[PATCH iproute2] ss: fix NULL dereference when rendering without header

[PATCH iproute2] ss: fix NULL dereference when rendering without header

[Jean-Philippe Brucker]

When ss is invoked with the no-header flag, if the query doesn't return
any result, render() is called with 'buffer' uninitialized. This
currently leads to a segfault. Ensure that buffer is initialized before
rendering.

The bug can be triggered with: ss -H sport = 100000

Signed-off-by: Jean-Philippe Brucker <jphilippe.brucker@gmail.com>
---
 misc/ss.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/misc/ss.c b/misc/ss.c
index e047f9c0..e087bef7 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -1197,10 +1197,15 @@ newline:
 /* Render buffered output with spacing and delimiters, then free up buffers */
 static void render(int screen_width)
 {
-	struct buf_token *token = (struct buf_token *)buffer.head->data;
+	struct buf_token *token;
 	int printed, line_started = 0;
 	struct column *f;
 
+	if (!buffer.head)
+		return;
+
+	token = (struct buf_token *)buffer.head->data;
+
 	/* Ensure end alignment of last token, it wasn't necessarily flushed */
 	buffer.tail->end += buffer.cur->len % 2;
 
-- 
2.16.2

Re: [PATCH iproute2] ss: fix NULL dereference when rendering without header

[Stefano Brivio]

On Sat,  3 Mar 2018 16:59:44 +0000
Jean-Philippe Brucker <jphilippe.brucker@gmail.com> wrote:

> When ss is invoked with the no-header flag, if the query doesn't return
> any result, render() is called with 'buffer' uninitialized. This
> currently leads to a segfault. Ensure that buffer is initialized before
> rendering.
> 
> The bug can be triggered with: ss -H sport = 100000

Oh dear. Nice catch, thanks for fixing this.

> Signed-off-by: Jean-Philippe Brucker <jphilippe.brucker@gmail.com>

Acked-by: Stefano Brivio <sbrivio@redhat.com>

-- 
Stefano