From 32b2baaf511b982b5af1555b511a2b2abaf7ae7d Mon Sep 17 00:00:00 2001
From: "U. Artie Eoff" <ullysses.a.eoff@intel.com>
Date: Tue, 14 Jan 2014 09:18:03 -0800
Subject: [PATCH] add_shm_format: check wl_array_add return value before deref

In wl_display_add_shm_format(), check the return value from
wl_array_add() before dereferencing it and assigning it a value.
Return the resulting pointer back to the caller.

Signed-off-by: U. Artie Eoff <ullysses.a.eoff@intel.com>
---
 src/wayland-server.c | 14 ++++++++++----
 src/wayland-server.h |  2 +-
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/src/wayland-server.c b/src/wayland-server.c
index 1459e09b..489b99d4 100644
--- a/src/wayland-server.c
+++ b/src/wayland-server.c
@@ -1317,25 +1317,31 @@ wl_display_remove_global(struct wl_display *display, struct wl_global *global)
  *
  * \param display The display object
  * \param format The wl_shm pixel format to advertise
+ * \return A pointer to the wl_shm format that was added to the list
+ * or NULL if adding it to the list failed.
  *
  * Add the specified wl_shm format to the list of formats the wl_shm
  * object advertises when a client binds to it.  Adding a format to
  * the list means that clients will know that the compositor supports
  * this format and may use it for creating wl_shm buffers.  The
- * compositor must be able to handle the pixel format when a client 
+ * compositor must be able to handle the pixel format when a client
+ * requests it.
  *
  * The compositor by default supports WL_SHM_FORMAT_ARGB8888 and
  * WL_SHM_FORMAT_XRGB8888.
  *
  * \memberof wl_display
  */
-WL_EXPORT void
+WL_EXPORT uint32_t *
 wl_display_add_shm_format(struct wl_display *display, uint32_t format)
 {
-	uint32_t *p;
+	uint32_t *p = NULL;
 
 	p = wl_array_add(&display->additional_shm_formats, sizeof *p);
-	*p = format;
+
+	if (p != NULL)
+		*p = format;
+	return p;
 }
 
 /**
diff --git a/src/wayland-server.h b/src/wayland-server.h
index f5427fd3..3fcaaf60 100644
--- a/src/wayland-server.h
+++ b/src/wayland-server.h
@@ -439,7 +439,7 @@ wl_shm_buffer_get_height(struct wl_shm_buffer *buffer);
 int
 wl_display_init_shm(struct wl_display *display);
 
-void
+uint32_t *
 wl_display_add_shm_format(struct wl_display *display, uint32_t format);
 
 struct wl_shm_buffer *