diff options
author | pingshix <pingx.shi@intel.com> | 2012-12-27 16:35:34 +0800 |
---|---|---|
committer | cactus <cactus@intel.com> | 2013-01-16 21:10:58 -0800 |
commit | 2687b6fb4c688fd1d045527aa48692c9db1ab141 (patch) | |
tree | 03d3929d885201e0238633c1b85bae4dff97b565 /va | |
parent | 7ce177f53f4c28c5fefb9259e106fc5a72f65b5e (diff) | |
download | libva-2687b6fb4c688fd1d045527aa48692c9db1ab141.tar.gz |
Fix libva klocwork issue
BZ: 77254
Fix NULL pointer dereference risk issues
Change-Id: Ib125c13c1d698d9105fbe4235355769c04f4da39
Signed-off-by: Elaine Wang <elaine.wang@intel.com>
Signed-off-by: pingshix <pingx.shi@intel.com>
Reviewed-on: http://android.intel.com:8080/83996
Reviewed-by: Yuan, Shengquan <shengquan.yuan@intel.com>
Reviewed-by: cactus <cactus@intel.com>
Tested-by: cactus <cactus@intel.com>
Diffstat (limited to 'va')
-rwxr-xr-x | va/va.c | 12 | ||||
-rw-r--r-- | va/va_fool.c | 28 | ||||
-rwxr-xr-x | va/va_trace.c | 4 |
3 files changed, 25 insertions, 19 deletions
@@ -87,10 +87,10 @@ int va_parseConfig(char *env, char *env_value) fclose(fp); /* no setting in config file, use env setting */ - if (getenv(env)) { + value = getenv(env); + if (value) { if (env_value) - strncpy(env_value, getenv(env), 1024); - + strncpy(env_value, value, 1024); return 0; } @@ -185,6 +185,12 @@ static VAStatus va_openDriver(VADisplay dpy, char *driver_name) char *driver_path = (char *) malloc( strlen(driver_dir) + strlen(driver_name) + strlen(DRIVER_EXTENSION) + 2 ); + if (!driver_path) { + va_errorMessage("%s L%d Out of memory!n", + __FUNCTION__, __LINE__); + return VA_STATUS_ERROR_ALLOCATION_FAILED; + } + strncpy( driver_path, driver_dir, strlen(driver_dir) + 1); strncat( driver_path, "/", strlen("/") ); strncat( driver_path, driver_name, strlen(driver_name) ); diff --git a/va/va_fool.c b/va/va_fool.c index 94b4c0b..3c7161b 100644 --- a/va/va_fool.c +++ b/va/va_fool.c @@ -32,6 +32,7 @@ #include <stdarg.h> #include <stdlib.h> #include <stdio.h> +#include <errno.h> #include <string.h> #include <dlfcn.h> #include <unistd.h> @@ -50,7 +51,7 @@ * . if set, decode does nothing * LIBVA_FOOL_ENCODE=<framename>: * . if set, encode does nothing, but fill in the coded buffer from the content of files with - * name framename.0,framename.1,framename.2, ..., framename.N, framename.N,framename.N,... + * name framename.0,framename.1,..., framename.N, framename.0,..., framename.N,...repeatly * LIBVA_FOOL_JPEG=<framename>:fill the content of filename to codedbuf for jpeg encoding * LIBVA_FOOL_POSTP: * . if set, do nothing for vaPutSurface @@ -256,31 +257,30 @@ VAStatus va_FoolBufferInfo( static int va_FoolFillCodedBufEnc(int idx) { char file_name[1024]; - struct stat file_stat; + struct stat file_stat = {0}; VACodedBufferSegment *codedbuf; int i, fd = -1; /* try file_name.file_count, if fail, try file_name.file_count-- */ for (i=0; i<=1; i++) { snprintf(file_name, 1024, "%s.%d", - fool_context[idx].fn_enc, - fool_context[idx].file_count); + fool_context[idx].fn_enc, + fool_context[idx].file_count); if ((fd = open(file_name, O_RDONLY)) != -1) { fstat(fd, &file_stat); fool_context[idx].file_count++; /* open next file */ break; - } - - fool_context[idx].file_count--; /* fall back to previous file */ - if (fool_context[idx].file_count < 0) + } else /* fall back to the first file file */ fool_context[idx].file_count = 0; } if (fd != -1) { fool_context[idx].segbuf_enc = realloc(fool_context[idx].segbuf_enc, file_stat.st_size); read(fd, fool_context[idx].segbuf_enc, file_stat.st_size); close(fd); - } + } else + va_errorMessage("Open file %s failed:%s\n", file_name, strerror(errno)); + codedbuf = (VACodedBufferSegment *)fool_context[idx].fool_buf[VAEncCodedBufferType]; codedbuf->size = file_stat.st_size; codedbuf->bit_offset = 0; @@ -295,18 +295,18 @@ static int va_FoolFillCodedBufEnc(int idx) static int va_FoolFillCodedBufJPG(int idx) { - struct stat file_stat; + struct stat file_stat = {0}; VACodedBufferSegment *codedbuf; int i, fd = -1; - if ((fd = open(fool_context[idx].fn_jpg, O_RDONLY)) != -1) + if ((fd = open(fool_context[idx].fn_jpg, O_RDONLY)) != -1) { fstat(fd, &file_stat); - - if (fd != -1) { fool_context[idx].segbuf_jpg = realloc(fool_context[idx].segbuf_jpg, file_stat.st_size); read(fd, fool_context[idx].segbuf_jpg, file_stat.st_size); close(fd); - } + } else + va_errorMessage("Open file %s failed:%s\n", fool_context[idx].fn_jpg, strerror(errno)); + codedbuf = (VACodedBufferSegment *)fool_context[idx].fool_buf[VAEncCodedBufferType]; codedbuf->size = file_stat.st_size; codedbuf->bit_offset = 0; diff --git a/va/va_trace.c b/va/va_trace.c index b06c400..8c2c684 100755 --- a/va/va_trace.c +++ b/va/va_trace.c @@ -1088,12 +1088,12 @@ static void va_TraceVASliceParameterBufferH264( if (p->slice_type == 0 || p->slice_type == 1) { va_TraceMsg(idx, "\tRefPicList0 ="); - for (i = 0; i < p->num_ref_idx_l0_active_minus1 + 1; i++) { + for (i = 0; (i < p->num_ref_idx_l0_active_minus1 + 1 && i < 32); i++) { va_TraceMsg(idx, "%d-%d-0x%08x-%d\n", p->RefPicList0[i].TopFieldOrderCnt, p->RefPicList0[i].BottomFieldOrderCnt, p->RefPicList0[i].picture_id, p->RefPicList0[i].frame_idx); } if (p->slice_type == 1) { va_TraceMsg(idx, "\tRefPicList1 ="); - for (i = 0; i < p->num_ref_idx_l1_active_minus1 + 1; i++) + for (i = 0; (i < p->num_ref_idx_l1_active_minus1 + 1 && i < 32); i++) { va_TraceMsg(idx, "%d-%d-0x%08x-%d\n", p->RefPicList1[i].TopFieldOrderCnt, p->RefPicList1[i].BottomFieldOrderCnt, p->RefPicList1[i].picture_id, p->RefPicList1[i].frame_idx); } |