advertising or otherwise to promote the sale, use or other dealings
23in this Software without prior written authorization from The Open Group.
24
25Copyright 1989 by Hewlett-Packard Company, Palo Alto, California.
26
27 All Rights Reserved
28
29Permission to use, copy, modify, and distribute this software and its
30documentation for any purpose and without fee is hereby granted,
31provided that the above copyright notice appear in all copies and that
32both that copyright notice and this permission notice appear in
33supporting documentation, and that the name of Hewlett-Packard not be
34used in advertising or publicity pertaining to distribution of the
35software without specific, written prior permission.
36
37HEWLETT-PACKARD DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING
38ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL
39HEWLETT-PACKARD BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR
40ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
41WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION,
42ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
43SOFTWARE.
44
45********************************************************/
46
47/***********************************************************************
48 *
49 * XGetFeedbackControl - get the feedback attributes of an extension device.
50 *
51 */
52
53#ifdef HAVE_CONFIG_H1
54#include <config.h>
55#endif
56
57#include <X11/extensions/XI.h>
58#include <X11/extensions/XIproto.h>
59#include <X11/Xlibint.h>
60#include <X11/Xlib.h>
61#include <X11/extensions/XInput.h>
62#include <X11/extensions/extutil.h>
63#include "XIint.h"
64#include <limits.h>
65
66XFeedbackState *
67XGetFeedbackControl(
68 register Display *dpy,
69 XDevice *dev,
70 int *num_feedbacks)
71{
72 XFeedbackState *Feedback = NULL((void*)0);
73 XFeedbackState *Sav = NULL((void*)0);
74 xFeedbackState *f = NULL((void*)0);
75 xFeedbackState *sav = NULL((void*)0);
76 xGetFeedbackControlReq *req;
77 xGetFeedbackControlReply rep;
78 XExtDisplayInfo *info = XInput_find_display(dpy);
79
80 LockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->lock_display
)(dpy)
;
81 if (_XiCheckExtInit(dpy, XInput_Initial_Release1, info) == -1)
1
Taking false branch
82 return NULL((void*)0);
83
84 GetReq(GetFeedbackControl, req)req = (xGetFeedbackControlReq *) _XGetRequest(dpy, 22, 8);
85 req->reqType = info->codes->major_opcode;
86 req->ReqType = X_GetFeedbackControl22;
87 req->deviceid = dev->device_id;
88
89 if (!_XReply(dpy, (xReply *) & rep, 0, xFalse0))
2
Taking false branch
90 goto out;
91
92 if (rep.length > 0) {
3
Taking true branch
93 unsigned long nbytes;
94 size_t size = 0;
95 int i;
96
97 *num_feedbacks = rep.num_feedbacks;
98
99 if (rep.length < (INT_MAX2147483647 >> 2)) {
4
Taking true branch
100 nbytes = rep.length << 2;
101 f = Xmalloc(nbytes)malloc(((nbytes) == 0 ? 1 : (nbytes)));
102 }
103 if (!f) {
5
Assuming 'f' is non-null
6
Taking false branch
104 _XEatDataWords(dpy, rep.length);
105 goto out;
106 }
107 sav = f;
108 _XRead(dpy, (char *)f, nbytes);
109
110 for (i = 0; i < *num_feedbacks; i++) {
7
Loop condition is true. Entering loop body
12
Loop condition is false. Execution continues on line 147
111 if (f->length > nbytes)
8
Taking false branch
112 goto out;
113 nbytes -= f->length;
114
115 switch (f->class) {
9
Control jumps to the 'default' case at line 138
116 case KbdFeedbackClass0:
117 size += sizeof(XKbdFeedbackState);
118 break;
119 case PtrFeedbackClass1:
120 size += sizeof(XPtrFeedbackState);
121 break;
122 case IntegerFeedbackClass3:
123 size += sizeof(XIntegerFeedbackState);
124 break;
125 case StringFeedbackClass2:
126 {
127 xStringFeedbackState *strf = (xStringFeedbackState *) f;
128 size += sizeof(XStringFeedbackState) +
129 (strf->num_syms_supported * sizeof(KeySym));
130 }
131 break;
132 case LedFeedbackClass4:
133 size += sizeof(XLedFeedbackState);
134 break;
135 case BellFeedbackClass5:
136 size += sizeof(XBellFeedbackState);
137 break;
138 default:
139 size += f->length;
140 break;
10
Execution continues on line 142
141 }
142 if (size > INT_MAX2147483647)
11
Taking false branch
143 goto out;
144 f = (xFeedbackState *) ((char *)f + f->length);
145 }
146
147 Feedback = Xmalloc(size)malloc(((size) == 0 ? 1 : (size)));
13
Within the expansion of the macro 'Xmalloc':
a
Assuming 'size' is equal to 0
b
Uninitialized value stored to field 'length'
148 if (!Feedback)
14
Assuming 'Feedback' is non-null
15
Taking false branch
149 goto out;
150
151 Sav = Feedback;
152
153 f = sav;
154 for (i = 0; i < *num_feedbacks; i++) {
16
Loop condition is true. Entering loop body
155 switch (f->class) {
17
Control jumps to the 'default' case at line 259
156 case KbdFeedbackClass0:
157 {
158 xKbdFeedbackState *k;
159 XKbdFeedbackState *K;
160
161 k = (xKbdFeedbackState *) f;
162 K = (XKbdFeedbackState *) Feedback;
163
164 K->class = k->class;
165 K->length = sizeof(XKbdFeedbackState);
166 K->id = k->id;
167 K->click = k->click;
168 K->percent = k->percent;
169 K->pitch = k->pitch;
170 K->duration = k->duration;
171 K->led_mask = k->led_mask;
172 K->global_auto_repeat = k->global_auto_repeat;
173 memcpy((char *)&K->auto_repeats[0],__builtin___memcpy_chk ((char *)&K->auto_repeats[0], (
char *)&k->auto_repeats[0], 32, __builtin_object_size (
(char *)&K->auto_repeats[0], 0))
174 (char *)&k->auto_repeats[0], 32)__builtin___memcpy_chk ((char *)&K->auto_repeats[0], (
char *)&k->auto_repeats[0], 32, __builtin_object_size (
(char *)&K->auto_repeats[0], 0))
;
175 break;
176 }
177 case PtrFeedbackClass1:
178 {
179 xPtrFeedbackState *p;
180 XPtrFeedbackState *P;
181
182 p = (xPtrFeedbackState *) f;
183 P = (XPtrFeedbackState *) Feedback;
184
185 P->class = p->class;
186 P->length = sizeof(XPtrFeedbackState);
187 P->id = p->id;
188 P->accelNum = p->accelNum;
189 P->accelDenom = p->accelDenom;
190 P->threshold = p->threshold;
191 break;
192 }
193 case IntegerFeedbackClass3:
194 {
195 xIntegerFeedbackState *ifs;
196 XIntegerFeedbackState *I;
197
198 ifs = (xIntegerFeedbackState *) f;
199 I = (XIntegerFeedbackState *) Feedback;
200
201 I->class = ifs->class;
202 I->length = sizeof(XIntegerFeedbackState);
203 I->id = ifs->id;
204 I->resolution = ifs->resolution;
205 I->minVal = ifs->min_value;
206 I->maxVal = ifs->max_value;
207 break;
208 }
209 case StringFeedbackClass2:
210 {
211 xStringFeedbackState *s;
212 XStringFeedbackState *S;
213
214 s = (xStringFeedbackState *) f;
215 S = (XStringFeedbackState *) Feedback;
216
217 S->class = s->class;
218 S->length = sizeof(XStringFeedbackState) +
219 (s->num_syms_supported * sizeof(KeySym));
220 S->id = s->id;
221 S->max_symbols = s->max_symbols;
222 S->num_syms_supported = s->num_syms_supported;
223 S->syms_supported = (KeySym *) (S + 1);
224 memcpy((char *)S->syms_supported, (char *)(s + 1),__builtin___memcpy_chk ((char *)S->syms_supported, (char *
)(s + 1), (S->num_syms_supported * sizeof(KeySym)), __builtin_object_size
((char *)S->syms_supported, 0))
225 (S->num_syms_supported * sizeof(KeySym)))__builtin___memcpy_chk ((char *)S->syms_supported, (char *
)(s + 1), (S->num_syms_supported * sizeof(KeySym)), __builtin_object_size
((char *)S->syms_supported, 0))
;
226 break;
227 }
228 case LedFeedbackClass4:
229 {
230 xLedFeedbackState *l;
231 XLedFeedbackState *L;
232
233 l = (xLedFeedbackState *) f;
234 L = (XLedFeedbackState *) Feedback;
235
236 L->class = l->class;
237 L->length = sizeof(XLedFeedbackState);
238 L->id = l->id;
239 L->led_values = l->led_values;
240 L->led_mask = l->led_mask;
241 break;
242 }
243 case BellFeedbackClass5:
244 {
245 xBellFeedbackState *b;
246 XBellFeedbackState *B;
247
248 b = (xBellFeedbackState *) f;
249 B = (XBellFeedbackState *) Feedback;
250
251 B->class = b->class;
252 B->length = sizeof(XBellFeedbackState);
253 B->id = b->id;
254 B->percent = b->percent;
255 B->pitch = b->pitch;
256 B->duration = b->duration;
257 break;
258 }
259 default:
260 break;
18
Execution continues on line 262
261 }
262 f = (xFeedbackState *) ((char *)f + f->length);
263 Feedback = (XFeedbackState *) ((char *)Feedback + Feedback->length);
19
The right operand of '+' is a garbage value
264 }
265 }
266out:
267 XFree((char *)sav);
268
269 UnlockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->unlock_display
)(dpy)
;
270 SyncHandle()if (dpy->synchandler) (*dpy->synchandler)(dpy);
271 return (Sav);
272}
273
274void
275XFreeFeedbackList(XFeedbackState *list)
276{
277 XFree((char *)list);
278}