[PATCH libdrm] intel: avoid null pointer dereference

[Eric Engestrom]

On Tuesday, 2017-02-07 15:59:32 +0100, Thomas H.P. Andersen wrote:
> On Fri, Feb 3, 2017 at 11:57 AM, Eric Engestrom
> <eric.engestrom at imgtec.com> wrote:
> >
> > On Thursday, 2017-02-02 23:57:29 +0100, Thomas Hindoe Paaboel Andersen wrote:
> > > Introduced in 028715ee
> > >
> > > Move the dereference after the null check.
> >
> > Fixes: 028715ee707469189505 ("intel: Avoid the need for most overflow
> >                               checks by using a scratch page.")
> > Reviewed-by: Eric Engestrom <eric.engestrom at imgtec.com>
> 
> Thanks. I do not have commit access. Can I ask you to push it?

I actually don't have commit access to libdrm either :)

Emil, can you push this (and the autogen patches)?

Cheers,
  Eric

> 
> >
> > > ---
> > >  intel/intel_decode.c | 3 ++-
> > >  1 file changed, 2 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/intel/intel_decode.c b/intel/intel_decode.c
> > > index 803d202..2721ffd 100644
> > > --- a/intel/intel_decode.c
> > > +++ b/intel/intel_decode.c
> > > @@ -3899,7 +3899,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > >       int ret;
> > >       unsigned int index = 0;
> > >       uint32_t devid;
> > > -     int size = ctx->base_count * 4;
> > > +     int size;
> > >       void *temp;
> > >
> > >       if (!ctx)
> > > @@ -3909,6 +3909,7 @@ drm_intel_decode(struct drm_intel_decode *ctx)
> > >        * the batchbuffer.  This lets us avoid a bunch of length
> > >        * checking in statically sized packets.
> > >        */
> > > +     size = ctx->base_count * 4;
> > >       temp = malloc(size + 4096);
> > >       memcpy(temp, ctx->base_data, size);
> > >       memset((char *)temp + size, 0xd0, 4096);
> > > --
> > > 2.9.3
> > >