From a342997bed4b6a50228641a9e1e95fb55922872f Mon Sep 17 00:00:00 2001 From: "Carl.Zhang" Date: Thu, 23 Apr 2026 15:47:37 +0800 Subject: [PATCH 1/2] va: reject NULL display in vaGetDisplayWl() Add a null-pointer check for the display parameter at the entry of vaGetDisplayWl(), returning NULL immediately instead of proceeding to backend initialization which would crash with a null dereference. This aligns the Wayland constructor with the X11 and DRM constructors which already validate their native display/fd arguments early. Signed-off-by: Carl.Zhang --- va/wayland/va_wayland.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/va/wayland/va_wayland.c b/va/wayland/va_wayland.c index 759b05517..2f4c42cc9 100644 --- a/va/wayland/va_wayland.c +++ b/va/wayland/va_wayland.c @@ -116,6 +116,9 @@ vaGetDisplayWl(struct wl_display *display) struct VADriverVTableWayland *vtable; unsigned int i; + if (!display) + return NULL; + pDisplayContext = va_newDisplayContext(); if (!pDisplayContext) return NULL; From c33e9d51af7603f84e0a2b01fed482dd9ffc778b Mon Sep 17 00:00:00 2001 From: "Carl.Zhang" Date: Thu, 23 Apr 2026 15:50:39 +0800 Subject: [PATCH 2/2] va: validate inputs in vaSetDriverName() before use Add CHECK_DISPLAY(dpy) before CTX(dpy) to validate the display handle, and add a NULL check for driver_name before calling strlen(). Without these guards, passing NULL for either argument causes a null-pointer dereference instead of returning a proper error status. This aligns vaSetDriverName() with the validation pattern used by other public APIs in va.c. Signed-off-by: Carl.Zhang --- va/va.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/va/va.c b/va/va.c index d87661aae..15b3e5212 100644 --- a/va/va.c +++ b/va/va.c @@ -627,9 +627,10 @@ VAStatus vaSetDriverName( VADriverContextP ctx; VAStatus vaStatus = VA_STATUS_SUCCESS; char *override_driver_name = NULL; + CHECK_DISPLAY(dpy); ctx = CTX(dpy); - if (strlen(driver_name) == 0 || strlen(driver_name) >= 256) { + if (!driver_name || strlen(driver_name) == 0 || strlen(driver_name) >= 256) { vaStatus = VA_STATUS_ERROR_INVALID_PARAMETER; va_errorMessage(dpy, "vaSetDriverName returns %s\n", vaErrorStr(vaStatus));