From patchwork Fri Feb  4 07:52:10 2011
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Check for NULL pointer from pixman_image_create_bits()
Date: Fri, 04 Feb 2011 15:52:10 -0000
From: Bryce Harrington <bryce@canonical.com>
X-Patchwork-Id: 3989
Message-Id: <20110204075209.GA3112@bryceharrington.org>
To: xorg-devel@lists.freedesktop.org

pixman_image_create_bits() can return NULL under a variety of
circumstances.  If this happens, it will segfault when dereferenced in
pixman_image_set_accessors().

http://bugs.freedesktop.org/show_bug.cgi?id=28882
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596155
https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/705078

Signed-off-by: Bryce Harrington <bryce@canonical.com>
Reviewed-by: Soren Sandmann <ssp@redhat.com<

---
fb/fbpict.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/fb/fbpict.c b/fb/fbpict.c
index 7636040..79b462b 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -163,7 +163,8 @@ create_bits_picture (PicturePtr pict,
 	pict->format,
 	pixmap->drawable.width, pixmap->drawable.height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
-    
+    if (!image)
+        return NULL;
     
 #ifdef FB_ACCESS_WRAPPER
 #if FB_SHIFT==5