Pārlūkot izejas kodu

Bug 630097 - (cov#11938) NULL dereference in mmldif

There is a chance that we can deference a NULL pointer in the
mmldif code.  If "(numb > tot_b)" is true, it is not guaranteed
that "a" is non-NULL.  We need to check if "a" is NULL before
dereferencing it in the "(cmp < 0)" case.
Nathan Kinder 15 gadi atpakaļ
vecāks
revīzija
243ba589c5
1 mainītis faili ar 1 papildinājumiem un 1 dzēšanām
  1. 1 1
      ldap/servers/slapd/tools/mmldif.c

+ 1 - 1
ldap/servers/slapd/tools/mmldif.c

@@ -1086,7 +1086,7 @@ addmodified(FILE * edf3, attrib1_t * attrib, record_t * first)
         } else {
         } else {
             cmp = stricmp(a->name, attribname(b));
             cmp = stricmp(a->name, attribname(b));
         }
         }
-        if (cmp < 0) {
+        if ((cmp < 0) && (a != NULL)) {
             /* a < b: a is deleted */
             /* a < b: a is deleted */
             attrname = a->name;
             attrname = a->name;
             fprintf(edf3, "delete: %s\n-\n", attrname);
             fprintf(edf3, "delete: %s\n-\n", attrname);