lkml.org 
[lkml]   [2023]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] vsprintf: fix possible NULL pointer deref in vsnprintf()
On Fri, Jan 06, 2023 at 12:16:31AM +0300, Sergey Shtylyov wrote:
> In vsnprintf() etc, C99 allows the 'buf' argument to be NULL when the
> 'size' argument equals 0. Let us treat NULL passed as if the 'buf'
> argument pointed to a 0-sized buffer, so that we can avoid a NULL pointer
> dereference and still return the # of characters that would be written if
> 'buf' pointed to a valid buffer...
>
> Found by Linux Verification Center (linuxtesting.org) with the SVACE static
> analysis tool.

...

> + /*
> + * C99 allows @buf to be NULL when @size is 0. We treat such NULL as if
> + * @buf pointed to 0-sized buffer, so we can both avoid a NULL pointer
> + * dereference and still return # of characters that would be written
> + * if @buf pointed to a valid buffer...
> + */
> + if (!buf)
> + size = 0;

Do we have test cases for that?

And what's wrong to print "(null)" ? Have you checked if your patch makes any
regressions to those cases?

--
With Best Regards,
Andy Shevchenko


\
 
 \ /
  Last update: 2023-03-26 23:33    [W:0.053 / U:1.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site