Blame SOURCES/0001-tcti-tabrmd-Fix-NULL-deref-bug-by-moving-debug-outpu.patch

f8ff95
From 418d49669a33f9e6b029787e3869b3a534bb7de8 Mon Sep 17 00:00:00 2001
f8ff95
From: Philip Tricca <philip.b.tricca@intel.com>
f8ff95
Date: Mon, 14 Aug 2017 13:57:51 -0700
f8ff95
Subject: [PATCH] tcti-tabrmd: Fix NULL deref bug by moving debug output after
f8ff95
 NULL check.
f8ff95
f8ff95
This one speaks for itself: The debug output dereferences the pointer to
f8ff95
the context structure before checking for NULL. Switching these two
f8ff95
things around fixes the issue.
f8ff95
f8ff95
Signed-off-by: Philip Tricca <philip.b.tricca@intel.com>
f8ff95
---
f8ff95
 src/tcti-tabrmd.c | 8 ++++----
f8ff95
 1 file changed, 4 insertions(+), 4 deletions(-)
f8ff95
f8ff95
diff --git a/src/tcti-tabrmd.c b/src/tcti-tabrmd.c
f8ff95
index 970702c..134cf8d 100644
f8ff95
--- a/src/tcti-tabrmd.c
f8ff95
+++ b/src/tcti-tabrmd.c
f8ff95
@@ -293,11 +293,11 @@ tss2_tcti_tabrmd_cancel (TSS2_TCTI_CONTEXT *context)
f8ff95
     GError *error = NULL;
f8ff95
     gboolean cancel_ret;
f8ff95
 
f8ff95
-    g_info("tss2_tcti_tabrmd_cancel: id 0x%" PRIx64,
f8ff95
-           TSS2_TCTI_TABRMD_ID (context));
f8ff95
     if (context == NULL) {
f8ff95
         return TSS2_TCTI_RC_BAD_CONTEXT;
f8ff95
     }
f8ff95
+    g_info("tss2_tcti_tabrmd_cancel: id 0x%" PRIx64,
f8ff95
+           TSS2_TCTI_TABRMD_ID (context));
f8ff95
     if (TSS2_TCTI_TABRMD_STATE (context) != TABRMD_STATE_RECEIVE) {
f8ff95
         return TSS2_TCTI_RC_BAD_SEQUENCE;
f8ff95
     }
f8ff95
@@ -346,11 +346,11 @@ tss2_tcti_tabrmd_set_locality (TSS2_TCTI_CONTEXT *context,
f8ff95
     TSS2_RC ret = TSS2_RC_SUCCESS;
f8ff95
     GError *error = NULL;
f8ff95
 
f8ff95
-    g_info ("tss2_tcti_tabrmd_set_locality: id 0x%" PRIx64,
f8ff95
-            TSS2_TCTI_TABRMD_ID (context));
f8ff95
     if (context == NULL) {
f8ff95
         return TSS2_TCTI_RC_BAD_CONTEXT;
f8ff95
     }
f8ff95
+    g_info ("tss2_tcti_tabrmd_set_locality: id 0x%" PRIx64,
f8ff95
+            TSS2_TCTI_TABRMD_ID (context));
f8ff95
     if (TSS2_TCTI_TABRMD_STATE (context) != TABRMD_STATE_TRANSMIT) {
f8ff95
         return TSS2_TCTI_RC_BAD_SEQUENCE;
f8ff95
     }
f8ff95
-- 
f8ff95
2.13.6
f8ff95