bugmake - Bugs: bug #21823, Potential NULL pointer dereference...

 
 

bug #21823: Potential NULL pointer dereference on hash.c, hash_insert

Submitter:  Marcio Buss <marciobuss>
Submitted:  Tue 18 Dec 2007 03:18:59 AM UTC
   
 
Severity:  3 - Normal Item Group:  Bug
Status:  Fixed Privacy:  Public
Assigned to:  psmith Open/Closed:  Closed
Component Version:  None Operating System:  None
Fixed Release:  3.82 Triage Status:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 07 Jun 2009 02:14:53 AM UTC, comment #4: 

Fixed by removing the confusing test.

 Paul D. Smith <psmith>
Group administrator
Fri 28 Mar 2008 04:24:30 AM UTC, comment #3: 

This is confusing, and the lack of detailed comments in hash.c doesn't help.

However, I think this particular bug is impossible.  Looking at the implementation of hash_find_slot(), it seems there is no way for that function to return null.  So, the test in hash_insert() to see if slot is null is unneeded and we can never pass null to hash_insert_at() from hash_insert().

That useless check in hash_insert() should be removed to avoid a bit of confusion and a useless operation or two.

 Paul D. Smith <psmith>
Group administrator
Tue 18 Dec 2007 07:25:43 PM UTC, comment #2: 


You are right. I just thought it was worth reporting the error because the test for NULL indicates something is "fishy." BTW,
imho I would assume all the statements in a program serve a
purpose, specially those that cannot be caught by the compiler's
dead code removal. Should this report be closed?

 Marcio Buss <marciobuss>
Tue 18 Dec 2007 07:09:18 PM UTC, comment #1: 

Just because there is a check for NULL does not necessarily mean that a NULL value can ever happen, "potentially". Unless you assume that all statements in a program serve a particular purpose.

Anonymous
Tue 18 Dec 2007 03:18:59 AM UTC, original submission:  


There's a potential null pointer dereference lurking at hash.c
line 132. The error can be tracked down as follows:

(1) Note the statement at line 131,
    const void *old_item = slot ? *slot : 0;

(2) then line 132 calls hash_insert_at (ht, item, slot)

(3) and hash_insert_at does
    const void old_item = (void **) slot;
    right away.

This means hash_insert_at cannot handle a NULL argument on its
third parameter, yet line 132 can potentially pass such value in.

Marcio Buss <marciobuss>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by psmith (Posted a comment)
  • -email is unavailable- added by marciobuss (Submitted the item)
  • -email is unavailable- added by marciobuss

    •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-07-28 psmith Fixed Release4.0 3.82
    2009-06-07 psmith StatusNone Fixed
        Assigned toNone psmith
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.0
    2007-12-18 marciobuss Carbon-Copy- Added -email is unavailable-

    Back to the top

    Copyright © 2024 Free Software Foundation, Inc.
    Verbatim copying and distribution of this entire article is permitted in any medium, provided this notice is preserved.
    The Levitating, Meditating, Flute-playing Gnu logo is a GNU GPL'ed image provided by the Nevrax Design Team.
    Page source code

    Powered by Savane 3.13-df36.
    Corresponding source code