gryf/wmaker
1
0
Fork 0
mirror of https://github.com/gryf/wmaker.git synced 2025-12-24 23:22:30 +01:00
Code Issues Projects Releases Wiki Activity

WINGs: fix possible NULL pointer dereference (Coverity #50197)

Browse Source 
As pointed by Coverity, the 'paintItem' function in the WMBrowser widget
is checking for nullity of its text argument, but before that it called the
strlen function which crashes on NULL pointer. This patch moves the strlen
call to the right place and reduce the lifespan of 'textLen' to highlight
incorrect tries to use the variable.

Signed-off-by: Christophe CURIS <christophe.curis@free.fr>
This commit is contained in:
Christophe CURIS
2014-05-18 21:31:51 +02:00
committed by Carlos R. Mafra
parent 28ce91a901
commit 7a39f32816
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
WINGs/wbrowser.c
View File

@@ -476,7 +476,7 @@ static void paintItem(WMList * lPtr, int index, Drawable d, char *text, int stat
Display *display = scr->display;
WMFont *font = ((state & WLDSIsBranch) ? scr->boldFont : scr->normalFont);
WMColor *backColor = ((state & WLDSSelected) ? scr->white : view->backColor);
int width, height, x, y, textLen;
int width, height, x, y;
/* Parameter not used, but tell the compiler that it is ok */
(void) index;
@@ -485,13 +485,15 @@ static void paintItem(WMList * lPtr, int index, Drawable d, char *text, int stat
height = rect->size.height;
x = rect->pos.x;
y = rect->pos.y;
textLen = strlen(text);
XFillRectangle(display, d, WMColorGC(backColor), x, y, width, height);
if (text) {
int widthC, textLen;
/* Avoid overlaping... */
int widthC = (state & WLDSIsBranch) ? width - 20 : width - 8;
widthC = (state & WLDSIsBranch) ? width - 20 : width - 8;
textLen = strlen(text);
if (WMWidthOfString(font, text, textLen) > widthC) {
char *textBuf = createTruncatedString(font, text, &textLen, widthC);
W_PaintText(view, d, font, x + 4, y, widthC, WALeft, scr->black, False, textBuf, textLen);