[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20250217231740.GB1827@brightrain.aerifal.cx>
Date: Mon, 17 Feb 2025 18:17:40 -0500
From: Rich Felker <dalias@...c.org>
To: Anton Moryakov <ant.v.moryakov@...il.com>
Cc: Yao Zi <ziyao@...root.org>, musl@...ts.openwall.com
Subject: Re: [PATCH] src: locale: fix potential NULL dereference in
iconv() in
On Mon, Feb 17, 2025 at 06:50:48PM +0300, Anton Moryakov wrote:
> Thanks for the feedback!
>
> пн, 17 февр. 2025 г. в 18:38, Yao Zi <ziyao@...root.org>:
>
> > On Mon, Feb 17, 2025 at 06:18:18PM +0300, Anton Moryakov wrote:
> > > Fixed a potential NULL dereference in iconv() by adding a check before
> > > accessing scd->state. If scd remains NULL due to cd & 1 != 0,
> > > dereferencing scd->state would cause undefined behavior.
> > >
> > > Previous code:
> > > switch (scd->state) { // Potential NULL dereference
> > >
> > > Fixed code:
> > > if (scd == NULL)
> > > goto ilseq;
> > > switch (scd->state) {
> > >
> > > This ensures that scd is properly validated before usage, preventing
> > crashes.
> > > Although the situation where scd == NULL is unlikely, I would recommend
> > adding this check
> >
> > Why is the check necessary? I cannot find out a valid use case that the
> > scd pointer is NULL when converting from ISO2022_JP.
> >
> > Please have a look at iconv_open().
Indeed, ISO2022_JP is the primary motivation for the existence of scd
and necessarily has scd!=0. If this invariant somehow weren't met due
to a bug, faulting on the access is the desired outcome. Treating a
violation of the invariant as an illegal input sequence error is
completely the wrong thing to do.
> > > Triggers found by static analyzer Svace.
>From the results so far, it sounds like this is a very poor tool.
Is it suggesting the changes and change descriptions you're sending?
If not, is there another tool layered on top of it you're using that's
generating them according to some LLM, or are you writing them
yourself?
Rich
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
