From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35219) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YG8m8-0007Ko-Ug for qemu-devel@nongnu.org; Tue, 27 Jan 2015 11:14:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YG8m4-0002ay-01 for qemu-devel@nongnu.org; Tue, 27 Jan 2015 11:14:00 -0500 From: Markus Armbruster Date: Tue, 27 Jan 2015 17:13:52 +0100 Message-Id: <1422375232-29283-4-git-send-email-armbru@redhat.com> In-Reply-To: <1422375232-29283-1-git-send-email-armbru@redhat.com> References: <1422375232-29283-1-git-send-email-armbru@redhat.com> Subject: [Qemu-devel] [PATCH 3/3] util/uri: URI member path can be null, compare more carfully List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-trivial@nongnu.org, Paolo Bonzini uri_resolve_relative() calls strcmp(bas->path, ref->path). However, either argument could be null! Evidence: the code checks for null after the comparison. Spotted by Coverity. I suspect this was screwed up when we stole the code from libxml2. There the conditional reads xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path) with int xmlStrEqual(const xmlChar *str1, const xmlChar *str2) { if (str1 == str2) return(1); if (str1 == NULL) return(0); if (str2 == NULL) return(0); do { if (*str1++ != *str2) return(0); } while (*str2++); return(1); } Fix by replicating libxml2's logic faithfully. Cc: Paolo Bonzini Signed-off-by: Markus Armbruster --- util/uri.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/util/uri.c b/util/uri.c index b9a7b54..1cfd78b 100644 --- a/util/uri.c +++ b/util/uri.c @@ -1935,7 +1935,8 @@ uri_resolve_relative (const char *uri, const char * base) val = g_strdup (uri); goto done; } - if (!strcmp(bas->path, ref->path)) { + if (bas->path == ref->path || + (bas->path && ref->path && !strcmp(bas->path, ref->path))) { val = g_strdup(""); goto done; } -- 1.9.3