From: Jean-Philippe Andre <jp.andre@samsung.com>
Date: Fri, 23 Sep 2016 08:28:57 +0000 (+0900)
Subject: evas_fb: Avoid invalid dereference
X-Git-Tag: upstream/1.20.0~4229
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=d7b9db44f0de6ac15fef6e7bd218a198b4ee0370;p=platform%2Fupstream%2Fefl.git

evas_fb: Avoid invalid dereference

If buf->priv.fb.fb was NULL the function would have crashed. So
buf->priv.fb.fb can't be NULL. I'm keeping the if(buf->priv.fb.fb)
anyway, but not sure the else case is valid.

Thanks @jiin.moon for the report.
---

diff --git a/src/modules/evas/engines/fb/evas_outbuf.c b/src/modules/evas/engines/fb/evas_outbuf.c
index 1cb94ad..7727428 100644
--- a/src/modules/evas/engines/fb/evas_outbuf.c
+++ b/src/modules/evas/engines/fb/evas_outbuf.c
@@ -365,7 +365,7 @@ void
 evas_fb_outbuf_fb_reconfigure(Outbuf *buf, int w, int h, int rot, Outbuf_Depth depth)
 {
    int have_backbuf = 0;
-   int fb_w, fb_h, fb_depth, refresh;
+   int fb_w, fb_h, fb_depth;
 
    if ((w == buf->w) && (h == buf->h) &&
        (rot == buf->rot) && (depth == buf->depth))
@@ -378,7 +378,6 @@ evas_fb_outbuf_fb_reconfigure(Outbuf *buf, int w, int h, int rot, Outbuf_Depth d
      }
 
    fb_depth = _outbuf_depth_convert(depth);
-   refresh = buf->priv.fb.fb->refresh;
 
    if (rot == 0 || rot == 180)
      {
@@ -393,9 +392,9 @@ evas_fb_outbuf_fb_reconfigure(Outbuf *buf, int w, int h, int rot, Outbuf_Depth d
 
    if (buf->priv.fb.fb)
      buf->priv.fb.fb = fb_changemode(buf->priv.fb.fb, fb_w, fb_h,
-                                        fb_depth, refresh);
+                                     fb_depth, buf->priv.fb.fb->refresh);
    else
-     buf->priv.fb.fb = fb_setmode(fb_w, fb_h, fb_depth, refresh);
+     buf->priv.fb.fb = fb_setmode(fb_w, fb_h, fb_depth, 0);
 
    if (!buf->priv.fb.fb) buf->priv.fb.fb = fb_getmode();
    EINA_SAFETY_ON_NULL_RETURN(buf->priv.fb.fb);