From 7a39f3281696093b92735dc40d734ff25d390be4 Mon Sep 17 00:00:00 2001 From: Christophe CURIS Date: Sun, 18 May 2014 21:31:51 +0200 Subject: [PATCH] WINGs: fix possible NULL pointer dereference (Coverity #50197) As pointed by Coverity, the 'paintItem' function in the WMBrowser widget is checking for nullity of its text argument, but before that it called the strlen function which crashes on NULL pointer. This patch moves the strlen call to the right place and reduce the lifespan of 'textLen' to highlight incorrect tries to use the variable. Signed-off-by: Christophe CURIS --- WINGs/wbrowser.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/WINGs/wbrowser.c b/WINGs/wbrowser.c index 6ef110e1..4027c2e6 100644 --- a/WINGs/wbrowser.c +++ b/WINGs/wbrowser.c @@ -476,7 +476,7 @@ static void paintItem(WMList * lPtr, int index, Drawable d, char *text, int stat Display *display = scr->display; WMFont *font = ((state & WLDSIsBranch) ? scr->boldFont : scr->normalFont); WMColor *backColor = ((state & WLDSSelected) ? scr->white : view->backColor); - int width, height, x, y, textLen; + int width, height, x, y; /* Parameter not used, but tell the compiler that it is ok */ (void) index; @@ -485,13 +485,15 @@ static void paintItem(WMList * lPtr, int index, Drawable d, char *text, int stat height = rect->size.height; x = rect->pos.x; y = rect->pos.y; - textLen = strlen(text); XFillRectangle(display, d, WMColorGC(backColor), x, y, width, height); if (text) { + int widthC, textLen; + /* Avoid overlaping... */ - int widthC = (state & WLDSIsBranch) ? width - 20 : width - 8; + widthC = (state & WLDSIsBranch) ? width - 20 : width - 8; + textLen = strlen(text); if (WMWidthOfString(font, text, textLen) > widthC) { char *textBuf = createTruncatedString(font, text, &textLen, widthC); W_PaintText(view, d, font, x + 4, y, widthC, WALeft, scr->black, False, textBuf, textLen);