Skip to content

(release/25.0) xf86: prevent passing NULL pointer as strcpy destination - #3601

Open
metux wants to merge 1 commit into
release/25.0from
pr/release/25.0-xf86-prevent-passing-null-pointer-as-strcpy-destination-_2026-08-20_16-22-59
Open

(release/25.0) xf86: prevent passing NULL pointer as strcpy destination#3601
metux wants to merge 1 commit into
release/25.0from
pr/release/25.0-xf86-prevent-passing-null-pointer-as-strcpy-destination-_2026-08-20_16-22-59

Conversation

@metux

@metux metux commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Reported by gcc 16.1:
hw/xfree86/common/xf86Configure.c:463:9: warning: use of NULL where non-null
expected [CWE-476] [-Wanalyzer-null-argument]
463 | strcpy(ptr->mon_modelname, (char *) (det_mon->section.name));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
‘handle_detailed_input’: events 1-5
458 | switch (det_mon->type) {
| ^~~~~~
| |
| (1) following ‘case 252:’ branch... ─>─┐
| │
| │
|┌───────────────────────────────────────────┘
459 |│ case DS_NAME:
|│ ~~~~
|│ |
|└───>(2) ...to here
460 | ptr->mon_modelname = realloc(ptr->mon_modelname,
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| | |
| | (3) when ‘realloc’ fails
| (4) using NULL here
461 | strlen((char *) (det_mon->section.name)) +
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
462 | 1);
| ~~
463 | strcpy(ptr->mon_modelname, (char ) (det_mon->section.name));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| (5) ⚠ argument 1 (‘realloc(
(struct *)data.mon_modelname, strlen(&*det_mon.section.name) + 1)’) NULL where non-null expected

note: argument 1 of ‘strcpy’ must be non-null

Signed-off-by: Alan Coopersmith alan.coopersmith@oracle.com
Part-of: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2272

Reported by gcc 16.1:
hw/xfree86/common/xf86Configure.c:463:9: warning: use of NULL where non-null
 expected [CWE-476] [-Wanalyzer-null-argument]
  463 |         strcpy(ptr->mon_modelname, (char *) (det_mon->section.name));
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘handle_detailed_input’: events 1-5
  458 |     switch (det_mon->type) {
      |     ^~~~~~
      |     |
      |     (1) following ‘case 252:’ branch... ─>─┐
      |                                            │
      |                                            │
      |┌───────────────────────────────────────────┘
  459 |│    case DS_NAME:
      |│    ~~~~
      |│    |
      |└───>(2) ...to here
  460 |         ptr->mon_modelname = realloc(ptr->mon_modelname,
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                            | |
      |                            | (3) when ‘realloc’ fails
      |                            (4) using NULL here
  461 |                                      strlen((char *) (det_mon->section.name)) +
      |                                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  462 |                                      1);
      |                                      ~~
  463 |         strcpy(ptr->mon_modelname, (char *) (det_mon->section.name));
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |         |
      |         (5) ⚠  argument 1 (‘realloc(*(struct <anonymous> *)data.mon_modelname,  strlen(&*det_mon.section.name) + 1)’) NULL where non-null expected

note: argument 1 of ‘strcpy’ must be non-null

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2272>
@metux metux self-assigned this Aug 20, 2026
@metux
metux requested a review from a team August 20, 2026 14:24
metux pushed a commit that referenced this pull request Aug 20, 2026
Reported by gcc 16.1:
hw/xfree86/common/xf86Configure.c:463:9: warning: use of NULL where non-null
 expected [CWE-476] [-Wanalyzer-null-argument]
  463 |         strcpy(ptr->mon_modelname, (char *) (det_mon->section.name));
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  ‘handle_detailed_input’: events 1-5
  458 |     switch (det_mon->type) {
      |     ^~~~~~
      |     |
      |     (1) following ‘case 252:’ branch... ─>─┐
      |                                            │
      |                                            │
      |┌───────────────────────────────────────────┘
  459 |│    case DS_NAME:
      |│    ~~~~
      |│    |
      |└───>(2) ...to here
  460 |         ptr->mon_modelname = realloc(ptr->mon_modelname,
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                            | |
      |                            | (3) when ‘realloc’ fails
      |                            (4) using NULL here
  461 |                                      strlen((char *) (det_mon->section.name)) +
      |                                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  462 |                                      1);
      |                                      ~~
  463 |         strcpy(ptr->mon_modelname, (char *) (det_mon->section.name));
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |         |
      |         (5) ⚠  argument 1 (‘realloc(*(struct <anonymous> *)data.mon_modelname,  strlen(&*det_mon.section.name) + 1)’) NULL where non-null expected

note: argument 1 of ‘strcpy’ must be non-null

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2272>
PR: #3601
@metux

metux commented Aug 20, 2026

Copy link
Copy Markdown
Contributor Author

Review: xf86: prevent passing NULL pointer as strcpy destination

Same fix as PR #3587 (release/25.1) and PR #3568 (release/25.2), now on release/25.0. Replaces realloc with XNFrealloc in handle_detailed_input to prevent passing NULL to strcpy. Still keeps the redundant assert (same as #3587, unlike #3568 which removed it).

Code review (1 file, +1/-1)

Checklist

Verdict

Passed. Identical to #3587.

@metux metux added the bot-review-passed Automated bot review found no blocking issues label Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bot-review-passed Automated bot review found no blocking issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants