[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Z7NXo1dfU-ULlFXG@pie.lan>
Date: Mon, 17 Feb 2025 15:37:38 +0000
From: Yao Zi <ziyao@...root.org>
To: musl@...ts.openwall.com
Cc: Anton Moryakov <ant.v.moryakov@...il.com>
Subject: Re: [PATCH] src: locale: fix potential NULL dereference in
iconv() in
On Mon, Feb 17, 2025 at 06:18:18PM +0300, Anton Moryakov wrote:
> Fixed a potential NULL dereference in iconv() by adding a check before
> accessing scd->state. If scd remains NULL due to cd & 1 != 0,
> dereferencing scd->state would cause undefined behavior.
>
> Previous code:
> switch (scd->state) { // Potential NULL dereference
>
> Fixed code:
> if (scd == NULL)
> goto ilseq;
> switch (scd->state) {
>
> This ensures that scd is properly validated before usage, preventing crashes.
> Although the situation where scd == NULL is unlikely, I would recommend adding this check
Why is the check necessary? I cannot find out a valid use case that the
scd pointer is NULL when converting from ISO2022_JP.
Please have a look at iconv_open().
Thanks,
Yao Zi
> Triggers found by static analyzer Svace.
>
> Signed-off-by: Anton Moryakov <ant.v.moryakov@...il.com>
>
> ---
> src/locale/iconv.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/src/locale/iconv.c b/src/locale/iconv.c
> index 52178950..ea3e8be1 100644
> --- a/src/locale/iconv.c
> +++ b/src/locale/iconv.c
> @@ -380,6 +380,8 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
> }
> goto ilseq;
> }
> + if(scd == NULL)
> + goto ilseq;
> switch (scd->state) {
> case 1:
> if (c=='\\') c = 0xa5;
> --
> 2.30.2
>
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
