Bug Summary

File:src/ModMap.c
Location:line 161, column 35
Description:Array access (via field 'modifiermap') results in a null pointer dereference

Annotated Source Code

1/*
2
3Copyright 1986, 1998 The Open Group
4
5Permission to use, copy, modify, distribute, and sell this software and its
6documentation for any purpose is hereby granted without fee, provided that
7the above copyright notice appear in all copies and that both that
8copyright notice and this permission notice appear in supporting
9documentation.
10
11The above copyright notice and this permission notice shall be included in
12all copies or substantial portions of the Software.
13
14THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
15IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
17OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
18AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
19CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
20
21Except as contained in this notice, the name of The Open Group shall not be
22used in advertising or otherwise to promote the sale, use or other dealings
23in this Software without prior written authorization from The Open Group.
24
25*/
26
27#ifdef HAVE_CONFIG_H1
28#include <config.h>
29#endif
30#include "Xlibint.h"
31#include <limits.h>
32
33XModifierKeymap *
34XGetModifierMapping(register Display *dpy)
35{
36 xGetModifierMappingReply rep;
37 register xReq *req;
38 unsigned long nbytes;
39 XModifierKeymap *res;
40
41 LockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->lock_display
)(dpy)
;
42 GetEmptyReq(GetModifierMapping, req)req = (xReq *) _XGetRequest(dpy, 119, 4);
43 (void) _XReply (dpy, (xReply *)&rep, 0, xFalse0);
44
45 if (rep.length < (INT_MAX2147483647 >> 2)) {
46 nbytes = (unsigned long)rep.length << 2;
47 res = Xmalloc(sizeof (XModifierKeymap))malloc(((sizeof (XModifierKeymap)) == 0 ? 1 : (sizeof (XModifierKeymap
))))
;
48 if (res)
49 res->modifiermap = Xmalloc (nbytes)malloc(((nbytes) == 0 ? 1 : (nbytes)));
50 } else
51 res = NULL((void*)0);
52 if ((! res) || (! res->modifiermap)) {
53 Xfree(res)free((res));
54 res = (XModifierKeymap *) NULL((void*)0);
55 _XEatDataWords(dpy, rep.length);
56 } else {
57 _XReadPad(dpy, (char *) res->modifiermap, (long) nbytes);
58 res->max_keypermod = rep.numKeyPerModifier;
59 }
60
61 UnlockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->unlock_display
)(dpy)
;
62 SyncHandle()if (dpy->synchandler) (*dpy->synchandler)(dpy);
63 return (res);
64}
65
66/*
67 * Returns:
68 * MappingSuccess (0) Success
69 * MappingBusy (1) Busy - one or more old or new modifiers are down
70 * MappingFailed (2) Failed - one or more new modifiers unacceptable
71 */
72int
73XSetModifierMapping(
74 register Display *dpy,
75 register XModifierKeymap *modifier_map)
76{
77 register xSetModifierMappingReq *req;
78 xSetModifierMappingReply rep;
79 int mapSize = modifier_map->max_keypermod << 3; /* 8 modifiers */
80
81 LockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->lock_display
)(dpy)
;
82 GetReq(SetModifierMapping, req)req = (xSetModifierMappingReq *) _XGetRequest(dpy, 118, 4);
83 req->length += mapSize >> 2;
84 req->numKeyPerModifier = modifier_map->max_keypermod;
85
86 Data(dpy, modifier_map->modifiermap, mapSize){ if (dpy->bufptr + (mapSize) <= dpy->bufmax) { __builtin___memcpy_chk
(dpy->bufptr, modifier_map->modifiermap, (int)mapSize,
__builtin_object_size (dpy->bufptr, 0)); dpy->bufptr +=
((mapSize) + 3) & ~3; } else _XSend(dpy, modifier_map->
modifiermap, mapSize);}
;
87
88 (void) _XReply(dpy, (xReply *) & rep,
89 (SIZEOF(xSetModifierMappingReply)32 - SIZEOF(xReply)32) >> 2, xTrue1);
90 UnlockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->unlock_display
)(dpy)
;
91 SyncHandle()if (dpy->synchandler) (*dpy->synchandler)(dpy);
92 return (rep.success);
93}
94
95XModifierKeymap *
96XNewModifiermap(int keyspermodifier)
97{
98 XModifierKeymap *res = Xmalloc((sizeof (XModifierKeymap)))malloc((((sizeof (XModifierKeymap))) == 0 ? 1 : ((sizeof (XModifierKeymap
)))))
;
99 if (res) {
3
Assuming 'res' is non-null
4
Taking true branch
100 res->max_keypermod = keyspermodifier;
101 res->modifiermap = (keyspermodifier > 0 ?
5
Assuming 'keyspermodifier' is <= 0
6
'?' condition is false
7
Null pointer value stored to field 'modifiermap'
102 Xmalloc(8 * keyspermodifier)malloc(((8 * keyspermodifier) == 0 ? 1 : (8 * keyspermodifier
)))
103 : (KeyCode *) NULL((void*)0));
104 if (keyspermodifier && (res->modifiermap == NULL((void*)0))) {
105 Xfree(res)free((res));
106 return (XModifierKeymap *) NULL((void*)0);
107 }
108 }
109 return (res);
110}
111
112
113int
114XFreeModifiermap(XModifierKeymap *map)
115{
116 if (map) {
117 Xfree(map->modifiermap)free((map->modifiermap));
118 Xfree(map)free((map));
119 }
120 return 1;
121}
122
123XModifierKeymap *
124XInsertModifiermapEntry(XModifierKeymap *map,
125#if NeedWidePrototypes1
126 unsigned int keycode,
127#else
128 KeyCode keycode,
129#endif
130 int modifier)
131{
132 XModifierKeymap *newmap;
133 int i,
134 row = modifier * map->max_keypermod,
135 newrow,
136 lastrow;
137
138 for (i=0; i<map->max_keypermod; i++) {
1
Loop condition is false. Execution continues on line 148
139 if (map->modifiermap[ row+i ] == keycode)
140 return(map); /* already in the map */
141 if (map->modifiermap[ row+i ] == 0) {
142 map->modifiermap[ row+i ] = keycode;
143 return(map); /* we added it without stretching the map */
144 }
145 }
146
147 /* stretch the map */
148 if ((newmap = XNewModifiermap(map->max_keypermod+1)) == NULL((void*)0))
2
Calling 'XNewModifiermap'
8
Returning from 'XNewModifiermap'
9
Taking false branch
149 return (XModifierKeymap *) NULL((void*)0);
150 newrow = row = 0;
151 lastrow = newmap->max_keypermod * 8;
152 while (newrow < lastrow) {
10
Loop condition is false. Execution continues on line 159
153 for (i=0; i<map->max_keypermod; i++)
154 newmap->modifiermap[ newrow+i ] = map->modifiermap[ row+i ];
155 newmap->modifiermap[ newrow+i ] = 0;
156 row += map->max_keypermod;
157 newrow += newmap->max_keypermod;
158 }
159 (void) XFreeModifiermap(map);
160 newrow = newmap->max_keypermod * modifier + newmap->max_keypermod - 1;
161 newmap->modifiermap[ newrow ] = keycode;
11
Array access (via field 'modifiermap') results in a null pointer dereference
162 return(newmap);
163}
164
165XModifierKeymap *
166XDeleteModifiermapEntry(XModifierKeymap *map,
167#if NeedWidePrototypes1
168 unsigned int keycode,
169#else
170 KeyCode keycode,
171#endif
172 int modifier)
173{
174 int i,
175 row = modifier * map->max_keypermod;
176
177 for (i=0; i<map->max_keypermod; i++) {
178 if (map->modifiermap[ row+i ] == keycode)
179 map->modifiermap[ row+i ] = 0;
180 }
181 /* should we shrink the map?? */
182 return (map);
183}