| Message ID | 5F9BE993.4050406@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | hw/display/omap_lcdc: Fix potential NULL pointer dereference | expand |
On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote: > > In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before > being check if it is valid, which may lead to NULL pointer dereference. > So move the assignment to surface after checking that the omap_lcd is valid. > > Reported-by: Euler Robot <euler.robot@huawei.com> > Signed-off-by: Alex Chen <alex.chen@huawei.com> > --- > hw/display/omap_lcdc.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) Applied to target-arm.next, thanks. -- PMM
On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote: > > On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote: > > > > In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before > > being check if it is valid, which may lead to NULL pointer dereference. > > So move the assignment to surface after checking that the omap_lcd is valid. > > > > Reported-by: Euler Robot <euler.robot@huawei.com> > > Signed-off-by: Alex Chen <alex.chen@huawei.com> > > --- > > hw/display/omap_lcdc.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > Applied to target-arm.next, thanks. Whoops, spoke too soon. This doesn't compile: ../../hw/display/omap_lcdc.c: In function ‘omap_update_display’: ../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used uninitialized in this function [-Werror=maybe-uninitialized] !surface_bits_per_pixel(surface)) { ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ because the early exit check if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable || !surface_bits_per_pixel(surface)) { return; } uses 'surface' and this patch moves the initialization of that variable down below its first use. thanks -- PMM
On 2020/10/30 22:35, Peter Maydell wrote: > On Fri, 30 Oct 2020 at 14:29, Peter Maydell <peter.maydell@linaro.org> wrote: >> >> On Fri, 30 Oct 2020 at 10:23, AlexChen <alex.chen@huawei.com> wrote: >>> >>> In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before >>> being check if it is valid, which may lead to NULL pointer dereference. >>> So move the assignment to surface after checking that the omap_lcd is valid. >>> >>> Reported-by: Euler Robot <euler.robot@huawei.com> >>> Signed-off-by: Alex Chen <alex.chen@huawei.com> >>> --- >>> hw/display/omap_lcdc.c | 3 ++- >>> 1 file changed, 2 insertions(+), 1 deletion(-) > >> Applied to target-arm.next, thanks. > > Whoops, spoke too soon. This doesn't compile: > > ../../hw/display/omap_lcdc.c: In function ‘omap_update_display’: > ../../hw/display/omap_lcdc.c:88:10: error: ‘surface’ may be used > uninitialized in this function [-Werror=maybe-uninitialized] > !surface_bits_per_pixel(surface)) { > ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > because the early exit check > if (!omap_lcd || omap_lcd->plm == 1 || !omap_lcd->enable || > !surface_bits_per_pixel(surface)) { > return; > } > > uses 'surface' and this patch moves the initialization of that > variable down below its first use. > Oh, I apologize for this compilation error, I will fix it in my patch v2. Thanks, Alex
diff --git a/hw/display/omap_lcdc.c b/hw/display/omap_lcdc.c index fa4a381db6..2941c5c67c 100644 --- a/hw/display/omap_lcdc.c +++ b/hw/display/omap_lcdc.c @@ -78,7 +78,7 @@ static void omap_lcd_interrupts(struct omap_lcd_panel_s *s) static void omap_update_display(void *opaque) { struct omap_lcd_panel_s *omap_lcd = (struct omap_lcd_panel_s *) opaque; - DisplaySurface *surface = qemu_console_surface(omap_lcd->con); + DisplaySurface *surface; draw_line_func draw_line; int size, height, first, last; int width, linesize, step, bpp, frame_offset; @@ -89,6 +89,7 @@ static void omap_update_display(void *opaque) return; } + surface = qemu_console_surface(omap_lcd->con); frame_offset = 0; if (omap_lcd->plm != 2) { cpu_physical_memory_read(
In omap_lcd_interrupts(), the pointer omap_lcd is dereferenced before being check if it is valid, which may lead to NULL pointer dereference. So move the assignment to surface after checking that the omap_lcd is valid. Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Alex Chen <alex.chen@huawei.com> --- hw/display/omap_lcdc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)