Skip to contentSkip to conversation

e2fsprogs: fix potential null ptr defef in check_for_modules()

PATCH Applied Eric Sandeen 2 participants 3 messages Feb 24, 2009 – Mar 6, 2009

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 e2fsprogs: fix potential null ptr defef in check_for_modules()

The coverity scanner found this one.

If a line in modules.dep has a ":" but no "/" then:

                if ((cp = strchr(buf, ':')) != NULL)
                        *cp = 0;
                else
                        continue;
                if ((cp = strrchr(buf, '/')) != NULL)
                        cp++;
                /* XXX else cp is still null */
                i = strlen(cp);

... we will deref a null pointer (cp). This can be demonstrated by putting a line like:

foo.ko:

into modules.dep. The below change just says that if no "/" is found, treat the whole string as the module name.

---

e2fsck/util.c +2 -0
Index: e2fsprogs/e2fsck/util.c
===================================================================
@@ -663,6 +663,8 @@ int check_for_modules(const char *fs_nam
 			continue;
 		if ((cp = strrchr(buf, '/')) != NULL)
 			cp++;
+		else
+			cp = buf;
 		i = strlen(cp);
 		if (i > 3) {
 			t = cp + i - 3;
lib/blkid/probe.c +2 -0
Index: e2fsprogs/lib/blkid/probe.c
===================================================================
@@ -227,6 +227,8 @@ static int check_for_modules(const char 
 			continue;
 		if ((cp = strrchr(buf, '/')) != NULL)
 			cp++;
+		else
+			cp = buf;
 		i = strlen(cp);
 		if (i > 3) {
 			t = cp + i - 3;
#1 lore raw

Re: [PATCH] e2fsprogs: fix potential null ptr deref in check_for_modules()

Quoted 13 lines · Eric Sandeen

The coverity scanner found this one.

If a line in modules.dep has a ":" but no "/" then:

                if ((cp = strchr(buf, ':')) != NULL)
                        *cp = 0;
                else
                        continue;
                if ((cp = strrchr(buf, '/')) != NULL)
                        cp++;
                /* XXX else cp is still null */
                i = strlen(cp);
Quoted 7 lines

... we will deref a null pointer (cp). This can be demonstrated by putting a line like:

foo.ko:

into modules.dep. The below change just says that if no "/" is found, treat the whole string as the module name.

FWIW; this resolves RH bugzilla:
[Bug 486997] rawhide's init/nash segfaults in libblkid

and also is an extension of the patch Jim sent a couple days ago.

The issue is that for fedora initrds, anyway, modules dep is something like:

crc16.ko:
ext4.ko: jbd2.ko crc16.ko
...

so it hits exactly this case.

-Eric

Quoted 34 lines

---

Index: e2fsprogs/e2fsck/util.c
===================================================================

e2fsck/util.c +2 -0
@@ -663,6 +663,8 @@ int check_for_modules(const char *fs_nam
 			continue;
 		if ((cp = strrchr(buf, '/')) != NULL)
 			cp++;
+		else
+			cp = buf;
 		i = strlen(cp);
 		if (i > 3) {
 			t = cp + i - 3;

Index: e2fsprogs/lib/blkid/probe.c
===================================================================

lib/blkid/probe.c +2 -1
@@ -227,6 +227,8 @@ static int check_for_modules(const char 
 			continue;
 		if ((cp = strrchr(buf, '/')) != NULL)
 			cp++;
+		else
+			cp = buf;
 		i = strlen(cp);
 		if (i > 3) {
 			t = cp + i - 3;
 
--

To unsubscribe from this list: send the line "unsubscribe linux-ext4" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

Applied
#2 lore raw
In reply to Eric Sandeen
Quoted 13 lines · Eric Sandeen

The coverity scanner found this one.

If a line in modules.dep has a ":" but no "/" then:

                if ((cp = strchr(buf, ':')) != NULL)
                        *cp = 0;
                else
                        continue;
                if ((cp = strrchr(buf, '/')) != NULL)
                        cp++;
                /* XXX else cp is still null */
                i = strlen(cp);
Quoted 7 lines

... we will deref a null pointer (cp). This can be demonstrated by putting a line like:

foo.ko:

into modules.dep. The below change just says that if no "/" is found, treat the whole string as the module name.

Thanks, applied to the e2fsprogs git tree.

- Ted