[Libva] [libva-intel-driver PATCH] Check pointer returned from calloc()
Xiang, Haihao
haihao.xiang at intel.com
Mon Sep 14 19:15:39 PDT 2015
Signed-off-by: Xiang, Haihao <haihao.xiang at intel.com>
---
src/gen6_mfd.c | 7 +++++++
src/gen6_vme.c | 4 ++++
src/gen75_mfc.c | 3 +++
src/gen7_mfc.c | 3 +++
src/gen8_mfd.c | 11 +++++++++++
src/gen9_mfc_hevc.c | 14 ++++++++------
src/i965_decoder_utils.c | 3 +++
src/i965_drv_video.c | 3 +++
src/i965_post_processing.c | 3 +++
9 files changed, 45 insertions(+), 6 deletions(-)
diff --git a/src/gen6_mfd.c b/src/gen6_mfd.c
index 5ab2db0..ed4829c 100755
--- a/src/gen6_mfd.c
+++ b/src/gen6_mfd.c
@@ -1184,6 +1184,10 @@ gen6_mfd_init_vc1_surface(VADriverContextP ctx,
if (!gen6_vc1_surface) {
gen6_vc1_surface = calloc(sizeof(struct gen6_vc1_surface), 1);
+
+ if (!gen6_vc1_surface)
+ return;
+
assert((obj_surface->size & 0x3f) == 0);
obj_surface->private_data = gen6_vc1_surface;
}
@@ -1854,6 +1858,9 @@ gen6_dec_hw_context_init(VADriverContextP ctx, struct object_config *obj_config)
struct gen6_mfd_context *gen6_mfd_context = calloc(1, sizeof(struct gen6_mfd_context));
int i;
+ if (!gen6_mfd_context)
+ return NULL;
+
gen6_mfd_context->base.destroy = gen6_mfd_context_destroy;
gen6_mfd_context->base.run = gen6_mfd_decode_picture;
gen6_mfd_context->base.batch = intel_batchbuffer_new(intel, I915_EXEC_RENDER, 0);
diff --git a/src/gen6_vme.c b/src/gen6_vme.c
index 2e02591..07e353e 100644
--- a/src/gen6_vme.c
+++ b/src/gen6_vme.c
@@ -636,6 +636,10 @@ Bool gen6_vme_context_init(VADriverContextP ctx, struct intel_encoder_context *e
}
vme_context = calloc(1, sizeof(struct gen6_vme_context));
+
+ if (!vme_context)
+ return False;
+
vme_context->gpe_context.surface_state_binding_table.length =
(SURFACE_STATE_PADDED_SIZE + sizeof(unsigned int)) * MAX_MEDIA_SURFACES_GEN6;
diff --git a/src/gen75_mfc.c b/src/gen75_mfc.c
index 0985215..b6b18ea 100644
--- a/src/gen75_mfc.c
+++ b/src/gen75_mfc.c
@@ -2541,6 +2541,9 @@ Bool gen75_mfc_context_init(VADriverContextP ctx, struct intel_encoder_context *
{
struct gen6_mfc_context *mfc_context = calloc(1, sizeof(struct gen6_mfc_context));
+ if (!mfc_context)
+ return False;
+
mfc_context->gpe_context.surface_state_binding_table.length = (SURFACE_STATE_PADDED_SIZE + sizeof(unsigned int)) * MAX_MEDIA_SURFACES_GEN6;
mfc_context->gpe_context.idrt.max_entries = MAX_GPE_KERNELS;
diff --git a/src/gen7_mfc.c b/src/gen7_mfc.c
index 78b1096..2c17779 100644
--- a/src/gen7_mfc.c
+++ b/src/gen7_mfc.c
@@ -1130,6 +1130,9 @@ gen7_mfc_context_init(VADriverContextP ctx, struct intel_encoder_context *encode
{
struct gen6_mfc_context *mfc_context = calloc(1, sizeof(struct gen6_mfc_context));
+ if (!mfc_context)
+ return False;
+
mfc_context->gpe_context.surface_state_binding_table.length = (SURFACE_STATE_PADDED_SIZE + sizeof(unsigned int)) * MAX_MEDIA_SURFACES_GEN6;
mfc_context->gpe_context.idrt.max_entries = MAX_GPE_KERNELS;
diff --git a/src/gen8_mfd.c b/src/gen8_mfd.c
index 2d650a3..23eaca3 100644
--- a/src/gen8_mfd.c
+++ b/src/gen8_mfd.c
@@ -74,6 +74,10 @@ gen8_mfd_init_avc_surface(VADriverContextP ctx,
if (!gen7_avc_surface) {
gen7_avc_surface = calloc(sizeof(GenAvcSurface), 1);
+
+ if (!gen7_avc_surface)
+ return;
+
gen7_avc_surface->base.frame_store_id = -1;
assert((obj_surface->size & 0x3f) == 0);
obj_surface->private_data = gen7_avc_surface;
@@ -1273,6 +1277,10 @@ gen8_mfd_init_vc1_surface(VADriverContextP ctx,
if (!gen7_vc1_surface) {
gen7_vc1_surface = calloc(sizeof(struct gen7_vc1_surface), 1);
+
+ if (!gen7_vc1_surface)
+ return;
+
assert((obj_surface->size & 0x3f) == 0);
obj_surface->private_data = gen7_vc1_surface;
}
@@ -3173,6 +3181,9 @@ gen8_dec_hw_context_init(VADriverContextP ctx, struct object_config *obj_config)
struct gen7_mfd_context *gen7_mfd_context = calloc(1, sizeof(struct gen7_mfd_context));
int i;
+ if (!gen7_mfd_context)
+ return NULL;
+
gen7_mfd_context->base.destroy = gen8_mfd_context_destroy;
gen7_mfd_context->base.run = gen8_mfd_decode_picture;
gen7_mfd_context->base.batch = intel_batchbuffer_new(intel, I915_EXEC_RENDER, 0);
diff --git a/src/gen9_mfc_hevc.c b/src/gen9_mfc_hevc.c
index 6a7ce84..272479e 100644
--- a/src/gen9_mfc_hevc.c
+++ b/src/gen9_mfc_hevc.c
@@ -2028,12 +2028,14 @@ VAStatus intel_hcpe_hevc_prepare(VADriverContextP ctx,
hevc_encoder_surface = calloc(sizeof(GenHevcSurface), 1);
- hevc_encoder_surface->motion_vector_temporal_bo =
- dri_bo_alloc(i965->intel.bufmgr,
- "motion vector temporal buffer",
- size,
- 0x1000);
- assert(hevc_encoder_surface->motion_vector_temporal_bo);
+ if (hevc_encoder_surface) {
+ hevc_encoder_surface->motion_vector_temporal_bo =
+ dri_bo_alloc(i965->intel.bufmgr,
+ "motion vector temporal buffer",
+ size,
+ 0x1000);
+ assert(hevc_encoder_surface->motion_vector_temporal_bo);
+ }
obj_surface->private_data = (void *)hevc_encoder_surface;
obj_surface->free_private_data = (void *)gen_free_hevc_surface;
diff --git a/src/i965_decoder_utils.c b/src/i965_decoder_utils.c
index a50f800..3085a56 100644
--- a/src/i965_decoder_utils.c
+++ b/src/i965_decoder_utils.c
@@ -587,6 +587,9 @@ intel_update_codec_frame_store_index(
uint64_t age;
int i, n, num_free_refs;
+ if (!free_refs)
+ return;
+
/* Detect changes of access unit */
if (fs_ctx->age == 0 || fs_ctx->prev_poc != poc)
fs_ctx->age++;
diff --git a/src/i965_drv_video.c b/src/i965_drv_video.c
index 1f4c322..d990691 100644
--- a/src/i965_drv_video.c
+++ b/src/i965_drv_video.c
@@ -2034,6 +2034,9 @@ i965_CreateContext(VADriverContextP ctx,
obj_context->hw_context = NULL;
obj_context->wrapper_context = VA_INVALID_ID;
+ if (!obj_context->render_targets)
+ return VA_STATUS_ERROR_ALLOCATION_FAILED;
+
for(i = 0; i < num_render_targets; i++) {
if (NULL == SURFACE(render_targets[i])) {
vaStatus = VA_STATUS_ERROR_INVALID_SURFACE;
diff --git a/src/i965_post_processing.c b/src/i965_post_processing.c
index 75b1514..491234b 100755
--- a/src/i965_post_processing.c
+++ b/src/i965_post_processing.c
@@ -6075,6 +6075,9 @@ i965_proc_context_init(VADriverContextP ctx, struct object_config *obj_config)
struct intel_driver_data *intel = intel_driver_data(ctx);
struct i965_proc_context *proc_context = calloc(1, sizeof(struct i965_proc_context));
+ if (!proc_context)
+ return NULL;
+
proc_context->base.destroy = i965_proc_context_destroy;
proc_context->base.run = i965_proc_picture;
proc_context->base.batch = intel_batchbuffer_new(intel, I915_EXEC_RENDER, 0);
--
1.9.1
More information about the Libva
mailing list