| File: | src/PolyTxt.c |
| Location: | line 199, column 13 |
| Description: | Dereference of null pointer (loaded from variable 'tbuf') |
| 1 | /* | |||
| 2 | ||||
| 3 | Copyright 1986, 1998 The Open Group | |||
| 4 | ||||
| 5 | Permission to use, copy, modify, distribute, and sell this software and its | |||
| 6 | documentation for any purpose is hereby granted without fee, provided that | |||
| 7 | the above copyright notice appear in all copies and that both that | |||
| 8 | copyright notice and this permission notice appear in supporting | |||
| 9 | documentation. | |||
| 10 | ||||
| 11 | The above copyright notice and this permission notice shall be included in | |||
| 12 | all copies or substantial portions of the Software. | |||
| 13 | ||||
| 14 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | |||
| 15 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |||
| 16 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | |||
| 17 | OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN | |||
| 18 | AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN | |||
| 19 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | |||
| 20 | ||||
| 21 | Except as contained in this notice, the name of The Open Group shall not be | |||
| 22 | used in advertising or otherwise to promote the sale, use or other dealings | |||
| 23 | in this Software without prior written authorization from The Open Group. | |||
| 24 | ||||
| 25 | */ | |||
| 26 | ||||
| 27 | #ifdef HAVE_CONFIG_H1 | |||
| 28 | #include <config.h> | |||
| 29 | #endif | |||
| 30 | #include "Xlibint.h" | |||
| 31 | ||||
| 32 | int | |||
| 33 | XDrawText( | |||
| 34 | register Display *dpy, | |||
| 35 | Drawable d, | |||
| 36 | GC gc, | |||
| 37 | int x, | |||
| 38 | int y, | |||
| 39 | XTextItem *items, | |||
| 40 | int nitems) | |||
| 41 | { | |||
| 42 | register int i; | |||
| 43 | register XTextItem *item; | |||
| 44 | int length = 0; | |||
| 45 | register xPolyText8Req *req; | |||
| 46 | ||||
| 47 | LockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->lock_display )(dpy); | |||
| 48 | FlushGC(dpy, gc)if ((gc)->dirty) _XFlushGCCache((dpy), (gc)); | |||
| 49 | GetReq (PolyText8, req)req = (xPolyText8Req *) _XGetRequest(dpy, 74, 16); | |||
| 50 | req->drawable = d; | |||
| 51 | req->gc = gc->gid; | |||
| 52 | req->x = x; | |||
| 53 | req->y = y; | |||
| 54 | ||||
| 55 | item = items; | |||
| 56 | for (i=0; i < nitems; i++) { | |||
| ||||
| 57 | if (item->font) | |||
| 58 | length += 5; /* a 255 byte, plus size of Font id */ | |||
| 59 | if (item->delta) | |||
| 60 | { | |||
| 61 | if (item->delta > 0) | |||
| 62 | { | |||
| 63 | length += SIZEOF(xTextElt)2 * ((item->delta + 126) / 127); | |||
| 64 | } | |||
| 65 | else | |||
| 66 | { | |||
| 67 | length += SIZEOF(xTextElt)2 * ((-item->delta + 127) / 128); | |||
| 68 | } | |||
| 69 | } | |||
| 70 | if (item->nchars > 0) | |||
| 71 | { | |||
| 72 | length += SIZEOF(xTextElt)2 * ((item->nchars + 253) / 254 - 1); | |||
| 73 | if (!item->delta) length += SIZEOF(xTextElt)2; | |||
| 74 | length += item->nchars; | |||
| 75 | } | |||
| 76 | item++; | |||
| 77 | } | |||
| 78 | ||||
| 79 | req->length += (length + 3)>>2; /* convert to number of 32-bit words */ | |||
| 80 | ||||
| 81 | ||||
| 82 | /* | |||
| 83 | * If the entire request does not fit into the remaining space in the | |||
| 84 | * buffer, flush the buffer first. If the request does fit into the | |||
| 85 | * empty buffer, then we won't have to flush it at the end to keep | |||
| 86 | * the buffer 32-bit aligned. | |||
| 87 | */ | |||
| 88 | ||||
| 89 | if (dpy->bufptr + length > dpy->bufmax) | |||
| 90 | _XFlush (dpy); | |||
| 91 | ||||
| 92 | item = items; | |||
| 93 | for (i=0; i< nitems; i++) { | |||
| 94 | ||||
| 95 | if (item->font) { | |||
| 96 | /* to mark a font shift, write a 255 byte followed by | |||
| 97 | the 4 bytes of font ID, big-end first */ | |||
| 98 | register unsigned char *f; | |||
| 99 | BufAlloc (unsigned char *, f, 5)if (dpy->bufptr + (5) > dpy->bufmax) _XFlush (dpy); f = (unsigned char *) dpy->bufptr; __builtin___memset_chk ( f, '\0', 5, __builtin_object_size (f, 0)); dpy->bufptr += ( 5);; | |||
| 100 | ||||
| 101 | f[0] = 255; | |||
| 102 | f[1] = (item->font & 0xff000000) >> 24; | |||
| 103 | f[2] = (item->font & 0x00ff0000) >> 16; | |||
| 104 | f[3] = (item->font & 0x0000ff00) >> 8; | |||
| 105 | f[4] = item->font & 0x000000ff; | |||
| 106 | ||||
| 107 | /* update GC shadow */ | |||
| 108 | gc->values.font = item->font; | |||
| 109 | } | |||
| 110 | ||||
| 111 | { | |||
| 112 | int nbytes = SIZEOF(xTextElt)2; | |||
| 113 | int PartialNChars = item->nchars; | |||
| 114 | int PartialDelta = item->delta; | |||
| 115 | /* register xTextElt *elt; */ | |||
| 116 | int FirstTimeThrough = True1; | |||
| 117 | char *CharacterOffset = item->chars; | |||
| 118 | char *tbuf = NULL((void*)0); | |||
| 119 | ||||
| 120 | while((PartialDelta < -128) || (PartialDelta > 127)) | |||
| 121 | { | |||
| 122 | int nb = SIZEOF(xTextElt)2; | |||
| 123 | ||||
| 124 | BufAlloc (char *, tbuf, nb)if (dpy->bufptr + (nb) > dpy->bufmax) _XFlush (dpy); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nb, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nb);; | |||
| 125 | *tbuf = 0; /* elt->len */ | |||
| 126 | if (PartialDelta > 0 ) | |||
| 127 | { | |||
| 128 | *(tbuf+1) = 127; /* elt->delta */ | |||
| 129 | PartialDelta = PartialDelta - 127; | |||
| 130 | } | |||
| 131 | else | |||
| 132 | { | |||
| 133 | /* -128 = 0x8, need to be careful of signed chars... */ | |||
| 134 | *((unsigned char *)(tbuf+1)) = 0x80; /* elt->delta */ | |||
| 135 | PartialDelta = PartialDelta + 128; | |||
| 136 | } | |||
| 137 | } | |||
| 138 | if (PartialDelta) | |||
| 139 | { | |||
| 140 | BufAlloc (char *, tbuf , nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
| 141 | *tbuf = 0; /* elt->len */ | |||
| 142 | *(tbuf+1) = PartialDelta; /* elt->delta */ | |||
| 143 | } | |||
| 144 | while(PartialNChars > 254) | |||
| 145 | { | |||
| 146 | nbytes = 254; | |||
| 147 | if (FirstTimeThrough) | |||
| 148 | { | |||
| 149 | FirstTimeThrough = False0; | |||
| 150 | if (!item->delta) | |||
| 151 | { | |||
| 152 | nbytes += SIZEOF(xTextElt)2; | |||
| 153 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
| 154 | *(tbuf+1) = 0; /* elt->delta */ | |||
| 155 | } | |||
| 156 | else | |||
| 157 | { | |||
| 158 | char *DummyChar; | |||
| 159 | BufAlloc(char *, DummyChar, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); DummyChar = (char *) dpy->bufptr; __builtin___memset_chk (DummyChar, '\0', nbytes, __builtin_object_size (DummyChar, 0 )); dpy->bufptr += (nbytes);; | |||
| 160 | } | |||
| 161 | } | |||
| 162 | else | |||
| 163 | { | |||
| 164 | nbytes += SIZEOF(xTextElt)2; | |||
| 165 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
| 166 | *(tbuf+1) = 0; /* elt->delta */ | |||
| 167 | } | |||
| 168 | /* watch out for signs on chars */ | |||
| 169 | *(unsigned char *)tbuf = 254; /* elt->len */ | |||
| 170 | memcpy (tbuf+2 , CharacterOffset, 254)__builtin___memcpy_chk (tbuf+2, CharacterOffset, 254, __builtin_object_size (tbuf+2, 0)); | |||
| 171 | PartialNChars = PartialNChars - 254; | |||
| 172 | CharacterOffset += 254; | |||
| 173 | ||||
| 174 | } | |||
| 175 | if (PartialNChars) | |||
| 176 | { | |||
| 177 | nbytes = PartialNChars; | |||
| 178 | if (FirstTimeThrough) | |||
| 179 | { | |||
| 180 | FirstTimeThrough = False0; | |||
| 181 | if (!item->delta) | |||
| 182 | { | |||
| 183 | nbytes += SIZEOF(xTextElt)2; | |||
| 184 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
| 185 | *(tbuf+1) = 0; /* elt->delta */ | |||
| 186 | } | |||
| 187 | else | |||
| 188 | { | |||
| 189 | char *DummyChar; | |||
| 190 | BufAlloc(char *, DummyChar, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); DummyChar = (char *) dpy->bufptr; __builtin___memset_chk (DummyChar, '\0', nbytes, __builtin_object_size (DummyChar, 0 )); dpy->bufptr += (nbytes);; | |||
| 191 | } | |||
| 192 | } | |||
| 193 | else | |||
| 194 | { | |||
| 195 | nbytes += SIZEOF(xTextElt)2; | |||
| 196 | BufAlloc (char *, tbuf, nbytes)if (dpy->bufptr + (nbytes) > dpy->bufmax) _XFlush (dpy ); tbuf = (char *) dpy->bufptr; __builtin___memset_chk (tbuf , '\0', nbytes, __builtin_object_size (tbuf, 0)); dpy->bufptr += (nbytes);; | |||
| 197 | *(tbuf+1) = 0; /* elt->delta */ | |||
| 198 | } | |||
| 199 | *tbuf = PartialNChars; /* elt->len */ | |||
| ||||
| 200 | memcpy (tbuf+2 , CharacterOffset, PartialNChars)__builtin___memcpy_chk (tbuf+2, CharacterOffset, PartialNChars , __builtin_object_size (tbuf+2, 0)); | |||
| 201 | } | |||
| 202 | } | |||
| 203 | item++; | |||
| 204 | } | |||
| 205 | ||||
| 206 | /* Pad request out to a 32-bit boundary */ | |||
| 207 | ||||
| 208 | if (length &= 3) { | |||
| 209 | char *pad; | |||
| 210 | /* | |||
| 211 | * BufAlloc is a macro that uses its last argument more than | |||
| 212 | * once, otherwise I'd write "BufAlloc (char *, pad, 4-length)" | |||
| 213 | */ | |||
| 214 | length = 4 - length; | |||
| 215 | BufAlloc (char *, pad, length)if (dpy->bufptr + (length) > dpy->bufmax) _XFlush (dpy ); pad = (char *) dpy->bufptr; __builtin___memset_chk (pad , '\0', length, __builtin_object_size (pad, 0)); dpy->bufptr += (length);; | |||
| 216 | /* | |||
| 217 | * if there are 3 bytes of padding, the first byte MUST be 0 | |||
| 218 | * so the pad bytes aren't mistaken for a final xTextElt | |||
| 219 | */ | |||
| 220 | *pad = 0; | |||
| 221 | } | |||
| 222 | ||||
| 223 | /* | |||
| 224 | * If the buffer pointer is not now pointing to a 32-bit boundary, | |||
| 225 | * we must flush the buffer so that it does point to a 32-bit boundary | |||
| 226 | * at the end of this routine. | |||
| 227 | */ | |||
| 228 | ||||
| 229 | if ((dpy->bufptr - dpy->buffer) & 3) | |||
| 230 | _XFlush (dpy); | |||
| 231 | UnlockDisplay(dpy)if ((dpy)->lock_fns) (*(dpy)->lock_fns->unlock_display )(dpy); | |||
| 232 | SyncHandle()if (dpy->synchandler) (*dpy->synchandler)(dpy); | |||
| 233 | return 0; | |||
| 234 | } |