[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#919796: mesa: Segmentation fault in dri2_query_wayland_buffer_wl



Source: mesa
Version: 18.3.2-1
Severity: normal
Tags: patch

Dear Maintainer,

The qtwayland-opensource-src package fails to build from source on hppa
due a segmentation fault in dri2_query_wayland_buffer_wl running the
qtwayland-opensource-src testsuite.  See bug 919197 for details:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919197

The fault occurs because dri2_dpy is NULL and dri2_query_wayland_buffer_wl
fails to check for this circumstance.

The attached patch add NULL pointer checks to dri2_query_wayland_buffer_wl
and dri2_create_image_wayland_wl_buffer.  This fixes the build of
qtwayland-opensource-src.

Please apply or fix the code so NULL display pointers are not used.

Regards,
Dave Anglin

-- System Information:
Debian Release: buster/sid
  APT prefers buildd-unstable
  APT policy: (500, 'buildd-unstable'), (500, 'unstable')
Architecture: hppa (parisc64)

Kernel: Linux 4.14.94+ (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- ./src/egl/drivers/dri2/egl_dri2.c.save	2019-01-15 20:35:09.752730367 -0500
+++ ./src/egl/drivers/dri2/egl_dri2.c	2019-01-15 20:37:32.753145310 -0500
@@ -1931,10 +1931,13 @@
    _EGLImageAttribs attrs;
    int32_t plane;
 
+   if (!dri2_dpy)
+      return NULL;
+     
    buffer = wayland_drm_buffer_get(dri2_dpy->wl_server_drm,
                                    (struct wl_resource *) _buffer);
    if (!buffer)
-       return NULL;
+      return NULL;
 
    if (!_eglParseImageAttribList(&attrs, disp, attr_list))
       return NULL;
@@ -2849,6 +2852,9 @@
    struct wl_drm_buffer *buffer;
    const struct wl_drm_components_descriptor *format;
 
+   if (!dri2_dpy)
+      return EGL_FALSE;
+     
    buffer = wayland_drm_buffer_get(dri2_dpy->wl_server_drm, buffer_resource);
    if (!buffer)
       return EGL_FALSE;

Reply to: