Skip to content

Commit 875dce9

Browse files
committed
Add missing ptr checks for malloc/calloc/CloseHandle
1 parent c15392a commit 875dce9

File tree

4 files changed

+39
-8
lines changed

4 files changed

+39
-8
lines changed

libusb/hid.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1272,6 +1272,10 @@ hid_device * HID_API_EXPORT hid_open_path(const char *path)
12721272
return NULL;
12731273

12741274
dev = new_hid_device();
1275+
if (!dev) {
1276+
LOG("hid_open_path failed: Couldn't allocate memory\n");
1277+
return NULL;
1278+
}
12751279

12761280
libusb_get_device_list(usb_context, &devs);
12771281
while ((usb_dev = devs[d++]) != NULL && !good_open) {
@@ -1343,6 +1347,10 @@ HID_API_EXPORT hid_device * HID_API_CALL hid_libusb_wrap_sys_device(intptr_t sys
13431347
return NULL;
13441348

13451349
dev = new_hid_device();
1350+
if (!dev) {
1351+
LOG("libusb_wrap_sys_device failed: Couldn't allocate memory\n");
1352+
return NULL;
1353+
}
13461354

13471355
res = libusb_wrap_sys_device(usb_context, sys_dev, &dev->device_handle);
13481356
if (res < 0) {

linux/hid.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -400,8 +400,8 @@ static int get_next_hid_usage(const __u8 *report_descriptor, __u32 size, struct
400400
/* If no top-level application collection is found and usage page/usage pair is found, pair is valid
401401
https://docs.microsoft.com/en-us/windows-hardware/drivers/hid/top-level-collections */
402402
if (initial && usage_found && ctx->usage_page_found) {
403-
*usage_page = ctx->usage_page;
404-
return 0; /* success */
403+
*usage_page = ctx->usage_page;
404+
return 0; /* success */
405405
}
406406

407407
return 1; /* finished processing */

mac/hid.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1236,7 +1236,6 @@ static int cond_timedwait(hid_device *dev, pthread_cond_t *cond, pthread_mutex_t
12361236
}
12371237

12381238
return 0;
1239-
12401239
}
12411240

12421241
int HID_API_EXPORT hid_read_timeout(hid_device *dev, unsigned char *data, size_t length, int milliseconds)
@@ -1522,7 +1521,7 @@ int HID_API_EXPORT_CALL hid_get_report_descriptor(hid_device *dev, unsigned char
15221521
if (ref != NULL && CFGetTypeID(ref) == CFDataGetTypeID()) {
15231522
CFDataRef report_descriptor = (CFDataRef) ref;
15241523
const UInt8 *descriptor_buf = CFDataGetBytePtr(report_descriptor);
1525-
CFIndex descriptor_buf_len = CFDataGetLength(report_descriptor);
1524+
const CFIndex descriptor_buf_len = CFDataGetLength(report_descriptor);
15261525
size_t copy_len = (size_t) descriptor_buf_len;
15271526

15281527
if (descriptor_buf == NULL || descriptor_buf_len < 0) {

windows/hid.c

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1045,7 +1045,10 @@ HID_API_EXPORT hid_device * HID_API_CALL hid_open_path(const char *path)
10451045

10461046
end_of_function:
10471047
free(interface_path);
1048-
CloseHandle(device_handle);
1048+
1049+
if (device_handle) {
1050+
CloseHandle(device_handle);
1051+
}
10491052

10501053
if (pp_data) {
10511054
HidD_FreePreparsedData(pp_data);
@@ -1085,8 +1088,15 @@ int HID_API_EXPORT HID_API_CALL hid_write(hid_device *dev, const unsigned char *
10851088
/* The user passed the right number of bytes. Use the buffer as-is. */
10861089
buf = (unsigned char *) data;
10871090
} else {
1088-
if (dev->write_buf == NULL)
1091+
if (dev->write_buf == NULL) {
10891092
dev->write_buf = (unsigned char *) malloc(dev->output_report_length);
1093+
1094+
if (dev->write_buf == NULL) {
1095+
register_winapi_error(dev, L"hid_write/malloc");
1096+
goto end_of_function;
1097+
}
1098+
}
1099+
10901100
buf = dev->write_buf;
10911101
memcpy(buf, data, length);
10921102
memset(buf + length, 0, dev->output_report_length - length);
@@ -1253,8 +1263,15 @@ int HID_API_EXPORT HID_API_CALL hid_send_feature_report(hid_device *dev, const u
12531263
buf = (unsigned char *) data;
12541264
length_to_send = length;
12551265
} else {
1256-
if (dev->feature_buf == NULL)
1266+
if (dev->feature_buf == NULL) {
12571267
dev->feature_buf = (unsigned char *) malloc(dev->feature_report_length);
1268+
1269+
if (dev->feature_buf == NULL) {
1270+
register_winapi_error(dev, L"hid_send_feature_report/malloc");
1271+
return -1;
1272+
}
1273+
}
1274+
12581275
buf = dev->feature_buf;
12591276
memcpy(buf, data, length);
12601277
memset(buf + length, 0, dev->feature_report_length - length);
@@ -1347,8 +1364,15 @@ int HID_API_EXPORT HID_API_CALL hid_send_output_report(hid_device* dev, const un
13471364
buf = (unsigned char *) data;
13481365
length_to_send = length;
13491366
} else {
1350-
if (dev->write_buf == NULL)
1367+
if (dev->write_buf == NULL) {
13511368
dev->write_buf = (unsigned char *) malloc(dev->output_report_length);
1369+
1370+
if (dev->write_buf == NULL) {
1371+
register_winapi_error(dev, L"hid_send_output_report/malloc");
1372+
return -1;
1373+
}
1374+
}
1375+
13521376
buf = dev->write_buf;
13531377
memcpy(buf, data, length);
13541378
memset(buf + length, 0, dev->output_report_length - length);

0 commit comments

Comments
 (0)