Messages in this thread | | | Date | Mon, 9 Jan 2023 13:23:40 +0200 | From | Andy Shevchenko <> | Subject | Re: [PATCH] vsprintf: fix possible NULL pointer deref in vsnprintf() |
| |
On Fri, Jan 06, 2023 at 12:16:31AM +0300, Sergey Shtylyov wrote: > In vsnprintf() etc, C99 allows the 'buf' argument to be NULL when the > 'size' argument equals 0. Let us treat NULL passed as if the 'buf' > argument pointed to a 0-sized buffer, so that we can avoid a NULL pointer > dereference and still return the # of characters that would be written if > 'buf' pointed to a valid buffer... > > Found by Linux Verification Center (linuxtesting.org) with the SVACE static > analysis tool.
...
> + /* > + * C99 allows @buf to be NULL when @size is 0. We treat such NULL as if > + * @buf pointed to 0-sized buffer, so we can both avoid a NULL pointer > + * dereference and still return # of characters that would be written > + * if @buf pointed to a valid buffer... > + */ > + if (!buf) > + size = 0;
Do we have test cases for that?
And what's wrong to print "(null)" ? Have you checked if your patch makes any regressions to those cases?
-- With Best Regards, Andy Shevchenko
| |