[Spice-devel] udscs: Fix a potential NULL pointer dereference

[Christophe Fergeau]

On Thu, Dec 01, 2016 at 05:19:33AM +0100, Francois Gouget wrote:
> udscs_server_fill_fds() should accept being passed a NULL pointer.

I would reword the commit log a bit, like "udscs_server_fill_fds() is
dereferencing the 'server' pointer, and then checks if it's NULL. This
commit makes sure the NULL check happens first"
I'll amend and push, thanks for the patch!

Acked-by: Christophe Fergeau <cfergeau at redhat.com>


> 
> Signed-off-by: Francois Gouget <fgouget at codeweavers.com>
> ---
>  src/udscs.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/src/udscs.c b/src/udscs.c
> index 414dce5..fdd75a4 100644
> --- a/src/udscs.c
> +++ b/src/udscs.c
> @@ -495,11 +495,12 @@ int udscs_server_fill_fds(struct udscs_server *server, fd_set *readfds,
>          fd_set *writefds)
>  {
>      struct udscs_connection *conn;
> -    int nfds = server->fd + 1;
> +    int nfds;
>  
>      if (!server)
>          return -1;
>  
> +    nfds = server->fd + 1;
>      FD_SET(server->fd, readfds);
>  
>      conn = server->connections_head.next;
> -- 
> 2.10.2
> _______________________________________________
> Spice-devel mailing list
> Spice-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/spice-devel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/spice-devel/attachments/20161201/2152d415/attachment.sig>