Skip to content

Potential null pointer in drmGetBufInfo()

The DRM_IOCTL_INFO_BUFS ioctl can return a large info.count that might fail alloca() via drmMalloc(). (Although small drmMalloc() are not null checked, larger ones are.)

In drmGetBufInfo() we can see a null pointer check done here:

if (!(info.list = drmMalloc(info.count * sizeof(*info.list))))
        return NULL;

But it is not repeated for this allocation further down:

retval->list  = drmMalloc(info.count * sizeof(*retval->list));

This could leave retval->list null, which is immediately dereferenced.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information