From: Darren Kenny <darren.kenny@oracle.com>
To: Bruno Haible <bruno@clisp.org>, bug-gnulib@gnu.org
Subject: Re: [PATCH 2/3] lib/argp-help: Fix possible dereference of a NULL state
Date: Mon, 21 Jun 2021 10:32:57 +0100 [thread overview]
Message-ID: <m2pmwfimuu.fsf@oracle.com> (raw)
In-Reply-To: <2605779.ugxd0eSEJy@omega>
On Friday, 2021-06-18 at 19:36:55 +02, Bruno Haible wrote:
> Darren Kenny wrote:
>> All other instances of call to __argp_failure() where there is
>> a dgettext() call first check whether the valie of state is NULL
>> before attempting to dereference it to get the root_argp->argp_domain.
>>
>> This was originally found during a Coverity scan of GRUB2.
>
> Thanks. I confirm that that is a possible NULL dereference here. I've
> applied your patch.
>
> The notation '(tiny change) is explained in
> <https://www.gnu.org/prep/maintain/html_node/Legally-Significant.html>.
>
>
> 2021-06-18 Darren Kenny <darren.kenny@oracle.com> (tiny change)
>
> argp: Avoid possible NULL access in argp_help.
> Reported by Coverity. The invocation chain is:
> argp_help -> _help -> fill_in_uparams -> validate_uparams.
> * lib/argp-help.c (validate_uparams): Don't crash if state == NULL.
>
> diff --git a/lib/argp-help.c b/lib/argp-help.c
> index 4c89697..80cdb44 100644
> --- a/lib/argp-help.c
> +++ b/lib/argp-help.c
> @@ -147,7 +147,8 @@ validate_uparams (const struct argp_state *state, struct uparams *upptr)
> if (*(int *)((char *)upptr + up->uparams_offs) >= upptr->rmargin)
> {
> __argp_failure (state, 0, 0,
> - dgettext (state->root_argp->argp_domain,
> + dgettext (state == NULL ? NULL
> + : state->root_argp->argp_domain,
> "\
> ARGP_HELP_FMT: %s value is less than or equal to %s"),
> "rmargin", up->name);
Thanks Bruno.
next prev parent reply other threads:[~2021-06-21 9:33 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-18 15:44 [PATCH 0/3] Some Coverity fixes from GRUB Darren Kenny
2021-06-18 15:44 ` [PATCH 1/3] lib/regexec: Fix possible null-dereference Darren Kenny
2021-08-11 7:28 ` Paul Eggert
2021-08-23 10:05 ` Darren Kenny
2021-08-23 20:09 ` Paul Eggert
2021-08-24 15:11 ` Darren Kenny
2021-08-24 18:52 ` Paul Eggert
2021-06-18 15:44 ` [PATCH 2/3] lib/argp-help: Fix possible dereference of a NULL state Darren Kenny
2021-06-18 17:36 ` Bruno Haible
2021-06-21 9:32 ` Darren Kenny [this message]
2021-06-18 15:44 ` [PATCH 3/3] lib/regexec: Resolve unused variable Darren Kenny
2021-08-11 7:24 ` Paul Eggert
2021-08-23 10:38 ` Darren Kenny
2021-08-23 13:00 ` Bruno Haible
2021-08-23 21:04 ` Paul Eggert
2021-08-06 14:29 ` [PATCH 0/3] Some Coverity fixes from GRUB Darren Kenny
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://lists.gnu.org/mailman/listinfo/bug-gnulib
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=m2pmwfimuu.fsf@oracle.com \
--to=darren.kenny@oracle.com \
--cc=bruno@clisp.org \
--cc=bug-gnulib@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).