[Mesa-dev] [Mesa-stable] [PATCH] gbm: fix potential NULL deref of mapImage/unmapImage.

[Weng, Chuanbo]

Seems the e-mails are blocked before I subscribe mesa-stable.
So after I subscribe mesa-stable, this e-mail appears in mesa-dev three times.

-----Original Message-----
From: mesa-stable [mailto:mesa-stable-bounces at lists.freedesktop.org] On Behalf Of Chuanbo Weng
Sent: Tuesday, September 6, 2016 5:29 PM
To: mesa-dev at lists.freedesktop.org; emil.l.velikov at gmail.com
Cc: mesa-stable at lists.freedesktop.org; Weng, Chuanbo <chuanbo.weng at intel.com>
Subject: [Mesa-stable] [PATCH] gbm: fix potential NULL deref of mapImage/unmapImage.

The mapImage/unmapImage functions of DRIimage extension can be NULL, so we should add additional check for them.

Cc: <mesa-stable at lists.freedesktop.org>
Signed-off-by: Chuanbo Weng <chuanbo.weng at intel.com>
---
 src/gbm/backends/dri/gbm_dri.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/gbm/backends/dri/gbm_dri.c b/src/gbm/backends/dri/gbm_dri.c index c3626e3..b14faef 100644
--- a/src/gbm/backends/dri/gbm_dri.c
+++ b/src/gbm/backends/dri/gbm_dri.c
@@ -941,7 +941,7 @@ gbm_dri_bo_map(struct gbm_bo *_bo,
       return *map_data;
    }
 
-   if (!dri->image || dri->image->base.version < 12) {
+   if (!dri->image || dri->image->base.version < 12 || 
+ !dri->image->mapImage) {
       errno = ENOSYS;
       return NULL;
    }
@@ -972,7 +972,8 @@ gbm_dri_bo_unmap(struct gbm_bo *_bo, void *map_data)
       return;
    }
 
-   if (!dri->context || !dri->image || dri->image->base.version < 12)
+   if (!dri->context || !dri->image ||
+       dri->image->base.version < 12 || !dri->image->unmapImage)
       return;
 
    dri->image->unmapImage(dri->context, bo->image, map_data);
--
1.9.1

_______________________________________________
mesa-stable mailing list
mesa-stable at lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/mesa-stable