* [PATCH] [iconv] Fix possible null-pointer dereference.
@ 2022-03-31 15:19 Dmitry Chestnyh
2022-03-31 15:47 ` Andreas Schwab
0 siblings, 1 reply; 7+ messages in thread
From: Dmitry Chestnyh @ 2022-03-31 15:19 UTC (permalink / raw)
To: libc-alpha; +Cc: Dmitry Chestnyh
This issue was found by SVACE static analyzer.
Dereference can appear at line 665 and there are no
obvious checks of `irrecersible` ptr value.
And seems that we can't be sure that this pointer
isn't NULL.
---
iconv/skeleton.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/iconv/skeleton.c b/iconv/skeleton.c
index 0356dbf92b..a296a9f944 100644
--- a/iconv/skeleton.c
+++ b/iconv/skeleton.c
@@ -659,6 +659,7 @@ FUNCTION_NAME (struct __gconv_step *step, struct __gconv_step_data *data,
/* Store information about how many bytes are available. */
data->__outbuf = outbuf;
+ assert(irreversible != NULL);
/* Remember how many non-identical characters we
converted in an irreversible way. */
*irreversible += lirreversible;
--
2.25.1
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] [iconv] Fix possible null-pointer dereference.
2022-03-31 15:19 [PATCH] [iconv] Fix possible null-pointer dereference Dmitry Chestnyh
@ 2022-03-31 15:47 ` Andreas Schwab
2022-03-31 15:56 ` Andreas Schwab
0 siblings, 1 reply; 7+ messages in thread
From: Andreas Schwab @ 2022-03-31 15:47 UTC (permalink / raw)
To: Dmitry Chestnyh; +Cc: libc-alpha
On Mär 31 2022, Dmitry Chestnyh wrote:
> diff --git a/iconv/skeleton.c b/iconv/skeleton.c
> index 0356dbf92b..a296a9f944 100644
> --- a/iconv/skeleton.c
> +++ b/iconv/skeleton.c
> @@ -659,6 +659,7 @@ FUNCTION_NAME (struct __gconv_step *step, struct __gconv_step_data *data,
> /* Store information about how many bytes are available. */
> data->__outbuf = outbuf;
>
> + assert(irreversible != NULL);
> /* Remember how many non-identical characters we
> converted in an irreversible way. */
> *irreversible += lirreversible;
I don't think this function is ever called with irreversible == NULL.
In fact, there is such an assertion in __gconv.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] [iconv] Fix possible null-pointer dereference.
2022-03-31 15:47 ` Andreas Schwab
@ 2022-03-31 15:56 ` Andreas Schwab
2022-03-31 15:58 ` Dmitriy Chestnyh
0 siblings, 1 reply; 7+ messages in thread
From: Andreas Schwab @ 2022-03-31 15:56 UTC (permalink / raw)
To: Dmitry Chestnyh; +Cc: libc-alpha
On Mär 31 2022, Andreas Schwab wrote:
> On Mär 31 2022, Dmitry Chestnyh wrote:
>
>> diff --git a/iconv/skeleton.c b/iconv/skeleton.c
>> index 0356dbf92b..a296a9f944 100644
>> --- a/iconv/skeleton.c
>> +++ b/iconv/skeleton.c
>> @@ -659,6 +659,7 @@ FUNCTION_NAME (struct __gconv_step *step, struct __gconv_step_data *data,
>> /* Store information about how many bytes are available. */
>> data->__outbuf = outbuf;
>>
>> + assert(irreversible != NULL);
>> /* Remember how many non-identical characters we
>> converted in an irreversible way. */
>> *irreversible += lirreversible;
>
> I don't think this function is ever called with irreversible == NULL.
> In fact, there is such an assertion in __gconv.
Except that __gconv_transliterate does pass NULL here.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] [iconv] Fix possible null-pointer dereference.
2022-03-31 15:56 ` Andreas Schwab
@ 2022-03-31 15:58 ` Dmitriy Chestnyh
2022-03-31 16:43 ` Andreas Schwab
0 siblings, 1 reply; 7+ messages in thread
From: Dmitriy Chestnyh @ 2022-03-31 15:58 UTC (permalink / raw)
To: Andreas Schwab; +Cc: libc-alpha
So the patch may be useful?
________________________________
От: Andreas Schwab <schwab@linux-m68k.org>
Отправлено: 31 марта 2022 г. 18:56:08
Кому: Dmitriy Chestnyh
Копия: libc-alpha@sourceware.org
Тема: Re: [PATCH] [iconv] Fix possible null-pointer dereference.
On Mär 31 2022, Andreas Schwab wrote:
> On Mär 31 2022, Dmitry Chestnyh wrote:
>
>> diff --git a/iconv/skeleton.c b/iconv/skeleton.c
>> index 0356dbf92b..a296a9f944 100644
>> --- a/iconv/skeleton.c
>> +++ b/iconv/skeleton.c
>> @@ -659,6 +659,7 @@ FUNCTION_NAME (struct __gconv_step *step, struct __gconv_step_data *data,
>> /* Store information about how many bytes are available. */
>> data->__outbuf = outbuf;
>>
>> + assert(irreversible != NULL);
>> /* Remember how many non-identical characters we
>> converted in an irreversible way. */
>> *irreversible += lirreversible;
>
> I don't think this function is ever called with irreversible == NULL.
> In fact, there is such an assertion in __gconv.
Except that __gconv_transliterate does pass NULL here.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] [iconv] Fix possible null-pointer dereference.
2022-03-31 15:58 ` Dmitriy Chestnyh
@ 2022-03-31 16:43 ` Andreas Schwab
0 siblings, 0 replies; 7+ messages in thread
From: Andreas Schwab @ 2022-03-31 16:43 UTC (permalink / raw)
To: Dmitriy Chestnyh; +Cc: libc-alpha
It may actually be possible to reach this point with irreversible ==
NULL.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] iconv: Fix possible null-pointer dereference.
2022-03-31 12:55 [PATCH] iconv: " Dmitry Chestnyh
@ 2022-03-31 13:24 ` Andreas Schwab
0 siblings, 0 replies; 7+ messages in thread
From: Andreas Schwab @ 2022-03-31 13:24 UTC (permalink / raw)
To: Dmitry Chestnyh; +Cc: libc-alpha
On Mär 31 2022, Dmitry Chestnyh wrote:
> The dereference can appear at iconv.c:54.
When inbuf isn't NULL then outbuf cannot be NULL.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH] iconv: Fix possible null-pointer dereference.
@ 2022-03-31 12:55 Dmitry Chestnyh
2022-03-31 13:24 ` Andreas Schwab
0 siblings, 1 reply; 7+ messages in thread
From: Dmitry Chestnyh @ 2022-03-31 12:55 UTC (permalink / raw)
To: libc-alpha; +Cc: Dmitry Chestnyh
The dereference can appear at iconv.c:54.
This problem was found by SVACE static analyzer.
---
iconv/iconv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/iconv/iconv.c b/iconv/iconv.c
index e805c4c59d..1c3c517ad3 100644
--- a/iconv/iconv.c
+++ b/iconv/iconv.c
@@ -35,7 +35,7 @@ iconv (iconv_t cd, char **inbuf, size_t *inbytesleft, char **outbuf,
size_t irreversible;
int result;
- if (__glibc_unlikely (inbuf == NULL || *inbuf == NULL))
+ if (__glibc_unlikely (inbuf == NULL || *inbuf == NULL || outbuf == NULL))
{
if (outbuf == NULL || *outbuf == NULL)
result = __gconv (gcd, NULL, NULL, NULL, NULL, &irreversible);
--
2.25.1
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-03-31 16:43 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-31 15:19 [PATCH] [iconv] Fix possible null-pointer dereference Dmitry Chestnyh
2022-03-31 15:47 ` Andreas Schwab
2022-03-31 15:56 ` Andreas Schwab
2022-03-31 15:58 ` Dmitriy Chestnyh
2022-03-31 16:43 ` Andreas Schwab
-- strict thread matches above, loose matches on Subject: below --
2022-03-31 12:55 [PATCH] iconv: " Dmitry Chestnyh
2022-03-31 13:24 ` Andreas Schwab
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).