Each file in this commit has a problem where it is possible to dereference

a pointer without that pointer being valid. This commit fixes each instance
of that.

6 files changed, 62 insertions, 29 deletions

diff --git a/core/multimedia/opieplayer/modplug/sndfile.cpp b/core/multimedia/opieplayer/modplug/sndfile.cpp
index 1d0d610..799555c 100644
--- a/core/multimedia/opieplayer/modplug/sndfile.cpp
+++ b/core/multimedia/opieplayer/modplug/sndfile.cpp
@@ -1736,13 +1736,16 @@ void CSoundFile::CheckCPUUsage(UINT nCPU)
 
 BOOL CSoundFile::SetPatternName(UINT nPat, LPCSTR lpszName)
 //---------------------------------------------------------
 {
         char szName[MAX_PATTERNNAME] = "";   // changed from CHAR
         if (nPat >= MAX_PATTERNS) return FALSE;
-        if (lpszName) lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        if (lpszName)
+                lstrcpyn(szName, lpszName, MAX_PATTERNNAME);
+        else
+                return FALSE;
         szName[MAX_PATTERNNAME-1] = 0;
         if (!m_lpszPatternNames) m_nPatternNames = 0;
         if (nPat >= m_nPatternNames)
         {
                 if (!lpszName[0]) return TRUE;
                 UINT len = (nPat+1)*MAX_PATTERNNAME;
diff --git a/core/multimedia/opieplayer/vorbis/tremor/block.c b/core/multimedia/opieplayer/vorbis/tremor/block.c
index 8949253..7b5531b 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/block.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/block.c
@@ -223,14 +223,16 @@ void vorbis_dsp_clear(vorbis_dsp_state *v){
   if(v){
     vorbis_info *vi=v->vi;
     codec_setup_info *ci=(codec_setup_info *)(vi?vi->codec_setup:NULL);
     private_state *b=(private_state *)v->backend_state;
 
     if(v->pcm){
-      for(i=0;i<vi->channels;i++)
-        if(v->pcm[i])_ogg_free(v->pcm[i]);
+      if (vi) {
+        for(i=0;i<vi->channels;i++)
+          if(v->pcm[i])_ogg_free(v->pcm[i]);
+      }
       _ogg_free(v->pcm);
       if(v->pcmret)_ogg_free(v->pcmret);
     }
 
     /* free mode lookups; these are actually vorbis_look_mapping structs */
     if(ci){
diff --git a/core/multimedia/opieplayer/vorbis/tremor/info.c b/core/multimedia/opieplayer/vorbis/tremor/info.c
index 941695e..3499ae4 100644
--- a/core/multimedia/opieplayer/vorbis/tremor/info.c
+++ b/core/multimedia/opieplayer/vorbis/tremor/info.c
@@ -94,14 +94,14 @@ void vorbis_comment_clear(vorbis_comment *vc){
     long i;
     for(i=0;i<vc->comments;i++)
       if(vc->user_comments[i])_ogg_free(vc->user_comments[i]);
     if(vc->user_comments)_ogg_free(vc->user_comments);
         if(vc->comment_lengths)_ogg_free(vc->comment_lengths);
     if(vc->vendor)_ogg_free(vc->vendor);
+    memset(vc,0,sizeof(*vc));
   }
-  memset(vc,0,sizeof(*vc));
 }
 
 /* blocksize 0 is guaranteed to be short, 1 is guarantted to be long.
    They may be equal, but short will never ge greater than long */
 int vorbis_info_blocksize(vorbis_info *vi,int zo){
   codec_setup_info *ci = (codec_setup_info *)vi->codec_setup;
diff --git a/noncore/apps/opie-write/qrichtext.cpp b/noncore/apps/opie-write/qrichtext.cpp
index f040f1e..768da44 100644
--- a/noncore/apps/opie-write/qrichtext.cpp
+++ b/noncore/apps/opie-write/qrichtext.cpp
@@ -186,15 +186,18 @@ QTextDeleteCommand::~QTextDeleteCommand()
     text.resize( 0 );
 }
 
 QTextCursor *QTextDeleteCommand::execute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
         owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
         return 0;
+    } else if ( !doc ) {
+        owarn << "No valid doc" << oendl;
+        return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     int len = text.size();
     if ( c )
@@ -214,15 +217,18 @@ QTextCursor *QTextDeleteCommand::execute( QTextCursor *c )
     return c;
 }
 
 QTextCursor *QTextDeleteCommand::unexecute( QTextCursor *c )
 {
     QTextParagraph *s = doc ? doc->paragAt( id ) : parag;
-    if ( !s ) {
+    if ( !s && doc ) {
         owarn << "can't locate parag at " << id << ", last parag: " << doc->lastParagraph()->paragId() << "" << oendl; 
         return 0;
+    } else if ( !doc ) {
+        owarn << "No valid doc" << oendl;
+        return 0;
     }
 
     cursor.setParagraph( s );
     cursor.setIndex( index );
     QString str = QTextString::toString( text );
     cursor.insert( str, TRUE, &text );
@@ -230,12 +236,15 @@ QTextCursor *QTextDeleteCommand::unexecute( QTextCursor *c )
     cursor.setIndex( index );
     if ( c ) {
         c->setParagraph( s );
         c->setIndex( index );
         for ( int i = 0; i < (int)text.size(); ++i )
             c->gotoNextLetter();
+    } else {
+        owarn << "No valid cursor" << oendl;
+        return 0;
     }
 
     if ( !styleInformation.isEmpty() ) {
         QDataStream styleStream( styleInformation, IO_ReadOnly );
         int num;
         styleStream >> num;
@@ -1389,30 +1398,41 @@ struct Q_EXPORT QTextDocumentTag {
 #if defined(Q_FULL_TEMPLATE_INSTANTIATION)
     bool operator==( const QTextDocumentTag& ) const { return FALSE; }
 #endif
 };
 
 
-#define NEWPAR       do{ if ( !hasNewPar) { \
-                    if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
-                        curpar->remove( curpar->length()-2, 1 ); \
-                    curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); vec = 0;} \
-                    hasNewPar = TRUE; \
-                    curpar->rtext = TRUE;  \
-                    curpar->align = curtag.alignment; \
-                    curpar->lstyle = curtag.liststyle; \
-                    curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
-                    curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
-                    space = TRUE; \
-                    delete vec; vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
-                    int i = 0; \
-                    for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
-                        vec->insert( i++, (*it).style ); \
-                    vec->insert( i, curtag.style ); \
-                    }while(FALSE)
-
+#define NEWPAR do { \
+                   if ( !hasNewPar) { \
+                       if ( !curpar ) { \
+                           owarn << "no current paragraph" << oendl; \
+                           return; \
+                       } \
+                       if ( !textEditMode && curpar && curpar->length()>1 && curpar->at( curpar->length()-2)->c == QChar_linesep ) \
+                           curpar->remove( curpar->length()-2, 1 ); \
+                       curpar = createParagraph( this, curpar, curpar->next() ); styles.append( vec ); \
+                       if ( !curpar ) { \
+                           owarn << "failed in creating a new paragraph" << oendl; \
+                           return; \
+                       } \
+                       vec = 0; \
+                   } \
+                   hasNewPar = TRUE; \
+                   curpar->rtext = TRUE;  \
+                   curpar->align = curtag.alignment; \
+                   curpar->lstyle = curtag.liststyle; \
+                   curpar->litem = ( curtag.style->displayMode() == QStyleSheetItem::DisplayListItem ); \
+                   curpar->str->setDirection( (QChar::Direction)curtag.direction ); \
+                   space = TRUE; \
+                   delete vec; \
+                   vec = new QPtrVector<QStyleSheetItem>( (uint)tags.count() + 1); \
+                   int i = 0; \
+                   for ( QValueStack<QTextDocumentTag>::Iterator it = tags.begin(); it != tags.end(); ++it ) \
+                       vec->insert( i++, (*it).style ); \
+                   vec->insert( i, curtag.style ); \
+               } while ( FALSE )
 
 void QTextDocument::setRichText( const QString &text, const QString &context )
 {
     if ( !context.isEmpty() )
         setContext( context );
     clear();
@@ -1892,14 +1912,17 @@ void QTextDocument::setRichTextMarginsInternal( QPtrList< QPtrVector<QStyleSheet
             curStyle = nextStyle;
             nextStyle = styles.next();
             continue;
         }
 
         int i, mar;
-        QStyleSheetItem* mainStyle = curStyle->size() ? (*curStyle)[curStyle->size()-1] : 0;
-        if ( mainStyle && mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
+        QStyleSheetItem* mainStyle = (*curStyle)[curStyle->size()-1];
+        if ( !mainStyle )
+            return;
+
+        if ( mainStyle->displayMode() == QStyleSheetItem::DisplayListItem )
             stylesPar->setListItem( TRUE );
         int numLists = 0;
         for ( i = 0; i < (int)curStyle->size(); ++i ) {
             if ( (*curStyle)[ i ]->displayMode() == QStyleSheetItem::DisplayBlock
                  && int((*curStyle)[ i ]->listStyle()) != QStyleSheetItem::Undefined )
                 numLists++;
@@ -5338,13 +5361,13 @@ int QTextFormatterBreakWords::format( QTextDocument *doc, QTextParagraph *parag,
     int ww = 0;
     QChar lastChr;
     for ( ; i < len; ++i, ++col ) {
         if ( c )
             lastChr = c->c;
         // ### next line should not be needed
-        if ( painter )
+        if ( c && painter )
             c->format()->setPainter( painter );
         c = &string->at( i );
         c->rightToLeft = FALSE;
         if ( i > 0 && (x > curLeft || ww == 0) || lastWasNonInlineCustom ) {
             c->lineStart = 0;
         } else {
diff --git a/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp b/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
index 9069c09..3fd877f 100644
--- a/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
+++ b/noncore/settings/networksettings2/opietooth2/OTSDPAttribute.cpp
@@ -292,12 +292,15 @@ UUIDVector OTSDPAttribute::getAllUUIDs() {
       if (getType() == SEQUENCE) {
           subAttributes = getSequence();
       } else if (getType() == ALTERNATIVE) {
           subAttributes = getAlternative();
       }
 
+      if (!subAttributes)
+          return 0;
+
       int os;
       for( unsigned int i = 0; i < subAttributes->count(); i++ ) {
         UUIDVector subUUIDs = (*subAttributes)[i]->getAllUUIDs();
 
         os = uuids.size();
         uuids.resize( uuids.size()+subUUIDs.count() );
diff --git a/noncore/settings/packagemanager/oipkgconfigdlg.cpp b/noncore/settings/packagemanager/oipkgconfigdlg.cpp
index d014378..78a18f7 100644
--- a/noncore/settings/packagemanager/oipkgconfigdlg.cpp
+++ b/noncore/settings/packagemanager/oipkgconfigdlg.cpp
@@ -433,13 +433,15 @@ void OIpkgConfigDlg::initData()
                 }
             }
         }
     }
 
     // Get Ipkg execution options
-    int options = m_ipkg->ipkgExecOptions();
+    int options = 0;
+    if ( m_ipkg )
+        options = m_ipkg->ipkgExecOptions();
     if ( options & FORCE_DEPENDS )
         m_optForceDepends->setChecked( true );
     if ( options & FORCE_REINSTALL )
         m_optForceReinstall->setChecked( true );
     if ( options & FORCE_REMOVE )
         m_optForceRemove->setChecked( true );
@@ -447,13 +449,13 @@ void OIpkgConfigDlg::initData()
         m_optForceOverwrite->setChecked( true );
     if ( options & FORCE_RECURSIVE )
         m_optForceRecursive->setChecked( true );
     if ( options & FORCE_VERBOSE_WGET )
         m_optVerboseWget->setChecked( true );
 
-    m_optVerboseIpkg->setCurrentItem( m_ipkg->ipkgExecVerbosity() );
+    m_optVerboseIpkg->setCurrentItem( ( m_ipkg ? m_ipkg->ipkgExecVerbosity() : 0 ) );
 }
 
 void OIpkgConfigDlg::slotServerSelected( int index )
 {
     m_serverCurrent = index;