From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49796) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YKlss-0008AQ-8x for qemu-devel@nongnu.org; Mon, 09 Feb 2015 05:48:10 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YKlso-00070C-CA for qemu-devel@nongnu.org; Mon, 09 Feb 2015 05:48:06 -0500 Received: from mx1.redhat.com ([209.132.183.28]:58134) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YKlso-0006zm-5v for qemu-devel@nongnu.org; Mon, 09 Feb 2015 05:48:02 -0500 Received: from int-mx11.intmail.prod.int.phx2.redhat.com (int-mx11.intmail.prod.int.phx2.redhat.com [10.5.11.24]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id t19Am12i019346 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL) for ; Mon, 9 Feb 2015 05:48:01 -0500 From: mrezanin@redhat.com Date: Mon, 9 Feb 2015 11:47:57 +0100 Message-Id: <1423478877-12053-1-git-send-email-mrezanin@redhat.com> Subject: [Qemu-devel] [PATCHv2] Prevent segmentation fault in case of relative resolve of uri List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: armbru@redhat.com, stefanha@redhat.com From: Miroslav Rezanina It was possible to call strcmp with NULL argument, that can cause segmentation fault. Properly checking parameters to prevent this situation. Signed-off-by: Miroslav Rezanina --- v2: - instead of adding NULL checks to strcmp call refactor whole NULL checking path. This will remove dead code and make whole checking easier to understand. Relative path generation part is not touched as I'm not fully sure of correct behavior and purpose of this patch is to prevent segmentation fault. --- util/uri.c | 55 +++++++++++++++++++++++++------------------------------ 1 file changed, 25 insertions(+), 30 deletions(-) diff --git a/util/uri.c b/util/uri.c index 918d235..23dbaca 100644 --- a/util/uri.c +++ b/util/uri.c @@ -1964,44 +1964,39 @@ uri_resolve_relative (const char *uri, const char * base) * If the scheme / server on the URI differs from the base, * just return the URI */ - if ((ref->scheme != NULL) && - ((bas->scheme == NULL) || - (strcmp (bas->scheme, ref->scheme)) || - (strcmp (bas->server, ref->server)))) { - val = g_strdup (uri); - goto done; + + if ((ref->scheme != NULL) && + ((bas->scheme == NULL) || (strcmp (bas->scheme, ref->scheme)))) { + val = g_strdup(uri); + goto done; } - if (!strcmp(bas->path, ref->path)) { - val = g_strdup(""); - goto done; - } - if (bas->path == NULL) { - val = g_strdup(ref->path); - goto done; + if ((ref->server != NULL) && + ((bas->server == NULL) || (strcmp (bas->server, ref->server)))) { + val = g_strdup(uri); + goto done; } + if (ref->path == NULL) { ref->path = (char *) "/"; - remove_path = 1; + remove_path = 1; } - /* - * At this point (at last!) we can compare the two paths - * - * First we take care of the special case where either of the - * two path components may be missing (bug 316224) - */ if (bas->path == NULL) { - if (ref->path != NULL) { - uptr = ref->path; - if (*uptr == '/') - uptr++; - /* exception characters from uri_to_string */ - val = uri_string_escape(uptr, "/;&=+$,"); - } - goto done; + uptr = ref->path; + if (*uptr == '/') + uptr++; + /* exception characters from uri_to_string */ + val = uri_string_escape(uptr, "/;&=+$,"); + goto done; } + + if (!strcmp(bas->path, ref->path)) { + val = g_strdup(""); + goto done; + } + bptr = bas->path; - if (ref->path == NULL) { + if (remove_path == 1) { for (ix = 0; bptr[ix] != 0; ix++) { if (bptr[ix] == '/') nbslash++; @@ -2010,7 +2005,7 @@ uri_resolve_relative (const char *uri, const char * base) len = 1; /* this is for a string terminator only */ } else { /* - * Next we compare the two strings and find where they first differ + * We compare the two strings and find where they first differ */ if ((ref->path[pos] == '.') && (ref->path[pos+1] == '/')) pos += 2; -- 2.1.0