From: Sagar Ghuge <sagar.ghuge@intel.com>
Date: Thu, 6 Sep 2018 19:37:28 +0000 (-0700)
Subject: intel/decoder: Avoid freeing invalid pointer
X-Git-Url: https://git.libre-soc.org/?a=commitdiff_plain;h=f9c8468c824dd9ceb804b6c9e177b738f8340a26;p=mesa.git

intel/decoder: Avoid freeing invalid pointer

v2: Free ctx.spec if error while reading genxml (Lionel Landwerlin)

v3: Handle case where genxml is empty (Lionel Landwerlin)

Signed-off-by: Sagar Ghuge <sagar.ghuge@intel.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
---

diff --git a/src/intel/common/gen_decoder.c b/src/intel/common/gen_decoder.c
index d4db8b89cc3..38a5fccb2ab 100644
--- a/src/intel/common/gen_decoder.c
+++ b/src/intel/common/gen_decoder.c
@@ -654,25 +654,27 @@ gen_spec_load_from_path(const struct gen_device_info *devinfo,
    ctx.spec = gen_spec_init();
    if (ctx.spec == NULL) {
       fprintf(stderr, "Failed to create gen_spec\n");
-      return NULL;
+      goto end;
    }
 
    do {
       buf = XML_GetBuffer(ctx.parser, XML_BUFFER_SIZE);
       len = fread(buf, 1, XML_BUFFER_SIZE, input);
-      if (len == 0) {
+      if (ferror(input)) {
          fprintf(stderr, "fread: %m\n");
-         free(ctx.spec);
+         gen_spec_destroy(ctx.spec);
          ctx.spec = NULL;
          goto end;
-      }
+      } else if (feof(input))
+         goto end;
+
       if (XML_ParseBuffer(ctx.parser, len, len == 0) == 0) {
          fprintf(stderr,
                  "Error parsing XML at line %ld col %ld: %s\n",
                  XML_GetCurrentLineNumber(ctx.parser),
                  XML_GetCurrentColumnNumber(ctx.parser),
                  XML_ErrorString(XML_GetErrorCode(ctx.parser)));
-         free(ctx.spec);
+         gen_spec_destroy(ctx.spec);
          ctx.spec = NULL;
          goto end;
       }
@@ -684,6 +686,12 @@ gen_spec_load_from_path(const struct gen_device_info *devinfo,
    fclose(input);
    free(filename);
 
+   /* free ctx.spec if genxml is empty */
+   if (ctx.spec && _mesa_hash_table_num_entries(ctx.spec->commands) == 0) {
+      gen_spec_destroy(ctx.spec);
+      return NULL;
+   }
+
    return ctx.spec;
 }