From 8e1ad6f180d6188894deee327e819263c3f6678e Mon Sep 17 00:00:00 2001
From: "Wan, Hao" <haox.wan@intel.com>
Date: Tue, 8 Oct 2024 15:56:08 +0000
Subject: [PATCH] Fix Coverity issues

CID/Type:
187157 Explicit null dereferenced
656172 Dereference after null check
602228 Dereference before null check

Tracked-On: OAM-126078
Signed-off-by: Wan, Hao <haox.wan@intel.com>
---
 .../src/mfx_c2_decoder_component.cpp          | 46 +++++++++++--------
 c2_utils/src/mfx_gralloc1.cpp                 |  7 ++-
 2 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/c2_components/src/mfx_c2_decoder_component.cpp b/c2_components/src/mfx_c2_decoder_component.cpp
index 11df780d..13924bb2 100755
--- a/c2_components/src/mfx_c2_decoder_component.cpp
+++ b/c2_components/src/mfx_c2_decoder_component.cpp
@@ -2177,19 +2177,20 @@ void MfxC2DecoderComponent::DoWork(std::unique_ptr<C2Work>&& work)
             if (it != m_pendingWorks.end()) {
                 work = std::move(it->second);
                 m_pendingWorks.erase(it);
+
+                if (work) {
+                    if (flushing) {
+                        m_flushedWorks.push_back(std::move(work));
+                    } else {
+                        FillEmptyWork(std::move(work), res);
+                    }
+                }
             } else {
                 MFX_DEBUG_TRACE_STREAM("Not found C2Work, index = " << incoming_frame_index.peeku());
                 // If not found, it might be removed by WaitWork. We don't need to return an error.
                 // FatalError(C2_CORRUPTED);
             }
         }
-        if (work) {
-            if (flushing) {
-                m_flushedWorks.push_back(std::move(work));
-            } else {
-                FillEmptyWork(std::move(work), res);
-            }
-        }
     }
 }
 
@@ -2334,19 +2335,20 @@ void MfxC2DecoderComponent::WaitWork(MfxC2FrameOut&& frame_out, mfxSyncPoint syn
 
     MfxC2FrameOut frameOutVpp;
     std::shared_ptr<mfxFrameSurface1> mfx_surface_vpp;
-    if(m_vppConversion) {
-        AllocateFrame(&frameOutVpp, true);
-        mfx_surface_vpp = frameOutVpp.GetMfxFrameSurface();
-
-        if (mfx_surface_vpp) {
-            mfxSyncPoint syncp;
-            mfx_res = m_vpp->RunFrameVPPAsync(mfx_surface.get(), mfx_surface_vpp.get(), NULL, &syncp);
-            if (MFX_ERR_NONE == mfx_res)
-#ifdef USE_ONEVPL
-                mfx_res = MFXVideoCORE_SyncOperation(m_mfxSession, syncp, MFX_TIMEOUT_INFINITE);
-#else
-                mfx_res = m_pSession->SyncOperation(syncp, MFX_TIMEOUT_INFINITE);
-#endif
+    if (m_vppConversion) {
+        res = AllocateFrame(&frameOutVpp, true);
+        if (res == C2_OK) {
+            mfx_surface_vpp = frameOutVpp.GetMfxFrameSurface();
+            if (mfx_surface_vpp.get()) {
+                mfxSyncPoint syncp;
+                mfx_res = m_vpp->RunFrameVPPAsync(mfx_surface.get(), mfx_surface_vpp.get(), NULL, &syncp);
+                if (MFX_ERR_NONE == mfx_res)
+    #ifdef USE_ONEVPL
+                    mfx_res = MFXVideoCORE_SyncOperation(m_mfxSession, syncp, MFX_TIMEOUT_INFINITE);
+    #else
+                    mfx_res = m_pSession->SyncOperation(syncp, MFX_TIMEOUT_INFINITE);
+    #endif
+            }
         }
     }
 
@@ -2387,6 +2389,10 @@ void MfxC2DecoderComponent::WaitWork(MfxC2FrameOut&& frame_out, mfxSyncPoint syn
             rect = C2Rect(mfx_surface->Info.CropW, mfx_surface->Info.CropH)
                           .at(mfx_surface->Info.CropX, mfx_surface->Info.CropY);
         } else {
+            if (mfx_surface_vpp.get() == nullptr) {
+                res = C2_CORRUPTED;
+                break;
+            }
             rect = C2Rect(mfx_surface_vpp->Info.CropW, mfx_surface_vpp->Info.CropH)
                           .at(mfx_surface_vpp->Info.CropX, mfx_surface_vpp->Info.CropY);
         }
diff --git a/c2_utils/src/mfx_gralloc1.cpp b/c2_utils/src/mfx_gralloc1.cpp
index 96addbfb..038260c9 100755
--- a/c2_utils/src/mfx_gralloc1.cpp
+++ b/c2_utils/src/mfx_gralloc1.cpp
@@ -278,13 +278,16 @@ buffer_handle_t MfxGralloc1Module::ImportBuffer(const buffer_handle_t rawHandle)
     MFX_DEBUG_TRACE_FUNC;
     c2_status_t res = C2_OK;
     buffer_handle_t *outBuffer = nullptr;
-    int32_t gr1_res = (*m_grImportBufferFunc)(m_gralloc1_dev, rawHandle, outBuffer);
+    buffer_handle_t out = nullptr;
 
+    int32_t gr1_res = (*m_grImportBufferFunc)(m_gralloc1_dev, rawHandle, outBuffer);
     if (GRALLOC1_ERROR_NONE != gr1_res || nullptr == outBuffer) {
         MFX_DEBUG_TRACE_I32(gr1_res);
         res = C2_BAD_STATE;
     }
-    buffer_handle_t out = const_cast<buffer_handle_t>(*outBuffer);
+
+    if (outBuffer)
+        out = const_cast<buffer_handle_t>(*outBuffer);
 
     MFX_DEBUG_TRACE__android_c2_status_t(res);
     return out;