Skip to content

Commit 60c8012

Browse files
haoxian2pcolberg
authored andcommitted
Fixed coverity issue in acl_mem.cpp: Dereference after null check
(Line 2036) Previously, if image is NULL, src_element_size is set to 0. However, there are a bunch of 'image' dereference after this check, which does not make sense since this if statement makes it seem like this function can handle a NULL image. Therefore, I replaced it with return CL_INVALID_MEM_OBJECT like some of the other functions. (Line 6829) Except these two lines, all the other line querying about mem->block_allocation are contained in the block with a null check for mem->block_allocation. Moving the two lines with the other lines.
1 parent 3d27d80 commit 60c8012

File tree

1 file changed

+42
-39
lines changed

1 file changed

+42
-39
lines changed

src/acl_mem.cpp

Lines changed: 42 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -2030,14 +2030,14 @@ CL_API_ENTRY cl_int CL_API_CALL clEnqueueReadImageIntelFPGA(
20302030
"Pointer argument cannot be NULL");
20312031
}
20322032

2033-
if (image != NULL) {
2034-
src_element_size = acl_get_image_element_size(
2035-
image->context, image->fields.image_objs.image_format, &errcode_ret);
2036-
if (errcode_ret != CL_SUCCESS) {
2037-
return errcode_ret;
2038-
}
2039-
} else {
2040-
src_element_size = 0;
2033+
if (image == NULL) {
2034+
return CL_INVALID_MEM_OBJECT;
2035+
}
2036+
2037+
src_element_size = acl_get_image_element_size(
2038+
image->context, image->fields.image_objs.image_format, &errcode_ret);
2039+
if (errcode_ret != CL_SUCCESS) {
2040+
return errcode_ret;
20412041
}
20422042

20432043
tmp_src_offset[0] = origin[0];
@@ -2127,16 +2127,16 @@ CL_API_ENTRY cl_int CL_API_CALL clEnqueueWriteImageIntelFPGA(
21272127
size_t dst_element_size;
21282128
std::scoped_lock lock{acl_mutex_wrapper};
21292129

2130-
if (image != NULL) {
2131-
dst_element_size = acl_get_image_element_size(
2132-
image->context, image->fields.image_objs.image_format, &errcode_ret);
2133-
if (errcode_ret != CL_SUCCESS) {
2134-
return errcode_ret;
2135-
}
2136-
} else {
2130+
if (image == NULL) {
21372131
return CL_INVALID_MEM_OBJECT;
21382132
}
21392133

2134+
dst_element_size = acl_get_image_element_size(
2135+
image->context, image->fields.image_objs.image_format, &errcode_ret);
2136+
if (errcode_ret != CL_SUCCESS) {
2137+
return errcode_ret;
2138+
}
2139+
21402140
if (!acl_command_queue_is_valid(command_queue)) {
21412141
return CL_INVALID_COMMAND_QUEUE;
21422142
}
@@ -2231,16 +2231,16 @@ CL_API_ENTRY cl_int CL_API_CALL clEnqueueFillImageIntelFPGA(
22312231
cl_event tmp_event;
22322232
std::scoped_lock lock{acl_mutex_wrapper};
22332233

2234-
if (image != NULL) {
2235-
dst_element_size = acl_get_image_element_size(
2236-
image->context, image->fields.image_objs.image_format, &errcode_ret);
2237-
if (errcode_ret != CL_SUCCESS) {
2238-
return errcode_ret;
2239-
}
2240-
} else {
2234+
if (image == NULL) {
22412235
return CL_INVALID_MEM_OBJECT;
22422236
}
22432237

2238+
dst_element_size = acl_get_image_element_size(
2239+
image->context, image->fields.image_objs.image_format, &errcode_ret);
2240+
if (errcode_ret != CL_SUCCESS) {
2241+
return errcode_ret;
2242+
}
2243+
22442244
if (!acl_command_queue_is_valid(command_queue)) {
22452245
return CL_INVALID_COMMAND_QUEUE;
22462246
}
@@ -2710,7 +2710,7 @@ CL_API_ENTRY void *CL_API_CALL clEnqueueMapImageIntelFPGA(
27102710
cl_int status;
27112711
size_t element_size;
27122712
size_t tmp_row_pitch;
2713-
size_t tmp_slice_pitch;
2713+
size_t tmp_slice_pitch = 0;
27142714
std::scoped_lock lock{acl_mutex_wrapper};
27152715

27162716
if (image != NULL) {
@@ -2771,19 +2771,22 @@ CL_API_ENTRY void *CL_API_CALL clEnqueueMapImageIntelFPGA(
27712771
image_slice_pitch == NULL) {
27722772
BAIL_INFO(CL_INVALID_VALUE, command_queue->context,
27732773
"Invalid slice pitch provided");
2774-
} else {
2775-
if (image->mem_object_type == CL_MEM_OBJECT_IMAGE2D ||
2776-
image->mem_object_type == CL_MEM_OBJECT_IMAGE1D ||
2777-
image->mem_object_type == CL_MEM_OBJECT_IMAGE1D_BUFFER) {
2778-
if (image_slice_pitch != NULL) {
2779-
*image_slice_pitch = 0;
2780-
}
2781-
} else if (image->mem_object_type == CL_MEM_OBJECT_IMAGE1D_ARRAY) {
2782-
*image_slice_pitch = tmp_row_pitch;
2783-
} else {
2784-
*image_slice_pitch =
2785-
image->fields.image_objs.image_desc->image_height * tmp_row_pitch;
2774+
}
2775+
2776+
if (image->mem_object_type == CL_MEM_OBJECT_IMAGE2D ||
2777+
image->mem_object_type == CL_MEM_OBJECT_IMAGE1D ||
2778+
image->mem_object_type == CL_MEM_OBJECT_IMAGE1D_BUFFER) {
2779+
if (image_slice_pitch != NULL) {
2780+
*image_slice_pitch = 0;
27862781
}
2782+
} else if (image->mem_object_type == CL_MEM_OBJECT_IMAGE1D_ARRAY) {
2783+
*image_slice_pitch = tmp_row_pitch;
2784+
} else {
2785+
*image_slice_pitch =
2786+
image->fields.image_objs.image_desc->image_height * tmp_row_pitch;
2787+
}
2788+
2789+
if (image_slice_pitch != NULL) {
27872790
tmp_slice_pitch = *image_slice_pitch;
27882791
}
27892792

@@ -6824,12 +6827,12 @@ static void acl_dump_mem_internal(cl_mem mem) {
68246827
(mem->block_allocation->region->uses_host_system_malloc
68256828
? "is malloc"
68266829
: "not malloc"));
6830+
printf(" .begin %p\n",
6831+
mem->block_allocation->range.begin);
6832+
printf(" .end %p\n",
6833+
mem->block_allocation->range.next);
68276834
}
68286835
printf(" .mappings %d\n", mem->mapping_count);
6829-
printf(" .begin %p\n",
6830-
mem->block_allocation->range.begin);
6831-
printf(" .end %p\n",
6832-
mem->block_allocation->range.next);
68336836
acl_print_debug_msg(" .size %lu\n", mem->size);
68346837
printf(" .host_ptr %p\n",
68356838
mem->fields.buffer_objs.host_ptr);

0 commit comments

Comments
 (0)