From patchwork Mon Feb 9 10:47:57 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miroslav Rezanina X-Patchwork-Id: 437867 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 1BF7C140119 for ; Mon, 9 Feb 2015 21:48:30 +1100 (AEDT) Received: from localhost ([::1]:60008 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YKltE-0000DQ-D2 for incoming@patchwork.ozlabs.org; Mon, 09 Feb 2015 05:48:28 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49796) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YKlss-0008AQ-8x for qemu-devel@nongnu.org; Mon, 09 Feb 2015 05:48:10 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YKlso-00070C-CA for qemu-devel@nongnu.org; Mon, 09 Feb 2015 05:48:06 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58134) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YKlso-0006zm-5v for qemu-devel@nongnu.org; Mon, 09 Feb 2015 05:48:02 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t19Am12i019346 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Mon, 9 Feb 2015 05:48:01 -0500 Received: from lws-ntb.brq.redhat.com (ovpn-116-45.ams2.redhat.com [10.36.116.45]) by int-mx11.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t19AlxPg005807; Mon, 9 Feb 2015 05:48:00 -0500 From: mrezanin@redhat.com To: qemu-devel@nongnu.org Date: Mon, 9 Feb 2015 11:47:57 +0100 Message-Id: <1423478877-12053-1-git-send-email-mrezanin@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.24 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 209.132.183.28 Cc: armbru@redhat.com, stefanha@redhat.com Subject: [Qemu-devel] [PATCHv2] Prevent segmentation fault in case of relative resolve of uri X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Miroslav Rezanina It was possible to call strcmp with NULL argument, that can cause segmentation fault. Properly checking parameters to prevent this situation. Signed-off-by: Miroslav Rezanina --- v2: - instead of adding NULL checks to strcmp call refactor whole NULL checking path. This will remove dead code and make whole checking easier to understand. Relative path generation part is not touched as I'm not fully sure of correct behavior and purpose of this patch is to prevent segmentation fault. --- util/uri.c | 55 +++++++++++++++++++++++++------------------------------ 1 file changed, 25 insertions(+), 30 deletions(-) diff --git a/util/uri.c b/util/uri.c index 918d235..23dbaca 100644 --- a/util/uri.c +++ b/util/uri.c @@ -1964,44 +1964,39 @@ uri_resolve_relative (const char *uri, const char * base) * If the scheme / server on the URI differs from the base, * just return the URI */ - if ((ref->scheme != NULL) && - ((bas->scheme == NULL) || - (strcmp (bas->scheme, ref->scheme)) || - (strcmp (bas->server, ref->server)))) { - val = g_strdup (uri); - goto done; + + if ((ref->scheme != NULL) && + ((bas->scheme == NULL) || (strcmp (bas->scheme, ref->scheme)))) { + val = g_strdup(uri); + goto done; } - if (!strcmp(bas->path, ref->path)) { - val = g_strdup(""); - goto done; - } - if (bas->path == NULL) { - val = g_strdup(ref->path); - goto done; + if ((ref->server != NULL) && + ((bas->server == NULL) || (strcmp (bas->server, ref->server)))) { + val = g_strdup(uri); + goto done; } + if (ref->path == NULL) { ref->path = (char *) "/"; - remove_path = 1; + remove_path = 1; } - /* - * At this point (at last!) we can compare the two paths - * - * First we take care of the special case where either of the - * two path components may be missing (bug 316224) - */ if (bas->path == NULL) { - if (ref->path != NULL) { - uptr = ref->path; - if (*uptr == '/') - uptr++; - /* exception characters from uri_to_string */ - val = uri_string_escape(uptr, "/;&=+$,"); - } - goto done; + uptr = ref->path; + if (*uptr == '/') + uptr++; + /* exception characters from uri_to_string */ + val = uri_string_escape(uptr, "/;&=+$,"); + goto done; } + + if (!strcmp(bas->path, ref->path)) { + val = g_strdup(""); + goto done; + } + bptr = bas->path; - if (ref->path == NULL) { + if (remove_path == 1) { for (ix = 0; bptr[ix] != 0; ix++) { if (bptr[ix] == '/') nbslash++; @@ -2010,7 +2005,7 @@ uri_resolve_relative (const char *uri, const char * base) len = 1; /* this is for a string terminator only */ } else { /* - * Next we compare the two strings and find where they first differ + * We compare the two strings and find where they first differ */ if ((ref->path[pos] == '.') && (ref->path[pos+1] == '/')) pos += 2;