Bug Summary

File:hw/xnest/GC.c
Location:line 145, column 23
Description:Access to field 'font_struct' results in a dereference of a null pointer

Annotated Source Code

1/*
2
3Copyright 1993 by Davor Matic
4
5Permission to use, copy, modify, distribute, and sell this software
6and its documentation for any purpose is hereby granted without fee,
7provided that the above copyright notice appear in all copies and that
8both that copyright notice and this permission notice appear in
9supporting documentation. Davor Matic makes no representations about
10the suitability of this software for any purpose. It is provided "as
11is" without express or implied warranty.
12
13*/
14
15#ifdef HAVE_XNEST_CONFIG_H1
16#include <xnest-config.h>
17#endif
18
19#include <X11/X.h>
20#include <X11/Xproto.h>
21#include "gcstruct.h"
22#include "windowstr.h"
23#include "pixmapstr.h"
24#include "scrnintstr.h"
25#include <X11/fonts/fontstruct.h>
26#include "mistruct.h"
27#include "region.h"
28
29#include "Xnest.h"
30
31#include "Display.h"
32#include "XNGC.h"
33#include "GCOps.h"
34#include "Drawable.h"
35#include "XNFont.h"
36#include "Color.h"
37
38DevPrivateKeyRec xnestGCPrivateKeyRec;
39
40static GCFuncs xnestFuncs = {
41 xnestValidateGC,
42 xnestChangeGC,
43 xnestCopyGC,
44 xnestDestroyGC,
45 xnestChangeClip,
46 xnestDestroyClip,
47 xnestCopyClip,
48};
49
50static GCOps xnestOps = {
51 xnestFillSpans,
52 xnestSetSpans,
53 xnestPutImage,
54 xnestCopyArea,
55 xnestCopyPlane,
56 xnestPolyPoint,
57 xnestPolylines,
58 xnestPolySegment,
59 xnestPolyRectangle,
60 xnestPolyArc,
61 xnestFillPolygon,
62 xnestPolyFillRect,
63 xnestPolyFillArc,
64 xnestPolyText8,
65 xnestPolyText16,
66 xnestImageText8,
67 xnestImageText16,
68 xnestImageGlyphBlt,
69 xnestPolyGlyphBlt,
70 xnestPushPixels
71};
72
73Boolint
74xnestCreateGC(GCPtr pGC)
75{
76 pGC->funcs = &xnestFuncs;
77 pGC->ops = &xnestOps;
78
79 pGC->miTranslate = 1;
80
81 xnestGCPriv(pGC)((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates,
(&xnestGCPrivateKeyRec)))
->gc = XCreateGC(xnestDisplay,
82 xnestDefaultDrawables[pGC->depth],
83 0L, NULL((void*)0));
84
85 return True1;
86}
87
88void
89xnestValidateGC(GCPtr pGC, unsigned long changes, DrawablePtr pDrawable)
90{
91}
92
93void
94xnestChangeGC(GCPtr pGC, unsigned long mask)
95{
96 XGCValues values;
97
98 if (mask & GCFunction(1L<<0))
1
Taking false branch
99 values.function = pGC->alu;
100
101 if (mask & GCPlaneMask(1L<<1))
2
Taking false branch
102 values.plane_mask = pGC->planemask;
103
104 if (mask & GCForeground(1L<<2))
3
Taking false branch
105 values.foreground = xnestPixel(pGC->fgPixel)(pGC->fgPixel);
106
107 if (mask & GCBackground(1L<<3))
4
Taking false branch
108 values.background = xnestPixel(pGC->bgPixel)(pGC->bgPixel);
109
110 if (mask & GCLineWidth(1L<<4))
5
Taking false branch
111 values.line_width = pGC->lineWidth;
112
113 if (mask & GCLineStyle(1L<<5))
6
Taking false branch
114 values.line_style = pGC->lineStyle;
115
116 if (mask & GCCapStyle(1L<<6))
7
Taking false branch
117 values.cap_style = pGC->capStyle;
118
119 if (mask & GCJoinStyle(1L<<7))
8
Taking false branch
120 values.join_style = pGC->joinStyle;
121
122 if (mask & GCFillStyle(1L<<8))
9
Taking false branch
123 values.fill_style = pGC->fillStyle;
124
125 if (mask & GCFillRule(1L<<9))
10
Taking false branch
126 values.fill_rule = pGC->fillRule;
127
128 if (mask & GCTile(1L<<10)) {
11
Taking false branch
129 if (pGC->tileIsPixel)
130 mask &= ~GCTile(1L<<10);
131 else
132 values.tile = xnestPixmap(pGC->tile.pixmap)(((xnestPrivPixmap *) dixLookupPrivate(&(pGC->tile.pixmap
)->devPrivates, (&xnestPixmapPrivateKeyRec)))->pixmap
)
;
133 }
134
135 if (mask & GCStipple(1L<<11))
12
Taking false branch
136 values.stipple = xnestPixmap(pGC->stipple)(((xnestPrivPixmap *) dixLookupPrivate(&(pGC->stipple)
->devPrivates, (&xnestPixmapPrivateKeyRec)))->pixmap
)
;
137
138 if (mask & GCTileStipXOrigin(1L<<12))
13
Taking false branch
139 values.ts_x_origin = pGC->patOrg.x;
140
141 if (mask & GCTileStipYOrigin(1L<<13))
14
Taking false branch
142 values.ts_y_origin = pGC->patOrg.y;
143
144 if (mask & GCFont(1L<<14))
15
Taking true branch
145 values.font = xnestFont(pGC->font)((((xnestPrivFont *)((xnestFontPrivateIndex) > (pGC->font
)->maxPrivate ? (void *) 0 : (pGC->font)->devPrivates
[xnestFontPrivateIndex]))->font_struct)->fid)
;
16
Within the expansion of the macro 'xnestFont':
a
Access to field 'font_struct' results in a dereference of a null pointer
146
147 if (mask & GCSubwindowMode(1L<<15))
148 values.subwindow_mode = pGC->subWindowMode;
149
150 if (mask & GCGraphicsExposures(1L<<16))
151 values.graphics_exposures = pGC->graphicsExposures;
152
153 if (mask & GCClipXOrigin(1L<<17))
154 values.clip_x_origin = pGC->clipOrg.x;
155
156 if (mask & GCClipYOrigin(1L<<18))
157 values.clip_y_origin = pGC->clipOrg.y;
158
159 if (mask & GCClipMask(1L<<19)) /* this is handled in change clip */
160 mask &= ~GCClipMask(1L<<19);
161
162 if (mask & GCDashOffset(1L<<20))
163 values.dash_offset = pGC->dashOffset;
164
165 if (mask & GCDashList(1L<<21)) {
166 mask &= ~GCDashList(1L<<21);
167 XSetDashes(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
,
168 pGC->dashOffset, (char *) pGC->dash, pGC->numInDashList);
169 }
170
171 if (mask & GCArcMode(1L<<22))
172 values.arc_mode = pGC->arcMode;
173
174 if (mask)
175 XChangeGC(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
, mask, &values);
176}
177
178void
179xnestCopyGC(GCPtr pGCSrc, unsigned long mask, GCPtr pGCDst)
180{
181 XCopyGC(xnestDisplay, xnestGC(pGCSrc)(((xnestPrivGC *) dixLookupPrivate(&(pGCSrc)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
, mask, xnestGC(pGCDst)(((xnestPrivGC *) dixLookupPrivate(&(pGCDst)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
);
182}
183
184void
185xnestDestroyGC(GCPtr pGC)
186{
187 XFreeGC(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
);
188}
189
190void
191xnestChangeClip(GCPtr pGC, int type, void *pValue, int nRects)
192{
193 int i, size;
194 BoxPtr pBox;
195 XRectangle *pRects;
196
197 xnestDestroyClip(pGC);
198
199 switch (type) {
200 case CT_NONE0:
201 XSetClipMask(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
, None0L);
202 pValue = NULL((void*)0);
203 break;
204
205 case CT_REGION2:
206 nRects = RegionNumRects((RegionPtr) pValue);
207 size = nRects * sizeof(*pRects);
208 pRects = (XRectangle *) malloc(size);
209 pBox = RegionRects((RegionPtr) pValue);
210 for (i = nRects; i-- > 0;) {
211 pRects[i].x = pBox[i].x1;
212 pRects[i].y = pBox[i].y1;
213 pRects[i].width = pBox[i].x2 - pBox[i].x1;
214 pRects[i].height = pBox[i].y2 - pBox[i].y1;
215 }
216 XSetClipRectangles(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
, 0, 0,
217 pRects, nRects, Unsorted0);
218 free((char *) pRects);
219 break;
220
221 case CT_PIXMAP1:
222 XSetClipMask(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
,
223 xnestPixmap((PixmapPtr) pValue)(((xnestPrivPixmap *) dixLookupPrivate(&((PixmapPtr) pValue
)->devPrivates, (&xnestPixmapPrivateKeyRec)))->pixmap
)
);
224 /*
225 * Need to change into region, so subsequent uses are with
226 * current pixmap contents.
227 */
228 pGC->clientClip = (*pGC->pScreen->BitmapToRegion) ((PixmapPtr) pValue);
229 (*pGC->pScreen->DestroyPixmap) ((PixmapPtr) pValue);
230 pValue = pGC->clientClip;
231 break;
232
233 case CT_UNSORTED6:
234 XSetClipRectangles(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
,
235 pGC->clipOrg.x, pGC->clipOrg.y,
236 (XRectangle *) pValue, nRects, Unsorted0);
237 break;
238
239 case CT_YSORTED10:
240 XSetClipRectangles(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
,
241 pGC->clipOrg.x, pGC->clipOrg.y,
242 (XRectangle *) pValue, nRects, YSorted1);
243 break;
244
245 case CT_YXSORTED14:
246 XSetClipRectangles(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
,
247 pGC->clipOrg.x, pGC->clipOrg.y,
248 (XRectangle *) pValue, nRects, YXSorted2);
249 break;
250
251 case CT_YXBANDED18:
252 XSetClipRectangles(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
,
253 pGC->clipOrg.x, pGC->clipOrg.y,
254 (XRectangle *) pValue, nRects, YXBanded3);
255 break;
256 }
257
258 switch (type) {
259 default:
260 break;
261
262 case CT_UNSORTED6:
263 case CT_YSORTED10:
264 case CT_YXSORTED14:
265 case CT_YXBANDED18:
266 /* server clip representation is a region */
267 pGC->clientClip = RegionFromRects(nRects, (xRectangle *) pValue, type);
268 free(pValue);
269 pValue = pGC->clientClip;
270 break;
271 }
272
273 pGC->clientClip = pValue;
274}
275
276void
277xnestDestroyClip(GCPtr pGC)
278{
279 if (pGC->clientClip) {
280 RegionDestroy(pGC->clientClip);
281 XSetClipMask(xnestDisplay, xnestGC(pGC)(((xnestPrivGC *) dixLookupPrivate(&(pGC)->devPrivates
, (&xnestGCPrivateKeyRec)))->gc)
, None0L);
282 pGC->clientClip = NULL((void*)0);
283 }
284}
285
286void
287xnestCopyClip(GCPtr pGCDst, GCPtr pGCSrc)
288{
289 if (pGCSrc->clientClip) {
290 RegionPtr pRgn = RegionCreate(NULL((void*)0), 1);
291 RegionCopy(pRgn, pGCSrc->clientClip);
292 xnestChangeClip(pGCDst, CT_REGION2, pRgn, 0);
293 } else {
294 xnestDestroyClip(pGCDst);
295 }
296}