Commit 71eeacf
committed
gfx/x11: NULL-check keysym rlut calloc to avoid OOM segfault
x11_init_keyboard_lut rebuilds the reverse keysym lookup table:
if (x11_keysym_rlut)
free(x11_keysym_rlut);
x11_keysym_rlut = (unsigned*)calloc(++x11_keysym_rlut_size, sizeof(unsigned));
for (map = map_start; map->rk != RETROK_UNKNOWN; map++)
x11_keysym_rlut[map->sym] = (enum retro_key)map->rk;
If the calloc returns NULL, the populate loop dereferences NULL on
its first iteration. The size allocated here is driven by the
maximum X11 keysym value observed while building x11_keysym_lut (a
few hundred unsigneds, so ~kB), small enough that OOM is unlikely
in normal operation but still possible under extreme memory
pressure.
The lookup-side reader already handles the disabled-rlut case:
if (x11_keysym_rlut && sym < x11_keysym_rlut_size)
return (enum retro_key)x11_keysym_rlut[sym];
so the correct failure behaviour is to leave x11_keysym_rlut as NULL
and set x11_keysym_rlut_size = 0. The reader's NULL + bounds
guard then falls through cleanly and the caller transparently gets
whatever fallback path follows. The existing 'x11_keysym_rlut_size
>= 65536' branch at the bottom of this same function already uses
size = 0 as the 'rlut disabled' sentinel, so this matches the
existing convention.
Thread-safety: unchanged. Called once during X11 context
initialisation; x11_keysym_rlut is a file-scope static touched only
on the main thread.
Reachability: X11 input context init. Runs once per X11 window
bring-up.1 parent 7ecdd2f commit 71eeacf
1 file changed
Lines changed: 11 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
426 | 426 | | |
427 | 427 | | |
428 | 428 | | |
429 | | - | |
430 | | - | |
431 | | - | |
432 | | - | |
| 429 | + | |
| 430 | + | |
| 431 | + | |
| 432 | + | |
| 433 | + | |
| 434 | + | |
| 435 | + | |
| 436 | + | |
| 437 | + | |
| 438 | + | |
| 439 | + | |
433 | 440 | | |
434 | 441 | | |
435 | 442 | | |
| |||
0 commit comments