107 lines
3.6 KiB
Diff
107 lines
3.6 KiB
Diff
|
From 0b9b9d659880a3084ec0a5b49f07f387de7b0f0c Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Stephen Hemminger <stephen@networkplumber.org>
|
|||
|
|
Date: Mon, 8 May 2023 19:21:27 -0700
|
|||
|
|
Subject: [PATCH] tc_exec: don't dereference NULL on calloc failure
|
|||
|
|
MIME-Version: 1.0
|
|||
|
|
Content-Type: text/plain; charset=UTF-8
|
|||
|
|
Content-Transfer-Encoding: 8bit
|
|||
|
|
|
|||
|
|
Reported as:
|
|||
|
|
tc_exec.c: In function ‘do_exec’:
|
|||
|
|
tc_exec.c:103:18: warning: dereference of NULL ‘eu’ [CWE-476] [-Wanalyzer-null-dereference]
|
|||
|
|
103 | return eu->parse_eopt(eu, argc, argv);
|
|||
|
|
| ~~^~~~~~~~~~~~
|
|||
|
|
‘do_exec’: events 1-6
|
|||
|
|
|
|
|||
|
|
| 81 | int do_exec(int argc, char **argv)
|
|||
|
|
| | ^~~~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (1) entry to ‘do_exec’
|
|||
|
|
|......
|
|||
|
|
| 86 | if (argc < 1) {
|
|||
|
|
| | ~
|
|||
|
|
| | |
|
|||
|
|
| | (2) following ‘false’ branch (when ‘argc > 0’)...
|
|||
|
|
|......
|
|||
|
|
| 91 | if (matches(*argv, "help") == 0) {
|
|||
|
|
| | ~~~~~~~~~~~~~~~~~~~~~~~
|
|||
|
|
| | ||
|
|||
|
|
| | |(3) ...to here
|
|||
|
|
| | (4) following ‘true’ branch...
|
|||
|
|
|......
|
|||
|
|
| 96 | strncpy(kind, *argv, sizeof(kind) - 1);
|
|||
|
|
| | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (5) ...to here
|
|||
|
|
| 97 |
|
|||
|
|
| 98 | eu = get_exec_kind(kind);
|
|||
|
|
| | ~~~~~~~~~~~~~~~~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (6) calling ‘get_exec_kind’ from ‘do_exec’
|
|||
|
|
|
|
|||
|
|
+--> ‘get_exec_kind’: events 7-10
|
|||
|
|
|
|
|||
|
|
| 40 | static struct exec_util *get_exec_kind(const char *name)
|
|||
|
|
| | ^~~~~~~~~~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (7) entry to ‘get_exec_kind’
|
|||
|
|
|......
|
|||
|
|
| 63 | if (eu == NULL)
|
|||
|
|
| | ~
|
|||
|
|
| | |
|
|||
|
|
| | (8) following ‘true’ branch (when ‘eu’ is NULL)...
|
|||
|
|
| 64 | goto noexist;
|
|||
|
|
| | ~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (9) ...to here
|
|||
|
|
|......
|
|||
|
|
| 72 | if (eu) {
|
|||
|
|
| | ~
|
|||
|
|
| | |
|
|||
|
|
| | (10) following ‘false’ branch (when ‘eu’ is NULL)...
|
|||
|
|
|
|
|||
|
|
‘get_exec_kind’: event 11
|
|||
|
|
|
|
|||
|
|
|cc1:
|
|||
|
|
| (11): ...to here
|
|||
|
|
|
|
|||
|
|
<------+
|
|||
|
|
|
|
|||
|
|
‘do_exec’: events 12-13
|
|||
|
|
|
|
|||
|
|
| 98 | eu = get_exec_kind(kind);
|
|||
|
|
| | ^~~~~~~~~~~~~~~~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (12) return of NULL to ‘do_exec’ from ‘get_exec_kind’
|
|||
|
|
|......
|
|||
|
|
| 103 | return eu->parse_eopt(eu, argc, argv);
|
|||
|
|
| | ~~~~~~~~~~~~~~
|
|||
|
|
| | |
|
|||
|
|
| | (13) dereference of NULL ‘eu’
|
|||
|
|
|
|
|||
|
|
|
|||
|
|
Fixes: 4bd624467bc6 ("tc: built-in eBPF exec proxy")
|
|||
|
|
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
|
|||
|
|
---
|
|||
|
|
tc/tc_exec.c | 4 ++++
|
|||
|
|
1 file changed, 4 insertions(+)
|
|||
|
|
|
|||
|
|
diff --git a/tc/tc_exec.c b/tc/tc_exec.c
|
|||
|
|
index 5d883402..182fbb4c 100644
|
|||
|
|
--- a/tc/tc_exec.c
|
|||
|
|
+++ b/tc/tc_exec.c
|
|||
|
|
@@ -96,6 +96,10 @@ int do_exec(int argc, char **argv)
|
|||
|
|
strncpy(kind, *argv, sizeof(kind) - 1);
|
|||
|
|
|
|||
|
|
eu = get_exec_kind(kind);
|
|||
|
|
+ if (eu == NULL) {
|
|||
|
|
+ fprintf(stderr, "Allocation failed finding exec\n");
|
|||
|
|
+ return -1;
|
|||
|
|
+ }
|
|||
|
|
|
|||
|
|
argc--;
|
|||
|
|
argv++;
|
|||
|
|
--
|
|||
|
|
2.27.0
|
|||
|
|
|