[PATCH] selftests/exec: check malloc() return in execveat concat()

[PATCH] selftests/exec: check malloc() return in execveat concat()

[zhangchujun]

concat() strcpy()s into the buffer returned by malloc() without
checking it for NULL.  If the allocation fails, the helper
dereferences NULL and crashes the test.

Check the allocation and exit with a failure message via
ksft_exit_fail_msg(), which is how the file already reports
unrecoverable errors.

Signed-off-by: zhangchujun <zhangchujun@cmss.chinamobile.com>

diff --git a/tools/testing/selftests/exec/execveat.c b/tools/testing/selftests/exec/execveat.c
index d37c068ed5fe..b70844a7a13c 100644
--- a/tools/testing/selftests/exec/execveat.c
+++ b/tools/testing/selftests/exec/execveat.c
@@ -138,6 +138,8 @@ static char *concat(const char *left, const char *right)
 {
 	char *result = malloc(strlen(left) + strlen(right) + 1);
 
+	if (!result)
+		ksft_exit_fail_msg("malloc failed\n");
 	strcpy(result, left);
 	strcat(result, right);
 	return result;
-- 
2.50.1.windows.1

Re: [PATCH] selftests/exec: check malloc() return in execveat concat()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] selftests/exec: single-word username in Signed-off-by trailer
- [Low] selftests/exec: missing Fixes trailer for unchecked malloc() in
  concat()
--

commit 1c579e8be1fe05d3235ea43d298729637c25d600
Author: zhangchujun <zhangchujun@cmss.chinamobile.com>

> selftests/exec: check malloc() return in execveat concat()
>
> concat() strcpy()s into the buffer returned by malloc() without
> checking it for NULL.  If the allocation fails, the helper
> dereferences NULL and crashes the test.
>
> Check the allocation and exit with a failure message via
> ksft_exit_fail_msg(), which is how the file already reports
> unrecoverable errors.
>
> Signed-off-by: zhangchujun <zhangchujun@cmss.chinamobile.com>

[Severity: High]
The Signed-off-by trailer and Author header use a single-word username
("zhangchujun") rather than a full real name.  Per
Documentation/process/submitting-patches.rst, the Developer's Certificate
of Origin requires a known real human name (given and family name) rather
than a single-token handle.

[Severity: Low]
Since this fixes an unchecked malloc() in concat(), should the commit
message include:

  Fixes: c9b26b81af9c ("syscalls: add selftest for execveat(2)")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113072313.1723-1-zhangchujun@cmss.chinamobile.com?part=1