NULL pointer dereference in skalibs's mininetstring_write()

From: Roman Khimov <khimov_at_altell.ru>
Date: Fri, 13 Mar 2015 17:50:06 +0300

Hello.

This one was catched by Clang's scan-build:

9 int mininetstring_write (int fd, char const *s, uint16 len, uint32 *w)
10 {
11 if (!w)
12 {
13 char pack[2] ;
14 uint16_pack_big(pack, len) ;
15 switch (fd_write(fd, pack, 2))
16 {
17 case -1 : return -1 ;
18 case 0 : return (errno = EAGAIN, -1) ;
19 case 1 : *w = (1U << 31) ; break ;
20 case 2 : *w = len ; break ;
21 default : return (errno = EDOM, -1) ;
22 }
23 }

It's obvious that if 'w' is NULL there will be NULL pointer dereference on
line 19 or 20. What's not so obvious is how to properly fix that. There is no
documentation for mininetstring_write() and I can only (wildly) guess what's
the intent here for the case of 'w' being NULL.



Received on Fri Mar 13 2015 - 14:50:06 UTC