Skip to content

Commit b9168ed

Browse files
committed
Fixed coverity issue in acl_mem.cpp: Dereference after null check
(Line 2036) Previously, if image is NULL, src_element_size is set to 0. However, there are a bunch of 'image' dereference after this check, which does not make sense since this if statement makes it seem like this function can handle a NULL image. Therefore, I replaced it with return CL_INVALID_MEM_OBJECT like some of the other functions. (Line 6829) Except these two lines, all the other line querying about mem->block_allocation are contained in the block with a null check for mem->block_allocation. Moving the two lines with the other lines.
1 parent 7ed6b39 commit b9168ed

File tree

1 file changed

+31
-28
lines changed

1 file changed

+31
-28
lines changed

src/acl_mem.cpp

Lines changed: 31 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -2026,14 +2026,14 @@ CL_API_ENTRY cl_int CL_API_CALL clEnqueueReadImageIntelFPGA(
20262026
"Pointer argument cannot be NULL");
20272027
}
20282028

2029-
if (image != NULL) {
2030-
src_element_size = acl_get_image_element_size(
2031-
image->context, image->fields.image_objs.image_format, &errcode_ret);
2032-
if (errcode_ret != CL_SUCCESS) {
2033-
return errcode_ret;
2034-
}
2035-
} else {
2036-
src_element_size = 0;
2029+
if (image == NULL) {
2030+
return CL_INVALID_MEM_OBJECT;
2031+
}
2032+
2033+
src_element_size = acl_get_image_element_size(
2034+
image->context, image->fields.image_objs.image_format, &errcode_ret);
2035+
if (errcode_ret != CL_SUCCESS) {
2036+
return errcode_ret;
20372037
}
20382038

20392039
tmp_src_offset[0] = origin[0];
@@ -2123,16 +2123,16 @@ CL_API_ENTRY cl_int CL_API_CALL clEnqueueWriteImageIntelFPGA(
21232123
size_t dst_element_size;
21242124
std::scoped_lock lock{acl_mutex_wrapper};
21252125

2126-
if (image != NULL) {
2127-
dst_element_size = acl_get_image_element_size(
2128-
image->context, image->fields.image_objs.image_format, &errcode_ret);
2129-
if (errcode_ret != CL_SUCCESS) {
2130-
return errcode_ret;
2131-
}
2132-
} else {
2126+
if (image == NULL) {
21332127
return CL_INVALID_MEM_OBJECT;
21342128
}
21352129

2130+
dst_element_size = acl_get_image_element_size(
2131+
image->context, image->fields.image_objs.image_format, &errcode_ret);
2132+
if (errcode_ret != CL_SUCCESS) {
2133+
return errcode_ret;
2134+
}
2135+
21362136
if (!acl_command_queue_is_valid(command_queue)) {
21372137
return CL_INVALID_COMMAND_QUEUE;
21382138
}
@@ -2227,16 +2227,16 @@ CL_API_ENTRY cl_int CL_API_CALL clEnqueueFillImageIntelFPGA(
22272227
cl_event tmp_event;
22282228
std::scoped_lock lock{acl_mutex_wrapper};
22292229

2230-
if (image != NULL) {
2231-
dst_element_size = acl_get_image_element_size(
2232-
image->context, image->fields.image_objs.image_format, &errcode_ret);
2233-
if (errcode_ret != CL_SUCCESS) {
2234-
return errcode_ret;
2235-
}
2236-
} else {
2230+
if (image == NULL) {
22372231
return CL_INVALID_MEM_OBJECT;
22382232
}
22392233

2234+
dst_element_size = acl_get_image_element_size(
2235+
image->context, image->fields.image_objs.image_format, &errcode_ret);
2236+
if (errcode_ret != CL_SUCCESS) {
2237+
return errcode_ret;
2238+
}
2239+
22402240
if (!acl_command_queue_is_valid(command_queue)) {
22412241
return CL_INVALID_COMMAND_QUEUE;
22422242
}
@@ -2771,15 +2771,18 @@ CL_API_ENTRY void *CL_API_CALL clEnqueueMapImageIntelFPGA(
27712771
if (image->mem_object_type == CL_MEM_OBJECT_IMAGE2D ||
27722772
image->mem_object_type == CL_MEM_OBJECT_IMAGE1D ||
27732773
image->mem_object_type == CL_MEM_OBJECT_IMAGE1D_BUFFER) {
2774-
if (image_slice_pitch != NULL) {
2775-
*image_slice_pitch = 0;
2774+
if (image_slice_pitch == NULL) {
2775+
BAIL_INFO(CL_INVALID_VALUE, command_queue->context,
2776+
"Invalid slice pitch provided");
27762777
}
2778+
*image_slice_pitch = 0;
27772779
} else if (image->mem_object_type == CL_MEM_OBJECT_IMAGE1D_ARRAY) {
27782780
*image_slice_pitch = tmp_row_pitch;
27792781
} else {
27802782
*image_slice_pitch =
27812783
image->fields.image_objs.image_desc->image_height * tmp_row_pitch;
27822784
}
2785+
27832786
tmp_slice_pitch = *image_slice_pitch;
27842787
}
27852788

@@ -6820,12 +6823,12 @@ static void acl_dump_mem_internal(cl_mem mem) {
68206823
(mem->block_allocation->region->uses_host_system_malloc
68216824
? "is malloc"
68226825
: "not malloc"));
6826+
printf(" .begin %p\n",
6827+
mem->block_allocation->range.begin);
6828+
printf(" .end %p\n",
6829+
mem->block_allocation->range.next);
68236830
}
68246831
printf(" .mappings %d\n", mem->mapping_count);
6825-
printf(" .begin %p\n",
6826-
mem->block_allocation->range.begin);
6827-
printf(" .end %p\n",
6828-
mem->block_allocation->range.next);
68296832
acl_print_debug_msg(" .size %lu\n", mem->size);
68306833
printf(" .host_ptr %p\n",
68316834
mem->fields.buffer_objs.host_ptr);

0 commit comments

Comments
 (0)