From 9036215b02436c1edab5d021a0ff3ca99a5b30b8 Mon Sep 17 00:00:00 2001 From: Mikhail Dmitrichenko Date: Sat, 14 Mar 2026 18:59:44 +0200 Subject: [PATCH] dix: avoid null ptr deref at doListFontsAndAliases In the `doListFontsAndAliases` function in dixfonts.c, when a font alias is encountered (`err == FontNameAlias`) as a result of `list_next_font_or_alias` call, the code allocates memory for `resolved` variable (`resolvedlen + 1` bytes) for storing target font name. In this case, if the `malloc(resolvedlen + 1)` call fails, `resolved` remains NULL. Later, when check (`else if (err == FontNameAlias)`) is TRUE, the code uses `memcpy` to copy nullable `resolved` into `tmp_pattern` without checking if `resolved` is NULL, so there is a potential null ptr dereference. This commit replaces `malloc` with `XNFalloc` for allocating memory for `resolved`. `XNFalloc` will internally check result of `malloc` and stop program execution if allocation was failed, preventing potential NULL dereferencing. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Mikhail Dmitrichenko Part-of: --- dix/dixfonts.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/dix/dixfonts.c b/dix/dixfonts.c index cfb195b0b7..4310f5b8ef 100644 --- a/dix/dixfonts.c +++ b/dix/dixfonts.c @@ -630,9 +630,8 @@ doListFontsAndAliases(ClientPtr client, LFclosurePtr c) } if (err == FontNameAlias) { free(resolved); - resolved = calloc(1, resolvedlen + 1); - if (resolved) - memcpy(resolved, tmpname, resolvedlen + 1); + resolved = XNFalloc(resolvedlen + 1); + memcpy(resolved, tmpname, resolvedlen + 1); } }