[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20240112174650.6216eccd@hermes.local>
Date: Fri, 12 Jan 2024 17:46:50 -0800
From: Stephen Hemminger <stephen@...workplumber.org>
To: Maks Mishin <maks.mishinfz@...il.com>
Cc: netdev@...r.kernel.org
Subject: Re: [PATCH] ifstat: Add NULL pointer check for argument of strdup()
On Wed, 10 Jan 2024 23:52:52 +0300
Maks Mishin <maks.mishinfz@...il.com> wrote:
> When calling a strdup() function its argument do not being checked
> for NULL pointer.
> Added NULL pointer checks in body of get_nlmsg_extended(), get_nlmsg() and
> load_raw_data() functions.
>
> Signed-off-by: Maks Mishin <maks.mishinFZ@...il.com>
Yes, ifstat has lots of poor memory management, but this patch
isn't addressing it.
> ---
> misc/ifstat.c | 17 +++++++++++++++--
> 1 file changed, 15 insertions(+), 2 deletions(-)
>
> diff --git a/misc/ifstat.c b/misc/ifstat.c
> index f6f9ba50..ee301799 100644
> --- a/misc/ifstat.c
> +++ b/misc/ifstat.c
> @@ -129,7 +129,12 @@ static int get_nlmsg_extended(struct nlmsghdr *m, void *arg)
> abort();
>
> n->ifindex = ifsm->ifindex;
> - n->name = strdup(ll_index_to_name(ifsm->ifindex));
> + const char *name = ll_index_to_name(ifsm->ifindex);
> +
> + if (name == NULL)
> + return -1;
> +
> + n->name = strdup(name);
>
What if strdup() returns NULL?
The error handling in ifstat is frankly aweful.
It just calls abort() everywhere.
> if (sub_type == NO_SUB_TYPE) {
> memcpy(&n->val, RTA_DATA(tb[filter_type]), sizeof(n->val));
> @@ -175,7 +180,12 @@ static int get_nlmsg(struct nlmsghdr *m, void *arg)
> if (!n)
> abort();
> n->ifindex = ifi->ifi_index;
> - n->name = strdup(RTA_DATA(tb[IFLA_IFNAME]));
> + const char *name = RTA_DATA(tb[IFLA_IFNAME]);
> +
> + if (name == NULL)
> + return -1;
This NULL check can't happen. A few lines above, there is check for tb[IFLA_IFNAME]
being NULL, and RTA_DATA() is macro that just offsets that netlink attribute
to find the data.
> +
> + n->name = strdup(name);
> memcpy(&n->ival, RTA_DATA(tb[IFLA_STATS]), sizeof(n->ival));
> memset(&n->rate, 0, sizeof(n->rate));
> for (i = 0; i < MAXS; i++)
> @@ -263,6 +273,9 @@ static void load_raw_table(FILE *fp)
> abort();
> *next++ = 0;
>
> + if (p == NULL)
> + abort();
> +
> n->name = strdup(p);
> p = next;
>
Powered by blists - more mailing lists