File: | src/PolyTxt.c |
Location: | line 199, column 13 |
Description: | Dereference of null pointer (loaded from variable 'tbuf') |
1 | /* | |||
2 | ||||
3 | Copyright 1986, 1998 The Open Group | |||
4 | ||||
5 | Permission to use, copy, modify, distribute, and sell this software and its | |||
6 | documentation for any purpose is hereby granted without fee, provided that | |||
7 | the above copyright notice appear in all copies and that both that | |||
8 | copyright notice and this permission notice appear in supporting | |||
9 | documentation. | |||
10 | ||||
11 | The above copyright notice and this permission notice shall be included in | |||
12 | all copies or substantial portions of the Software. | |||
13 | ||||
14 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |||
15 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |||
16 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |||
17 | OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN | |||
18 | AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN | |||
19 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | |||
20 | ||||
21 | Except as contained in this notice, the name of The Open Group shall not be | |||
22 | used in advertising or otherwise to promote the sale, use or other dealings | |||
23 | in this Software without prior written authorization from The Open Group. | |||
24 | ||||
25 | */ | |||
26 | ||||
27 | #ifdef HAVE_CONFIG_H1 | |||
28 | #include <config.h> | |||
29 | #endif | |||
30 | #include "Xlibint.h" | |||
31 | ||||
32 | int | |||
33 | XDrawText( | |||
34 | register Display *dpy, | |||
35 | Drawable d, | |||
36 | GC gc, | |||
37 | int x, | |||
38 | int y, | |||
39 | XTextItem *items, | |||
40 | int nitems) | |||
41 | { | |||
42 | register int i; | |||
43 | register XTextItem *item; | |||
44 | int length = 0; | |||
45 | register xPolyText8Req *req; | |||
46 | ||||
47 | LockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->lock_display )(dpy); | |||
48 | FlushGC(dpy, gc)if ((gc)->dirty) _XFlushGCCache((dpy), (gc)); | |||
49 | GetReq (PolyText8, req)req = (xPolyText8Req *) _XGetRequest(dpy, 74, 16); | |||
50 | req->drawable = d; | |||
51 | req->gc = gc->gid; | |||
52 | req->x = x; | |||
53 | req->y = y; | |||
54 | ||||
55 | item = items; | |||
56 | for (i=0; i < nitems; i++) { | |||
| ||||
57 | if (item->font) | |||
58 | length += 5; /* a 255 byte, plus size of Font id */ | |||
59 | if (item->delta) | |||
60 | { | |||
61 | if (item->delta > 0) | |||
62 | { | |||
63 | length += SIZEOF(xTextElt)2 * ((item->delta + 126) / 127); | |||
64 | } | |||
65 | else | |||
66 | { | |||
67 | length += SIZEOF(xTextElt)2 * ((-item->delta + 127) / 128); | |||
68 | } | |||
69 | } | |||
70 | if (item->nchars > 0) | |||
71 | { | |||
72 | length += SIZEOF(xTextElt)2 * ((item->nchars + 253) / 254 - 1); | |||
73 | if (!item->delta) length += SIZEOF(xTextElt)2; | |||
74 | length += item->nchars; | |||
75 | } | |||
76 | item++; | |||
77 | } | |||
78 | ||||
79 | req->length += (length + 3)>>2; /* convert to number of 32-bit words */ | |||
80 | ||||
81 | ||||
82 | /* | |||
83 | * If the entire request does not fit into the remaining space in the | |||
84 | * buffer, flush the buffer first. If the request does fit into the | |||
85 | * empty buffer, then we won't have to flush it at the end to keep | |||
86 | * the buffer 32-bit aligned. | |||
87 | */ | |||
88 | ||||
89 | if (dpy->bufptr + length > dpy->bufmax) | |||
90 | _XFlush (dpy); | |||
91 | ||||
92 | item = items; | |||
93 | for (i=0; i< nitems; i++) { | |||
94 | ||||
95 | if (item->font) { | |||
96 | /* to mark a font shift, write a 255 byte followed by | |||
97 | the 4 bytes of font ID, big-end first */ | |||
98 | register unsigned char *f; | |||
99 | BufAlloc (unsigned char *, f, 5)if (dpy->bufptr + (5) > dpy->bufmax) _XFlush (dpy); f = (unsigned char *) dpy->bufptr; __builtin___memset_chk ( f, '\0', 5, __builtin_object_size (f, 0)); dpy->bufptr += ( 5);; | |||
100 | ||||
101 | f[0] = 255; | |||
102 | f[1] = (item->font & 0xff000000) >> 24; | |||
103 | f[2] = (item->font & 0x00ff0000) >> 16; | |||
104 | f[3] = (item->font & 0x0000ff00) >> 8; | |||
105 | f[4] = item->font & 0x000000ff; | |||
106 | ||||
107 | /* update GC shadow */ | |||
108 | gc->values.font = item->font; | |||
109 | } | |||
110 | ||||
111 | { | |||
112 | int nbytes = SIZEOF(xTextElt)2; | |||
113 | int PartialNChars = item->nchars; | |||
114 | int PartialDelta = item->delta; | |||
115 | /* register xTextElt *elt; */ | |||
116 | int FirstTimeThrough = True1; | |||
117 | char *CharacterOffset = item->chars; | |||
118 | char *tbuf = NULL((void*)0); | |||
119 | ||||
120 | while((PartialDelta < -128) || (PartialDelta > 127)) | |||
121 | { | |||
122 | int nb = SIZEOF(xTextElt)2; | |||
123 | ||||
124 | BufAlloc (char *, tbuf, nb)if (dpy->bufptr + (nb) > dpy->bufmax) _XFlush (dpy); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nb, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nb);; | |||
125 | *tbuf = 0; /* elt->len */ | |||
126 | if (PartialDelta > 0 ) | |||
127 | { | |||
128 | *(tbuf+1) = 127; /* elt->delta */ | |||
129 | PartialDelta = PartialDelta - 127; | |||
130 | } | |||
131 | else | |||
132 | { | |||
133 | /* -128 = 0x8, need to be careful of signed chars... */ | |||
134 | *((unsigned char *)(tbuf+1)) = 0x80; /* elt->delta */ | |||
135 | PartialDelta = PartialDelta + 128; | |||
136 | } | |||
137 | } | |||
138 | if (PartialDelta) | |||
139 | { | |||
140 | BufAlloc (char *, tbuf , nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
141 | *tbuf = 0; /* elt->len */ | |||
142 | *(tbuf+1) = PartialDelta; /* elt->delta */ | |||
143 | } | |||
144 | while(PartialNChars > 254) | |||
145 | { | |||
146 | nbytes = 254; | |||
147 | if (FirstTimeThrough) | |||
148 | { | |||
149 | FirstTimeThrough = False0; | |||
150 | if (!item->delta) | |||
151 | { | |||
152 | nbytes += SIZEOF(xTextElt)2; | |||
153 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
154 | *(tbuf+1) = 0; /* elt->delta */ | |||
155 | } | |||
156 | else | |||
157 | { | |||
158 | char *DummyChar; | |||
159 | BufAlloc(char *, DummyChar, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); DummyChar = (char *) dpy->bufptr; __builtin___memset_chk (DummyChar, '\0', nbytes, __builtin_object_size (DummyChar, 0 )); dpy->bufptr += (nbytes);; | |||
160 | } | |||
161 | } | |||
162 | else | |||
163 | { | |||
164 | nbytes += SIZEOF(xTextElt)2; | |||
165 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
166 | *(tbuf+1) = 0; /* elt->delta */ | |||
167 | } | |||
168 | /* watch out for signs on chars */ | |||
169 | *(unsigned char *)tbuf = 254; /* elt->len */ | |||
170 | memcpy (tbuf+2 , CharacterOffset, 254)__builtin___memcpy_chk (tbuf+2, CharacterOffset, 254, __builtin_object_size (tbuf+2, 0)); | |||
171 | PartialNChars = PartialNChars - 254; | |||
172 | CharacterOffset += 254; | |||
173 | ||||
174 | } | |||
175 | if (PartialNChars) | |||
176 | { | |||
177 | nbytes = PartialNChars; | |||
178 | if (FirstTimeThrough) | |||
179 | { | |||
180 | FirstTimeThrough = False0; | |||
181 | if (!item->delta) | |||
182 | { | |||
183 | nbytes += SIZEOF(xTextElt)2; | |||
184 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
185 | *(tbuf+1) = 0; /* elt->delta */ | |||
186 | } | |||
187 | else | |||
188 | { | |||
189 | char *DummyChar; | |||
190 | BufAlloc(char *, DummyChar, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); DummyChar = (char *) dpy->bufptr; __builtin___memset_chk (DummyChar, '\0', nbytes, __builtin_object_size (DummyChar, 0 )); dpy->bufptr += (nbytes);; | |||
191 | } | |||
192 | } | |||
193 | else | |||
194 | { | |||
195 | nbytes += SIZEOF(xTextElt)2; | |||
196 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
197 | *(tbuf+1) = 0; /* elt->delta */ | |||
198 | } | |||
199 | *tbuf = PartialNChars; /* elt->len */ | |||
| ||||
200 | memcpy (tbuf+2 , CharacterOffset, PartialNChars)__builtin___memcpy_chk (tbuf+2, CharacterOffset, PartialNChars , __builtin_object_size (tbuf+2, 0)); | |||
201 | } | |||
202 | } | |||
203 | item++; | |||
204 | } | |||
205 | ||||
206 | /* Pad request out to a 32-bit boundary */ | |||
207 | ||||
208 | if (length &= 3) { | |||
209 | char *pad; | |||
210 | /* | |||
211 | * BufAlloc is a macro that uses its last argument more than | |||
212 | * once, otherwise I'd write "BufAlloc (char *, pad, 4-length)" | |||
213 | */ | |||
214 | length = 4 - length; | |||
215 | BufAlloc (char *, pad, length)if (dpy->bufptr + (length) > dpy->bufmax) _XFlush (dpy ); pad = (char *) dpy->bufptr; __builtin___memset_chk (pad , '\0', length, __builtin_object_size (pad, 0)); dpy->bufptr += (length);; | |||
216 | /* | |||
217 | * if there are 3 bytes of padding, the first byte MUST be 0 | |||
218 | * so the pad bytes aren't mistaken for a final xTextElt | |||
219 | */ | |||
220 | *pad = 0; | |||
221 | } | |||
222 | ||||
223 | /* | |||
224 | * If the buffer pointer is not now pointing to a 32-bit boundary, | |||
225 | * we must flush the buffer so that it does point to a 32-bit boundary | |||
226 | * at the end of this routine. | |||
227 | */ | |||
228 | ||||
229 | if ((dpy->bufptr - dpy->buffer) & 3) | |||
230 | _XFlush (dpy); | |||
231 | UnlockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->unlock_display )(dpy); | |||
232 | SyncHandle()if (dpy->synchandler) (*dpy->synchandler)(dpy); | |||
233 | return 0; | |||
234 | } |