[PATCH libX11] Add missing NULL checks to ICWrap

Ross Burton ross.burton at intel.com
Mon May 18 06:49:01 PDT 2015


ICWrap.c dereferences the xim parameter passed in from client code without a
NULL check.  I have seen mplayer trigger this resulting in a segfault.  In this
case mplayer had called XOpenIM and NULL was returned which was later passed
into XCreateIC.

Patch originally by Drew Moseley <drew_moseley at mentor.com>.

Signed-off-by: Ross Burton <ross.burton at intel.com>
---
 src/xlibi18n/ICWrap.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/xlibi18n/ICWrap.c b/src/xlibi18n/ICWrap.c
index 8c1b4a0..69f080d 100644
--- a/src/xlibi18n/ICWrap.c
+++ b/src/xlibi18n/ICWrap.c
@@ -169,7 +169,7 @@ XSetIMValues(XIM im, ...)
     va_list var;
     int     total_count;
     XIMArg *args;
-    char   *ret;
+    char   *ret = NULL;
 
     /*
      * so count the stuff dangling here
@@ -185,7 +185,8 @@ XSetIMValues(XIM im, ...)
     _XIMVaToNestedList(var, total_count, &args);
     va_end(var);
 
-    ret = (*im->methods->set_values) (im, args);
+    if (im && im->methods)
+	ret = (*im->methods->set_values) (im, args);
     Xfree(args);
     return ret;
 }
@@ -196,7 +197,7 @@ XGetIMValues(XIM im, ...)
     va_list var;
     int     total_count;
     XIMArg *args;
-    char   *ret;
+    char   *ret = NULL;
 
     /*
      * so count the stuff dangling here
@@ -212,7 +213,8 @@ XGetIMValues(XIM im, ...)
     _XIMVaToNestedList(var, total_count, &args);
     va_end(var);
 
-    ret = (*im->methods->get_values) (im, args);
+    if (im && im->methods)
+	ret = (*im->methods->get_values) (im, args);
     Xfree(args);
     return ret;
 }
@@ -228,7 +230,7 @@ XCreateIC(XIM im, ...)
     va_list var;
     int     total_count;
     XIMArg *args;
-    XIC     ic;
+    XIC     ic = NULL;
 
     /*
      * so count the stuff dangling here
@@ -244,7 +246,8 @@ XCreateIC(XIM im, ...)
     _XIMVaToNestedList(var, total_count, &args);
     va_end(var);
 
-    ic = (XIC) (*im->methods->create_ic) (im, args);
+    if (im && im->methods)
+	ic = (XIC) (*im->methods->create_ic) (im, args);
     Xfree(args);
     if (ic) {
 	ic->core.next = im->core.ic_chain;
-- 
2.1.4



More information about the xorg-devel mailing list