Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

6 files changed, 62 insertions, 29 deletions

diff --git a/core/multimedia/opieplayer/modplug/sndfile.cpp b/core/multimedia/opieplayer/modplug/sndfile.cpp
index 1d0d610..799555c 100644
--- a/core/multimedia/opieplayer/modplug/sndfile.cpp
+++ b/core/multimedia/opieplayer/modplug/sndfile.cpp
@@ -1718,49 +1718,52 @@ void CSoundFile::CheckCPUUsage(UINT nCPU)
 		UINT i=MAX_CHANNELS;
 		while (i >= 8)
 		{
 			i--;
 			if (Chn[i].nLength)
 			{
 				Chn[i].nLength = Chn[i].nPos = 0;
 				nCPU -= 2;
 				if (nCPU < 94) break;
 			}
 		}
 	} else
 	if (nCPU > 90)
 	{
 		m_dwSongFlags |= SONG_CPUVERYHIGH;
 	}
 }
 
 
 BOOL CSoundFile::SetPatternName(UINT nPat, LPCSTR lpszName)
 //---------------------------------------------------------
 {
         char szName[MAX_PATTERNNAME] = "";   // changed from CHAR
 	if (nPat >= MAX_PATTERNS) return FALSE;
-	if (lpszName) lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+	if (lpszName)
+		lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+	else
+		return FALSE;
 	szName[MAX_PATTERNNAME-1] = 0;
 	if (!m_lpszPatternNames) m_nPatternNames = 0;
 	if (nPat >= m_nPatternNames)
 	{
 		if (!lpszName[0]) return TRUE;
 		UINT len = (nPat+1)*MAX_PATTERNNAME;
 		char *p = new char[len];   // changed from CHAR
 		if (!p) return FALSE;
 		memset(p, 0, len);
 		if (m_lpszPatternNames)
 		{
 			memcpy(p, m_lpszPatternNames, m_nPatternNames * MAX_PATTERNNAME);
 			delete m_lpszPatternNames;
 			m_lpszPatternNames = NULL;
 		}
 		m_lpszPatternNames = p;
 		m_nPatternNames = nPat + 1;
 	}
 	memcpy(m_lpszPatternNames + nPat * MAX_PATTERNNAME, szName, MAX_PATTERNNAME);
 	return TRUE;
 }
 
 
 BOOL CSoundFile::GetPatternName(UINT nPat, LPSTR lpszName, UINT cbSize) const
diff --git a/core/multimedia/opieplayer/vorbis/tremor/block.c b/core/multimedia/opieplayer/vorbis/tremor/block.c
index 8949253..7b5531b 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/block.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/block.c
@@ -205,50 +205,52 @@ int vorbis_synthesis_restart(vorbis_dsp_state *v){
   
   v->pcm_returned=-1;
   v->granulepos=-1;
   v->sequence=-1;
   ((private_state *)(v->backend_state))->sample_count=-1;
 
   return(0);
 }
 
 int vorbis_synthesis_init(vorbis_dsp_state *v,vorbis_info *vi){
   _vds_init(v,vi);
   vorbis_synthesis_restart(v);
 
   return(0);
 }
 
 void vorbis_dsp_clear(vorbis_dsp_state *v){
   int i;
   if(v){
     vorbis_info *vi=v->vi;
     codec_setup_info *ci=(codec_setup_info *)(vi?vi->codec_setup:NULL);
     private_state *b=(private_state *)v->backend_state;
 
     if(v->pcm){
-      for(i=0;i<vi->channels;i++)
-	if(v->pcm[i])_ogg_free(v->pcm[i]);
+      if (vi) {
+	for(i=0;i<vi->channels;i++)
+	  if(v->pcm[i])_ogg_free(v->pcm[i]);
+      }
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }
 
     /* free mode lookups; these are actually vorbis_look_mapping structs */
     if(ci){
       for(i=0;i<ci->modes;i++){
 	int mapnum=ci->mode_param[i]->mapping;
 	int maptype=ci->map_type[mapnum];
 	if(b && b->mode)_mapping_P[maptype]->free_look(b->mode[i]);
       }
     }
 
     if(b){
       if(b->mode)_ogg_free(b->mode);    
       _ogg_free(b);
     }
     
     memset(v,0,sizeof(*v));
   }
 }
 
 /* Unlike in analysis, the window is only partially applied for each
    block.  The time domain envelope is not yet handled at the point of
diff --git a/core/multimedia/opieplayer/vorbis/tremor/info.c b/core/multimedia/opieplayer/vorbis/tremor/info.c
index 941695e..3499ae4 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/info.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/info.c
@@ -76,50 +76,50 @@ char *vorbis_comment_query(vorbis_comment *vc, char *tag, int count){
 
 int vorbis_comment_query_count(vorbis_comment *vc, char *tag){
   int i,count=0;
   int taglen = strlen(tag)+1; /* +1 for the = we append */
   char *fulltag = (char *)alloca(taglen+1);
   strcpy(fulltag,tag);
   strcat(fulltag, "=");
 
   for(i=0;i<vc->comments;i++){
     if(!tagcompare(vc->user_comments[i], fulltag, taglen))
       count++;
   }
 
   return count;
 }
 
 void vorbis_comment_clear(vorbis_comment *vc){
   if(vc){
     long i;
     for(i=0;i<vc->comments;i++)
       if(vc->user_comments[i])_ogg_free(vc->user_comments[i]);
     if(vc->user_comments)_ogg_free(vc->user_comments);
 	if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
+    memset(vc,0,sizeof(*vc));
   }
-  memset(vc,0,sizeof(*vc));
 }
 
 /* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = (codec_setup_info *)vi->codec_setup;
   return ci ? ci->blocksizes[zo] : -1;
 }
 
 /* used by synthesis, which has a full, alloced vi */
 void vorbis_info_init(vorbis_info *vi){
   memset(vi,0,sizeof(*vi));
   vi->codec_setup=(codec_setup_info *)_ogg_calloc(1,sizeof(codec_setup_info));
 }
 
 void vorbis_info_clear(vorbis_info *vi){
   codec_setup_info     *ci=(codec_setup_info *)vi->codec_setup;
   int i;
 
   if(ci){
 
     for(i=0;i<ci->modes;i++)
       if(ci->mode_param[i])_ogg_free(ci->mode_param[i]);
 
diff --git a/noncore/apps/opie-write/qrichtext.cpp b/noncore/apps/opie-write/qrichtext.cpp
index f040f1e..768da44 100644
--- a/noncore/apps/opie-write/qrichtext.cpp
+++ b/noncore/apps/opie-write/qrichtext.cpp
@@ -168,92 +168,101 @@ QTextDeleteCommand::QTextDeleteCommand( QTextDocument *d, int i, int idx, const
     }
 }
 
 QTextDeleteCommand::QTextDeleteCommand( QTextParagraph *p, int idx, const QMemArray<QTextStringChar> &str )
     : QTextCommand( 0 ), id( -1 ), index( idx ), parag( p ), text( str )
 {
     for ( int i = 0; i < (int)text.size(); ++i ) {
 	if ( text[ i ].format() )
 	    text[ i ].format()->addRef();
     }
 }
 
 QTextDeleteCommand::~QTextDeleteCommand()
 {
     for ( int i = 0; i < (int)text.size(); ++i ) {
 	if ( text[ i ].format() )
 	    text[ i ].format()->removeRef();
     }
     text.resize( 0 );
 }
 
 QTextCursor *QTextDeleteCommand::execute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
 	owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
 	return 0;
+    } else if ( !doc ) {
+	owarn << "No valid doc" << oendl;
+	return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     int len = text.size();
     if ( c )
 	*c = cursor;
     if ( doc ) {
 	doc->setSelectionStart( QTextDocument::Temp, cursor );
 	for ( int i = 0; i < len; ++i )
 	    cursor.gotoNextLetter();
 	doc->setSelectionEnd( QTextDocument::Temp, cursor );
 	doc->removeSelectedText( QTextDocument::Temp, &cursor );
 	if ( c )
 	    *c = cursor;
     } else {
 	s->remove( index, len );
     }
 
     return c;
 }
 
 QTextCursor *QTextDeleteCommand::unexecute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
 	owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
 	return 0;
+    } else if ( !doc ) {
+	owarn << "No valid doc" << oendl;
+	return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     QString str = QTextString::toString( text );
     cursor.insert( str, TRUE, &text );
     cursor.setParagraph( s );
     cursor.setIndex( index );
     if ( c ) {
 	c->setParagraph( s );
 	c->setIndex( index );
 	for ( int i = 0; i < (int)text.size(); ++i )
 	    c->gotoNextLetter();
+    } else {
+	owarn << "No valid cursor" << oendl;
+	return 0;
     }
 
     if ( !styleInformation.isEmpty() ) {
 	QDataStream styleStream( styleInformation, IO_ReadOnly );
 	int num;
 	styleStream >> num;
 	QTextParagraph *p = s;
 	while ( num-- && p ) {
 	    p->readStyleInformation( styleStream );
 	    p = p->next();
 	}
     }
     s = cursor.paragraph();
     while ( s ) {
 	s->format();
 	s->setChanged( TRUE );
 	if ( s == c->paragraph() )
 	    break;
 	s = s->next();
     }
 
     return &cursor;
 }
 
@@ -1371,66 +1380,77 @@ struct Q_EXPORT QTextDocumentTag {
 	wsm = t.wsm;
 	format = t.format;
 	alignment = t.alignment;
 	direction = t.direction;
 	liststyle = t.liststyle;
     }
     QTextDocumentTag& operator=(const QTextDocumentTag& t) {
 	name = t.name;
 	style = t.style;
 	anchorHref = t.anchorHref;
 	wsm = t.wsm;
 	format = t.format;
 	alignment = t.alignment;
 	direction = t.direction;
 	liststyle = t.liststyle;
 	return *this;
     }
 
 #if defined(Q_FULL_TEMPLATE_INSTANTIATION)
     bool operator==( const QTextDocumentTag& ) const { return FALSE; }
 #endif
 };
 
 
-#define NEWPAR       do{ if ( !hasNewPar) { \
-		    if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
-			curpar->remove( curpar->length()-2, 1 ); \
-		    curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); vec = 0;} \
-		    hasNewPar = TRUE; \
-		    curpar->rtext = TRUE;  \
-		    curpar->align = curtag.alignment; \
-		    curpar->lstyle = curtag.liststyle; \
-		    curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
-		    curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
-		    space = TRUE; \
-		    delete vec; vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
-		    int i = 0; \
-		    for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
-			vec->insert( i++, (*it).style ); \
-		    vec->insert( i, curtag.style ); \
-		    }while(FALSE)
-
+#define NEWPAR do { \
+                   if ( !hasNewPar) { \
+                       if ( !curpar ) { \
+                           owarn << "no current paragraph" << oendl; \
+                           return; \
+                       } \
+                       if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
+                           curpar->remove( curpar->length()-2, 1 ); \
+                       curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); \
+                       if ( !curpar ) { \
+                           owarn << "failed in creating a new paragraph" << oendl; \
+                           return; \
+                       } \
+                       vec = 0; \
+                   } \
+                   hasNewPar = TRUE; \
+                   curpar->rtext = TRUE;  \
+                   curpar->align = curtag.alignment; \
+                   curpar->lstyle = curtag.liststyle; \
+                   curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
+                   curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
+                   space = TRUE; \
+                   delete vec; \
+                   vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
+                   int i = 0; \
+                   for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
+                       vec->insert( i++, (*it).style ); \
+                   vec->insert( i, curtag.style ); \
+               } while ( FALSE )
 
 void QTextDocument::setRichText( const QString &text, const QString &context )
 {
     if ( !context.isEmpty() )
 	setContext( context );
     clear();
     fParag = lParag = createParagraph( this );
     oTextValid = TRUE;
     oText = text;
     setRichTextInternal( text );
     fParag->rtext = TRUE;
 }
 
 void QTextDocument::setRichTextInternal( const QString &text, QTextCursor* cursor )
 {
     QTextParagraph* curpar = lParag;
     int pos = 0;
     QValueStack<QTextDocumentTag> tags;
     QTextDocumentTag initag( "", sheet_->item(""), *formatCollection()->defaultFormat() );
     QTextDocumentTag curtag = initag;
     bool space = TRUE;
     bool canMergeLi = FALSE;
 
     bool textEditMode = FALSE;
@@ -1874,50 +1894,53 @@ void QTextDocument::setRichTextInternal( const QString &text, QTextCursor* curso
 
     if ( cursor ) {
  	cursor->gotoPreviousLetter();
   	cursor->remove();
      }
 
 }
 
 void QTextDocument::setRichTextMarginsInternal( QPtrList< QPtrVector<QStyleSheetItem> >& styles, QTextParagraph* stylesPar )
 {
     // margin and line spacing calculation
     QPtrVector<QStyleSheetItem>* prevStyle = 0;
     QPtrVector<QStyleSheetItem>* curStyle = styles.first();
     QPtrVector<QStyleSheetItem>* nextStyle = styles.next();
     while ( stylesPar ) {
 	if ( !curStyle ) {
 	    stylesPar = stylesPar->next();
 	    prevStyle = curStyle;
 	    curStyle = nextStyle;
 	    nextStyle = styles.next();
 	    continue;
 	}
 
 	int i, mar;
-	QStyleSheetItem* mainStyle = curStyle->size() ? (*curStyle)[curStyle->size()-1] : 0;
-	if ( mainStyle && mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
+	QStyleSheetItem* mainStyle = (*curStyle)[curStyle->size()-1];
+	if ( !mainStyle )
+	    return;
+
+	if ( mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
 	    stylesPar->setListItem( TRUE );
 	int numLists = 0;
 	for ( i = 0; i < (int)curStyle->size(); ++i ) {
 	    if ( (*curStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
 		 && int((*curStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
 		numLists++;
 	}
 	stylesPar->ldepth = numLists;
 	if ( stylesPar->next() && nextStyle ) {
 	    // also set the depth of the next paragraph, required for the margin calculation
 	    numLists = 0;
 	    for ( i = 0; i < (int)nextStyle->size(); ++i ) {
 		if ( (*nextStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
 		     && int((*nextStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
 		    numLists++;
 	    }
 	    stylesPar->next()->ldepth = numLists;
 	}
 
 	// do the top margin
 	QStyleSheetItem* item = mainStyle;
 	int m;
 	if (stylesPar->utm > 0 ) {
 	    m = stylesPar->utm-1;
@@ -5320,49 +5343,49 @@ int QTextFormatterBreakWords::format( QTextDocument *doc, QTextParagraph *parag,
     if ( start == 0 )
 	c = &parag->string()->at( 0 );
 
     int i = start;
     QTextLineStart *lineStart = new QTextLineStart( y, y, 0 );
     insertLineStart( parag, 0, lineStart );
     int lastBreak = -1;
     int tmpBaseLine = 0, tmph = 0;
     bool lastWasNonInlineCustom = FALSE;
 
     int align = parag->alignment();
     if ( align == Qt3::AlignAuto && doc && doc->alignment() != Qt3::AlignAuto )
 	align = doc->alignment();
 
     align &= Qt3::AlignHorizontal_Mask;
 
     QPainter *painter = QTextFormat::painter();
     int col = 0;
     int ww = 0;
     QChar lastChr;
     for ( ; i < len; ++i, ++col ) {
 	if ( c )
 	    lastChr = c->c;
 	// ### next line should not be needed
-	if ( painter )
+	if ( c && painter )
 	    c->format()->setPainter( painter );
 	c = &string->at( i );
 	c->rightToLeft = FALSE;
 	if ( i > 0 && (x > curLeft || ww == 0) || lastWasNonInlineCustom ) {
 	    c->lineStart = 0;
 	} else {
 	    c->lineStart = 1;
 	    firstChar = c;
 	}
 
 	if ( c->isCustom() && c->customItem()->placement() != QTextCustomItem::PlaceInline )
 	    lastWasNonInlineCustom = TRUE;
 	else
 	    lastWasNonInlineCustom = FALSE;
 
 	if ( c->c.unicode() >= 32 || c->isCustom() ) {
 	    ww = string->width( i );
 	} else if ( c->c == '\t' ) {
 	    int nx = parag->nextTab( i, x - left ) + left;
 	    if ( nx < x )
 		ww = w - x;
 	    else
 		ww = nx - x;
 	} else {
diff --git a/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp b/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
index 9069c09..3fd877f 100644
--- a/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
+++ b/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
@@ -274,48 +274,51 @@ AttributeVector * OTSDPAttribute::getSequence() {
     return Value.sequenceVal;
 }
 
 AttributeVector * OTSDPAttribute::getAlternative() {
     assert(type == ALTERNATIVE);
     return Value.sequenceVal;
 }
 
 UUIDVector OTSDPAttribute::getAllUUIDs() {
 
     UUIDVector uuids;
 
     if (getType() == UUID) {
       uuids.resize( uuids.size()+1 );
       uuids[uuids.size()-1] = getUUID();
     } else {
       AttributeVector * subAttributes = 0 ;
 
       if (getType() == SEQUENCE) {
           subAttributes = getSequence();
       } else if (getType() == ALTERNATIVE) {
           subAttributes = getAlternative();
       }
 
+      if (!subAttributes)
+          return 0;
+
       int os;
       for( unsigned int i = 0; i < subAttributes->count(); i++ ) {
         UUIDVector subUUIDs = (*subAttributes)[i]->getAllUUIDs();
 
         os = uuids.size();
         uuids.resize( uuids.size()+subUUIDs.count() );
 
         for( unsigned int k = 0; k < subUUIDs.count(); k++ ) {
           uuids[os + k] = subUUIDs[k];
         }
       }
     }
     return uuids;
 }
 
 static char * Attr2String[] = {
         "Invalid",
         "Nil",
         "UInt",
         "int",
         "UUID",
         "Boolean",
         "String",
         "Sequence",
diff --git a/noncore/settings/packagemanager/oipkgconfigdlg.cpp b/noncore/settings/packagemanager/oipkgconfigdlg.cpp
index d014378..78a18f7 100644
--- a/noncore/settings/packagemanager/oipkgconfigdlg.cpp
+++ b/noncore/settings/packagemanager/oipkgconfigdlg.cpp
@@ -415,63 +415,65 @@ void OIpkgConfigDlg::initData()
                                     m_proxyUsername->setText( config->value() );
                                 }
                                 else if ( config->name() == "proxy_password" )
                                 {
                                     m_proxyPassword->setText( config->value() );
                                 }
                             }
                             break;
                         case OConfItem::Other :
                             {
                                 if ( config->name() == "lists_dir" )
                                     m_optSourceLists->setText( config->value() );
                                 else // TODO - use proper libipkg define
                                     m_optSourceLists->setText( "/usr/lib/ipkg/lists" );
                             }
                             break;
                         default : break;
                     };
                 }
             }
         }
     }
 
     // Get Ipkg execution options
-    int options = m_ipkg->ipkgExecOptions();
+    int options = 0;
+    if ( m_ipkg )
+        options = m_ipkg->ipkgExecOptions();
     if ( options & FORCE_DEPENDS )
         m_optForceDepends->setChecked( true );
     if ( options & FORCE_REINSTALL )
         m_optForceReinstall->setChecked( true );
     if ( options & FORCE_REMOVE )
         m_optForceRemove->setChecked( true );
     if ( options & FORCE_OVERWRITE )
         m_optForceOverwrite->setChecked( true );
     if ( options & FORCE_RECURSIVE )
         m_optForceRecursive->setChecked( true );
     if ( options & FORCE_VERBOSE_WGET )
         m_optVerboseWget->setChecked( true );
 
-    m_optVerboseIpkg->setCurrentItem( m_ipkg->ipkgExecVerbosity() );
+    m_optVerboseIpkg->setCurrentItem( ( m_ipkg ? m_ipkg->ipkgExecVerbosity() : 0 ) );
 }
 
 void OIpkgConfigDlg::slotServerSelected( int index )
 {
     m_serverCurrent = index;
 
     // Enable Edit and Delete buttons
     m_serverEditBtn->setEnabled( true );
     m_serverDeleteBtn->setEnabled( true );
 }
 
 void OIpkgConfigDlg::slotServerNew()
 {
     OConfItem *server = new OConfItem( OConfItem::Source );
 
     OIpkgServerDlg dlg( server, this );
     if ( QPEApplication::execDialog( &dlg ) == QDialog::Accepted )
     {
         // Add to configuration option list
         m_configs->append( server );
         m_configs->sort();
 
         // Add to server list
         m_serverList->insertItem( server->name() );