avoid possible null-pointer dereference in error-path

[hmcfgusb] / hmcfgusb.c

diff --git a/hmcfgusb.c b/hmcfgusb.c
index c90410a4d0ad2411dcc228ac9c2f291e6e44af0e..83c9719b04b0d71e7324343a4aa75e7f147d3f87 100644 (file)
--- a/hmcfgusb.c
+++ b/hmcfgusb.c
@@ -285,8 +285,11 @@ static void LIBUSB_CALL hmcfgusb_interrupt(struct libusb_transfer *transfer)
        if (err != 0) {
                fprintf(stderr, "Can't re-submit transfer: %s\n", usb_strerror(err));
                libusb_free_transfer(transfer);
-               cb_data->dev->transfer = NULL;
-               free(cb_data);
+               if (cb_data) {
+                       if (cb_data->dev)
+                               cb_data->dev->transfer = NULL;
+                       free(cb_data);
+               }
        }
 }
 
@@ -433,13 +436,11 @@ int hmcfgusb_poll(struct hmcfgusb_dev *dev, int timeout)
                return -1;
        } else if (err == 0) {
                /* No pending timeout or a sane platform */
-               tv.tv_sec = timeout;
        } else {
                if ((tv.tv_sec == 0) && (tv.tv_usec == 0)) {
                        usb_event = 1;
-               } else if (tv.tv_sec > timeout) {
-                       tv.tv_sec = timeout;
-                       tv.tv_usec = 0;
+               } else if ((tv.tv_sec * 1000) < timeout) {
+                       timeout = tv.tv_sec * 1000;
                }
        }
 
@@ -448,7 +449,7 @@ int hmcfgusb_poll(struct hmcfgusb_dev *dev, int timeout)
                        dev->pfd[i].revents = 0;
                }
 
-               n = poll(dev->pfd, dev->n_pfd, tv.tv_sec * 1000);
+               n = poll(dev->pfd, dev->n_pfd, timeout);
                if (n < 0) {
                        perror("poll");
                        errno = 0;