From 9ecd6b80f9670c581c9f10f615057fae61a9e189 Mon Sep 17 00:00:00 2001 From: deref3046 Date: Tue, 30 Jun 2026 14:47:05 +0800 Subject: [PATCH 1/3] fix null check calloc daemon --- daemon/daemon.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/daemon/daemon.c b/daemon/daemon.c index c366ea7c..796c7f92 100644 --- a/daemon/daemon.c +++ b/daemon/daemon.c @@ -206,6 +206,10 @@ static void handle_new_connection(int listen_fd) } struct client *c = calloc(1, sizeof(*c)); + if (!c) { + close(client_fd); + return; + } c->ctrl_fd = client_fd; if (hdr.type == CTRL_MSG_CONSUMER_HELLO) { From 1be880c51c640b8af5cda4c9ce34b93fbf2dfa46 Mon Sep 17 00:00:00 2001 From: deref3046 Date: Tue, 30 Jun 2026 14:47:12 +0800 Subject: [PATCH 2/3] fix null check malloc consumer --- libdisplay_consumer/display_consumer.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libdisplay_consumer/display_consumer.c b/libdisplay_consumer/display_consumer.c index 8e93e3d9..6d6df274 100644 --- a/libdisplay_consumer/display_consumer.c +++ b/libdisplay_consumer/display_consumer.c @@ -41,6 +41,10 @@ void allocate_services(struct display_ctx *ctx, struct service_info *services, i ctx->services = services; ctx->num_services = num_services; ctx->resources = (struct resources*)malloc(sizeof(struct resources) * num_services); + if (!ctx->resources) { + ctx->num_services = 0; + return; + } for(int i=0;iresources[i].service_type = services[i].type; ctx->resources[i].type = -1;//unallocated From ce7f54e382ac08730ed9975ee07f91395131a10f Mon Sep 17 00:00:00 2001 From: deref3046 Date: Tue, 30 Jun 2026 14:47:23 +0800 Subject: [PATCH 3/3] fix overflow push dmabufs --- libdisplay_consumer/display_consumer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/libdisplay_consumer/display_consumer.c b/libdisplay_consumer/display_consumer.c index 6d6df274..b71eaeb2 100644 --- a/libdisplay_consumer/display_consumer.c +++ b/libdisplay_consumer/display_consumer.c @@ -300,6 +300,7 @@ int set_screen_info(display_ctx *ctx, uint32_t width, uint32_t height, uint32_t int push_dmabufs(display_ctx *ctx, const int *fds, const struct buf_info *infos, int count) { + if (count > MAX_BUFS) count = MAX_BUFS; memcpy(ctx->stored_fds, fds, count * sizeof(int)); memcpy(ctx->stored_infos, infos, count * sizeof(struct buf_info)); ctx->stored_count = count;