From 2f352db1aaa3ba9b865ab539cdea5ce0f3ec2136 Mon Sep 17 00:00:00 2001 From: intel-mediadev Date: Fri, 23 Oct 2026 12:05:47 +0800 Subject: [PATCH] [Media_Common][Coverity] Fix NULL_FIELD dereferences in va_trace and va_dri2 Fix two Coverity NULL_FIELD defects (CID 3528231, CID 3660939): 1. va/va_trace.c (CID 3528231): In va_TraceVPrint(), fp_log is read from trace_ctx->plog_file->fp_log and passed directly to vfprintf/fflush without a null check. Since fp_log is set from fopen() output (which can return NULL on failure), dereferencing it unconditionally causes undefined behavior. All other sites in the file that use fp_log check it for null first (lines 744, 920, 2113, 4307). Add the missing null guard before the FILE* use. 2. va/x11/va_dri2.c (CID 3660939): VA_DRI2GetBuffers_internal() dereferences info->codes->major_opcode without checking info->codes for null. Both callers validate info->codes via XextCheckExtension/XextSimpleCheckExtension before calling this static helper, so this cannot be triggered in current code. Add a defensive early-return to make the function self-guarding and consistent with the pattern used in sibling functions. Resolves: VSMGWL-85794 [Internal] Commit_Type: Bugfix Platforms: Gen8_12, Xe_Hpm, Xe_Lpm, Xe2_Hpm, Xe2_Lpm, Xe3_Hpm, Xe3_Lpm OS: Linux Feature impact: Misc Resolves: VSMGWL-85794 Related-to: N/A Co-Authored-By: Claude Code --- va/va_trace.c | 2 ++ va/x11/va_dri2.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/va/va_trace.c b/va/va_trace.c index 7ececc088..4d051bab3 100644 --- a/va/va_trace.c +++ b/va/va_trace.c @@ -968,6 +968,8 @@ static void va_TraceVPrint(struct trace_context *trace_ctx, const char *msg, va_ return; fp = trace_ctx->plog_file->fp_log; + if (!fp) + return; if (msg) { vfprintf(fp, msg, args); } else diff --git a/va/x11/va_dri2.c b/va/x11/va_dri2.c index da2a9f40b..6d3637f81 100644 --- a/va/x11/va_dri2.c +++ b/va/x11/va_dri2.c @@ -303,6 +303,9 @@ VA_DRI2Buffer *VA_DRI2GetBuffers_internal(XExtDisplayInfo *info, CARD32 *p; int i; + if (!info->codes) + return NULL; + GetReqExtra(DRI2GetBuffers, count * 4, req); req->reqType = info->codes->major_opcode; req->dri2ReqType = X_DRI2GetBuffers;