102-fix-potential-deref-of-null-error.patch 1.6 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455
  1. strip.c: Pointer `arhdr` created at strip.c:2741 and then dereferenced without NULL-check.
  2. The same situation for the `arhdr` pointer at the objdump.c:313 and
  3. the `h` pointer at the readelf.c:13545.
  4. Triggers found by static analyzer Svace.
  5. Signed-off-by: Maks Mishin <[email protected]>
  6. ---
  7. src/objdump.c | 5 +++++
  8. src/readelf.c | 5 +++++
  9. src/strip.c | 5 +++++
  10. 3 files changed, 15 insertions(+)
  11. --- a/src/objdump.c
  12. +++ b/src/objdump.c
  13. @@ -311,6 +311,11 @@ handle_ar (int fd, Elf *elf, const char
  14. {
  15. /* The the header for this element. */
  16. Elf_Arhdr *arhdr = elf_getarhdr (subelf);
  17. + if (arhdr == NULL)
  18. + {
  19. + printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
  20. + exit (1);
  21. + }
  22. /* Skip over the index entries. */
  23. if (strcmp (arhdr->ar_name, "/") != 0
  24. --- a/src/readelf.c
  25. +++ b/src/readelf.c
  26. @@ -13543,6 +13543,11 @@ dump_archive_index (Elf *elf, const char
  27. as_off, fname, elf_errmsg (-1));
  28. const Elf_Arhdr *h = elf_getarhdr (subelf);
  29. + if (h == NULL)
  30. + {
  31. + printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
  32. + exit (1);
  33. + }
  34. printf (_("Archive member '%s' contains:\n"), h->ar_name);
  35. --- a/src/strip.c
  36. +++ b/src/strip.c
  37. @@ -2739,6 +2739,11 @@ handle_ar (int fd, Elf *elf, const char
  38. {
  39. /* The the header for this element. */
  40. Elf_Arhdr *arhdr = elf_getarhdr (subelf);
  41. + if (arhdr == NULL)
  42. + {
  43. + printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
  44. + exit (1);
  45. + }
  46. if (elf_kind (subelf) == ELF_K_ELF)
  47. result |= handle_elf (fd, subelf, new_prefix, arhdr->ar_name, 0, NULL);