From 969d9f15369b577ba5b8cd29c1e818e6e7e0c2ca Mon Sep 17 00:00:00 2001 From: Junkyeong Kim Date: Mon, 22 Aug 2016 21:32:48 +0900 Subject: [PATCH] avoid dereference null, fix memory leak Change-Id: I8981af9e4b1dd888382cd52d9cc5e17c536329d2 Signed-off-by: Junkyeong Kim --- src/tdm.c | 6 ++++++ src/tdm_monitor_server.c | 8 ++++++++ tools/tdm_test_server.c | 28 ++++++++++++++++++++++------ 3 files changed, 36 insertions(+), 6 deletions(-) diff --git a/src/tdm.c b/src/tdm.c index 371553d..3f6388c 100644 --- a/src/tdm.c +++ b/src/tdm.c @@ -966,6 +966,11 @@ tdm_display_deinit(tdm_display *dpy) free(private_display); g_private_display = NULL; + if (tdm_debug_dump_dir) { + free(tdm_debug_dump_dir); + tdm_debug_dump_dir = NULL; + } + _pthread_mutex_unlock(&gLock); TDM_INFO("done"); @@ -1047,6 +1052,7 @@ tdm_display_enable_dump(tdm_private_display *private_display, const char *dump_s snprintf(temp, sizeof(temp), "%s", dump_str); arg = strtok_r(temp, ",", &end); + TDM_GOTO_IF_FAIL(arg != NULL, done); if (!strncmp(arg, "none", 4)) { tdm_debug_dump = 0; diff --git a/src/tdm_monitor_server.c b/src/tdm_monitor_server.c index c5bda95..25874ab 100644 --- a/src/tdm_monitor_server.c +++ b/src/tdm_monitor_server.c @@ -195,6 +195,10 @@ _tdm_monitor_server_prop(unsigned int pid, char *cwd, int argc, char *argv[], ch arg = end + 1; prop_name = strtok_r(arg, ",", &end); + if (!prop_name) { + TDM_SNPRINTF(reply, len, "failed: get prop_name by strtok_r\n"); + return; + } if (*end == '\0') { TDM_SNPRINTF(reply, len, "failed: no value\n"); @@ -202,6 +206,10 @@ _tdm_monitor_server_prop(unsigned int pid, char *cwd, int argc, char *argv[], ch } arg = strtok_r(NULL, TDM_DELIM, &end); + if (!arg) { + TDM_SNPRINTF(reply, len, "failed: get arg by strtok_r\n"); + return; + } value.u32 = strtol(arg, &end, 10); output = tdm_display_get_output(dpy, output_idx, &ret); diff --git a/tools/tdm_test_server.c b/tools/tdm_test_server.c index 0045be5..d59c6ce 100644 --- a/tools/tdm_test_server.c +++ b/tools/tdm_test_server.c @@ -989,6 +989,8 @@ static void layer_cb_buffer_release(tbm_surface_h b, void *user_data) { tdm_test_server_buffer *tb = get_tts_buffer(b); + TDM_EXIT_IF_FAIL(tb != NULL); + tb->in_use = 0; tdm_buffer_remove_release_handler(b, layer_cb_buffer_release, NULL); if (tb->done) @@ -1083,6 +1085,10 @@ pp_get_buffer(tdm_test_server_pp *p) } for (i = 0; i < size; i++) { tdm_test_server_buffer *tb = get_tts_buffer(p->bufs[i]); + + if (tb == NULL) + continue; + if (!tb->in_use) { tdm_test_buffer_fill(p->bufs[i], p->data->b_fill); return p->bufs[i]; @@ -1169,10 +1175,16 @@ pp_cb_timeout(void *user_data) static void pp_setup(tdm_test_server_pp *p, tbm_surface_h sb, tbm_surface_h db) { - tdm_test_server *data = p->l->o->data; + tdm_test_server *data; tbm_surface_info_s info; tdm_error ret; + if (!p || !p->l || !p->l->o || !p->l->o->data) { + TDM_ERR("invalid parameter failed"); + exit(0); + } + data = p->l->o->data; + p->pp = tdm_display_create_pp(data->display, &ret); TDM_EXIT_IF_FAIL(ret == TDM_ERROR_NONE); @@ -1209,8 +1221,7 @@ pp_setup(tdm_test_server_pp *p, tbm_surface_h sb, tbm_surface_h db) printf(" ! "); print_config(&p->info.dst_config); printf(" fps(%d) transform(%s)\n", p->fps, tdm_transform_str(p->info.transform)); - if (p->l) - printf("\toutput_idx(%d) layer_idx(%d)\n", p->l->o->idx, p->l->idx); + printf("\toutput_idx(%d) layer_idx(%d)\n", p->l->o->idx, p->l->idx); layer_setup(p->l, db); @@ -1282,12 +1293,18 @@ capture_attach(tdm_test_server_capture *c, tbm_surface_h b) static void capture_setup(tdm_test_server_capture *c, tbm_surface_h b) { - tdm_test_server *data = c->l->o->data; + tdm_test_server *data; tdm_output *output; tdm_layer *layer; tbm_surface_info_s info; tdm_error ret; + if (!c || !c->l || !c->l->o || !c->l->o->data) { + TDM_ERR("invalid parameter failed"); + exit(0); + } + data = c->l->o->data; + if (c->output_idx != -1 && c->layer_idx == -1) { output = tdm_display_get_output(data->display, c->output_idx, &ret); TDM_EXIT_IF_FAIL(ret == TDM_ERROR_NONE); @@ -1324,8 +1341,7 @@ capture_setup(tdm_test_server_capture *c, tbm_surface_h b) printf("capture: o(%d) l(%d) ", c->output_idx, c->layer_idx); print_config(&c->info.dst_config); printf(" transform(%s)\n", tdm_transform_str(c->info.transform)); - if (c->l) - printf("\toutput_idx(%d) layer_idx(%d)\n", c->l->o->idx, c->l->idx); + printf("\toutput_idx(%d) layer_idx(%d)\n", c->l->o->idx, c->l->idx); layer_setup(c->l, b); } -- 2.7.4