Merge branch 'uli42-pr/pvs_findings' into 3.6.x

nx-X11/programs/Xserver/hw/nxagent/Atoms.c

@@ -385,12 +385,16 @@ static void nxagentExpandCache(void)
 {
   privAtomMapSize += NXAGENT_ATOM_MAP_SIZE_INCREMENT;
 
-  privAtomMap = realloc(privAtomMap, privAtomMapSize * sizeof(AtomMap));
+  AtomMap * newmap = realloc(privAtomMap, privAtomMapSize * sizeof(AtomMap));
 
-  if (privAtomMap == NULL)
+  if (newmap == NULL)
   {
     FatalError("nxagentExpandCache: realloc failed\n");
   }
+  else
+  {
+    privAtomMap = newmap;
+  }
 }
 
 /*
@@ -405,19 +409,23 @@ static void nxagentWriteAtom(Atom local, XlibAtom remote, const char *string)
   #ifdef WARNING
   if (s == NULL)
   {
-    fprintf(stderr, "nxagentWriteAtom: Malloc failed.\n");
+    /* we only warn here, because s being NULL ist not problem, it
+       will only result in NULL being stored in the privAtomMap, which
+       is perfectly legal. */
+    fprintf(stderr, "%s: Malloc failed.\n", __func__);
   }
   #endif
 
   if (privLastAtom == privAtomMapSize)
   {
+    /* will issue a fatal error, therefore no further check here */
     nxagentExpandCache();
   }
 
   privAtomMap[privLastAtom].local = local;
   privAtomMap[privLastAtom].remote = remote;
   privAtomMap[privLastAtom].string = s;
-  privAtomMap[privLastAtom].length = strlen(s);
+  privAtomMap[privLastAtom].length = s ? strlen(s) : 0;
 
   privLastAtom++;
 }

nx-X11/programs/Xserver/hw/nxagent/Colormap.c

@@ -482,7 +482,7 @@ void nxagentResolveColor(unsigned short *pRed, unsigned short *pGreen,
     unsigned int limg = pVisual->ColormapEntries - 1;
     /* rescale to gray then [0..limg] then [0..65535] then rgb bits */
     *pRed = (30L * *pRed + 59L * *pGreen + 11L * *pBlue) / 100;
-    *pRed = ((((*pRed * (limg + 1))) >> 16) * 65535) / limg;
+    *pRed = (((*pRed * (limg + 1)) >> 16) * 65535) / limg;
     *pBlue = *pGreen = *pRed = ((*pRed >> shift) * 65535) / lim;
   }
   else
@@ -573,7 +573,7 @@ Bool nxagentReconnectAllColormap(void *p0)
 
   for (int cid = 0; (cid < MAXCLIENTS) && success; cid++)
   {
-    if (clients[cid] && success)
+    if (clients[cid])
     {
       FindClientResourcesByType(clients[cid], RT_COLORMAP, nxagentReconnectColormap, &success);
     }

nx-X11/programs/Xserver/hw/nxagent/Display.c

@@ -2576,13 +2576,19 @@ Bool nxagentReconnectDisplay(void *p0)
 
   nxagentNumDefaultColormaps = nxagentNumVisuals;
 
-  nxagentDefaultColormaps = (Colormap *) realloc(nxagentDefaultColormaps,
+  {
+    Colormap * tmp = (Colormap *) realloc(nxagentDefaultColormaps,
                                               nxagentNumDefaultColormaps * sizeof(Colormap));
-
-  if (nxagentDefaultColormaps == NULL)
+    if (tmp == NULL)
     {
+      SAFE_free(nxagentDefaultColormaps);
       FatalError("Can't allocate memory for the default colormaps\n");
     }
+    else
+    {
+      nxagentDefaultColormaps = tmp;
+    }
+  }
 
   reconnectDisplayState = ALLOC_DEF_COLORMAP;
 

nx-X11/programs/Xserver/hw/nxagent/Drawable.c

@@ -1605,9 +1605,11 @@ void nxagentUnmarkCorruptedRegion(DrawablePtr pDrawable, RegionPtr pRegion)
    * If the drawable becomes synchronized, the counter reporting the
    * number of corrupted drawables must be decreased. Moreover the
    * corrupted timestamp must be reset.
+   * Note: oldstatus has been checked above and is always
+   * "NotSynchronized" here.
    */
 
-  if (oldStatus == NotSynchronized &&
+  if (/*oldStatus == NotSynchronized &&*/
           nxagentDrawableStatus(pDrawable) == Synchronized)
   {
     if (pDrawable -> type == DRAWABLE_PIXMAP)

nx-X11/programs/Xserver/hw/nxagent/Keyboard.c

@@ -435,6 +435,11 @@ N/A
 
         int len = (max_keycode - min_keycode + 1) * mapWidth;
         keymap = (KeySym *)malloc(len * sizeof(KeySym));
+        if (keymap == NULL)
+        {
+          XFreeModifiermap(modifier_keymap);
+          return -1;
+        }
         for(int i = 0; i < len; ++i)
         {
           keymap[i] = keymap64[i];
@@ -1425,12 +1430,10 @@ static void nxagentXkbGetRemoteNames(void)
 
   if ((after > 0) || (type != XA_STRING) || (format != 8))
   {
-    if (data)
-    {
+    /* data non-null - has been checked above */
     SAFE_XFree(data);
     return;
   }
-  }
 
   char *name = data;
 

nx-X11/programs/Xserver/hw/nxagent/NXglyph.c

@@ -296,6 +296,13 @@ miGlyphs (CARD8		op,
         else
         {
           nxagentGlyphsExtents = (BoxPtr) malloc(sizeof(BoxRec));
+          if (!nxagentGlyphsExtents)
+          {
+            #ifdef WARNING
+            fprintf(stderr, "WARNING! Cannot allocate GlyphExtents\n");
+            #endif
+            return;
+          }
 
           GlyphExtents (nlist, list, glyphs, &extents);
 

nx-X11/programs/Xserver/hw/nxagent/NXpicture.c

@@ -320,8 +320,6 @@ static PicturePtr createSourcePicture(void)
     if (!pPicture)
       return 0;
 
-    if (pPicture != NULL)
-    {
     DevUnion *ppriv = (DevUnion *) (pPicture + 1);
 
     for (int i = 0; i < picturePrivateCount; ++i)
@@ -340,7 +338,6 @@ static PicturePtr createSourcePicture(void)
     pPicture -> devPrivates = ppriv;
 
     nxagentPicturePriv(pPicture) -> picture = 0;
-    }
 
     pPicture->pDrawable = 0;
     pPicture->pFormat = 0;

nx-X11/programs/Xserver/hw/nxagent/Reconnect.c

@@ -788,12 +788,16 @@ void nxagentSetReconnectError(int id, char *format, ...)
       size = (size ? size * 2 : NXAGENT_RECONNECT_DEFAULT_MESSAGE_SIZE);
     }
 
-    nxagentReconnectErrorMessage = realloc(nxagentReconnectErrorMessage, size);
+    char *tmp = realloc(nxagentReconnectErrorMessage, size);
 
-    if (nxagentReconnectErrorMessage == NULL)
+    if (tmp == NULL)
     {
       FatalError("realloc failed");
     }
+    else
+    {
+      nxagentReconnectErrorMessage = tmp;
+    }
   }
 
   return;

nx-X11/programs/Xserver/hw/nxagent/Render.c

@@ -1248,7 +1248,7 @@ void nxagentGlyphs(CARD8 op, PicturePtr pSrc, PicturePtr pDst,
                        PictFormatPtr maskFormat, INT16 xSrc, INT16 ySrc, int nlists,
                            XGlyphElt8 *elts, int sizeID, GlyphPtr *glyphsBase)
 {
-  BoxRec glyphBox;
+  BoxRec glyphBox = {0};
 
   XGlyphElt8 *elements;
 

nx-X11/programs/Xserver/hw/nxagent/Rootless.c

@@ -502,7 +502,8 @@ int nxagentExportProperty(WindowPtr pWin,
 
     nxagentPropWMHints propHints = {
       .flags = wmHints.flags,
-      .input = (wmHints.input == True ? 1 : 0),
+      /*.input = (wmHints.input == True ? 1 : 0), is always True*/
+      .input = 1,
       .initialState = wmHints.initial_state,
       .iconPixmap = wmHints.icon_pixmap,
       .iconWindow = wmHints.icon_window,

nx-X11/programs/Xserver/hw/nxagent/Screen.c

@@ -1156,6 +1156,14 @@ Bool nxagentOpenScreen(ScreenPtr pScreen, int argc, char *argv[])
      */
 
     DepthPtr depths = (DepthPtr) malloc(nxagentNumDepths * sizeof(DepthRec));
+    if (!depths)
+    {
+      #ifdef WARNING
+      fprintf(stderr, "WARNING: Could not allocate depths array\n");
+      #endif
+      /* FIXME: free data allocated above */
+      return False;
+    }
 
     for (int i = 0; i < nxagentNumDepths; i++)
     {
@@ -1177,6 +1185,14 @@ Bool nxagentOpenScreen(ScreenPtr pScreen, int argc, char *argv[])
     int numDepths = nxagentNumDepths;
 
     VisualPtr visuals = (VisualPtr) malloc(nxagentNumVisuals * sizeof(VisualRec));
+    if (!visuals)
+    {
+      #ifdef WARNING
+      fprintf(stderr, "WARNING: Could not allocate visual array\n");
+      #endif
+      /* FIXME: free data allocated above */
+      return False;
+    }
 
     int defaultVisualIndex = 0;
 
@@ -3058,6 +3074,14 @@ void nxagentShadowAdaptDepth(unsigned int width, unsigned int height,
   unsigned char *cBuffer = malloc(length);
   unsigned char *icBuffer = cBuffer;
 
+  if (!cBuffer)
+  {
+    #ifdef WARNING
+    fprintf(stderr, "WARNING: could not allocate cBuffer\n");
+    #endif
+    return;
+  }
+
   Visual *pVisual = nxagentImageVisual((DrawablePtr) nxagentShadowPixmapPtr, nxagentShadowDepth);
 
   if (pVisual == NULL)
@@ -4203,6 +4227,13 @@ void nxagentSaveAreas(PixmapPtr pPixmap, RegionPtr prgnSave, int xorg, int yorg,
   int nRects = RegionNumRects(&cleanRegion);
   int size = nRects * sizeof(XRectangle);
   XRectangle *pRects = (XRectangle *) malloc(size);
+  if (!pRects)
+  {
+    #ifdef WARNING
+    fprintf(stderr, "Could not allocate pRects\n");
+    #endif
+    return;
+  }
   BoxPtr pBox = RegionRects(&cleanRegion);
 
   for (int i = nRects; i-- > 0;)
@@ -4336,6 +4367,14 @@ void nxagentRestoreAreas(PixmapPtr pPixmap, RegionPtr prgnRestore, int xorg,
   int nRects = RegionNumRects(clipRegion);
   int size = nRects * sizeof(XRectangle);
   XRectangle *pRects = (XRectangle *) malloc(size);
+  if (!pRects)
+  {
+    #ifdef WARNING
+    fprintf(stderr, "Could not allocate pRects\n");
+    #endif
+    return;
+  }
+
   BoxPtr pBox = RegionRects(clipRegion);
 
   for (int i = nRects; i-- > 0;)

nx-X11/programs/Xserver/hw/nxagent/Splash.c

@@ -332,16 +332,11 @@ void nxagentRemoveSplashWindow(void)
   fprintf(stderr, "%s: Destroying the splash window.\n", __func__);
   #endif
 
-  if (!nxagentWMPassed)
-  {
   #ifdef NXAGENT_ONSTART
   XSetSelectionOwner(nxagentDisplay, nxagentReadyAtom,
                          nxagentDefaultWindows[0], CurrentTime);
   #endif
 
-    nxagentWMPassed = True;
-  }
-
   if (nxagentSplashWindow != None)
   {
     XDestroyWindow(nxagentDisplay, nxagentSplashWindow);

nx-X11/programs/Xserver/hw/nxagent/Window.c

@@ -3088,9 +3088,11 @@ static void nxagentReconnectWindow(void * param0, XID param1, void * data_buffer
                     (void*)pWin, pWin -> drawable.id, nxagentWindow(pWin));
         #endif
 
+        /* FIXME: use XAllocSizeHints() */
         #ifdef _XSERVER64
         data64 = (unsigned char *) malloc(sizeof(XSizeHints) + 4);
-
+	if (data64)
+	{
           for (int i = 0; i < 4; i++)
           {
             *(data64 + i) = *(data + i);
@@ -3113,6 +3115,13 @@ static void nxagentReconnectWindow(void * param0, XID param1, void * data_buffer
 	else
 	{
           #ifdef WARNING
+          fprintf(stderr, "%s: Failed to alloc memory for XSizeHints\n", __func__);
+          #endif
+	}
+      }
+      else
+      {
+        #ifdef WARNING
         fprintf(stderr, "nxagentReconnectWindow: Failed to get property WM_NORMAL_HINTS on window %p\n",
                     (void*)pWin);
         #endif
@@ -3657,6 +3666,14 @@ void nxagentAddStaticResizedWindow(WindowPtr pWin, unsigned long sequence, int o
   StaticResizedWindowStruct *tmp = nxagentStaticResizedWindowList;
 
   nxagentStaticResizedWindowList = malloc(sizeof(StaticResizedWindowStruct));
+  if (!nxagentStaticResizedWindowList)
+  {
+    #ifdef WARNING
+    fprintf(stderr, "WARNING: could not allocate memory for nxagentStaticResizedWindowList\n");
+    #endif
+    nxagentStaticResizedWindowList = tmp;
+    return;
+  }
   nxagentStaticResizedWindowList -> next = tmp;
   nxagentStaticResizedWindowList -> prev = NULL;