bugfindutils - Bugs: bug #59133, strdup without error handling in...

 
 

bug #59133: strdup without error handling in print.c:do_fprintf()

Submitter:  FB <x251>
Submitted:  Fri 18 Sep 2020 07:07:33 PM UTC
   
 
Category:  find Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  berny
Originator Name:  Open/Closed:  Closed
Release:  4.7.0 Fixed Release:  4.8.0
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 21 Oct 2020 07:42:22 AM UTC, comment #2: 
Bernhard Voelker <berny>
Group administrator
Tue 20 Oct 2020 07:33:40 AM UTC, comment #1: 

Thanks, the attached fixes it;  pushing soon.

(file #50025)

Bernhard Voelker <berny>
Group administrator
Fri 18 Sep 2020 07:07:33 PM UTC, original submission:  

strdup() is called and the resulting pointer is dereferenced without NULL check:


        case 'h':               /* leading directories part of path */
          /* sanitised */
          {
            char *pname = strdup (pathname);

            /* Remove trailing slashes - unless it's the root '/' directory.  */
            char *s = pname + strlen (pname) -1;
            for ( ; pname <= s; s--)


(Reported by Infer)

FB <x251>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by berny (Updated the item)
  • -email is unavailable- added by x251 (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-01-09 berny Open/ClosedOpen Closed
        Fixed ReleaseNone 4.8.0
    2020-10-21 berny StatusCode Review Fixed
    2020-10-20 berny Attached File- Added 0001-find-add-error-handling-for-strdup-in-the-print-h-ca.patch, #50025
        StatusNone Code Review
        Assigned toNone berny

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code