58 lines
2.3 KiB
Diff
58 lines
2.3 KiB
Diff
|
From d24073823fa7d82726f631628923e9a5378d529d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Alexey Tikhonov <atikhono@redhat.com>
|
||
|
|
Date: Mon, 18 Mar 2024 12:15:21 +0100
|
||
|
|
Subject: [PATCH] UTILS: inotify: avoid potential NULL deref
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
Fixes following error:
|
||
|
|
```
|
||
|
|
Error: STRING_NULL (CWE-170):
|
||
|
|
sssd-2.9.1/src/util/inotify.c:298: string_null_source: Function ""read"" does not terminate string ""ev_buf"". [Note: The source code implementation of the function has been overridden by a builtin model.]
|
||
|
|
sssd-2.9.1/src/util/inotify.c:316: var_assign_var: Assigning: ""ptr"" = ""ev_buf"". Both now point to the same unterminated string.
|
||
|
|
sssd-2.9.1/src/util/inotify.c:320: var_assign_var: Assigning: ""in_event"" = ""ptr"". Both now point to the same unterminated string.
|
||
|
|
sssd-2.9.1/src/util/inotify.c:327: string_null: Passing unterminated string ""in_event->name"" to ""process_dir_event"", which expects a null-terminated string.
|
||
|
|
# 325|
|
||
|
|
# 326| if (snctx->wctx->dir_wd == in_event->wd) {
|
||
|
|
# 327|-> ret = process_dir_event(snctx, in_event);
|
||
|
|
# 328| } else if (snctx->wctx->file_wd == in_event->wd) {
|
||
|
|
# 329| ret = process_file_event(snctx, in_event);
|
||
|
|
```
|
||
|
|
-- it might be unsafe to dereference `in_event->name`
|
||
|
|
if `in_event->len == 0`
|
||
|
|
|
||
|
|
Reviewed-by: Alejandro López <allopez@redhat.com>
|
||
|
|
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
||
|
|
|
||
|
|
Reference:https://github.com/SSSD/sssd/commit/4085ee07926303aa26e46dfcc6dec87776432c62
|
||
|
|
Conflict:NA
|
||
|
|
|
||
|
|
---
|
||
|
|
src/util/inotify.c | 8 ++++++--
|
||
|
|
1 file changed, 6 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/util/inotify.c b/src/util/inotify.c
|
||
|
|
index a3c33ed..8192cfd 100644
|
||
|
|
--- a/src/util/inotify.c
|
||
|
|
+++ b/src/util/inotify.c
|
||
|
|
@@ -233,9 +233,13 @@ static errno_t process_dir_event(struct snotify_ctx *snctx,
|
||
|
|
{
|
||
|
|
errno_t ret;
|
||
|
|
|
||
|
|
+ if (in_event->len == 0) {
|
||
|
|
+ DEBUG(SSSDBG_TRACE_FUNC, "Not interested in nameless event\n");
|
||
|
|
+ return EOK;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
DEBUG(SSSDBG_TRACE_ALL, "inotify name: %s\n", in_event->name);
|
||
|
|
- if (in_event->len == 0 \
|
||
|
|
- || strcmp(in_event->name, snctx->base_name) != 0) {
|
||
|
|
+ if (strcmp(in_event->name, snctx->base_name) != 0) {
|
||
|
|
DEBUG(SSSDBG_TRACE_FUNC, "Not interested in %s\n", in_event->name);
|
||
|
|
return EOK;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.33.0
|
||
|
|
|