2022-10-21 12:43:27

by Zhi Li

Subject: [PATCH] [nfs/nfs-utils] mount.nfs: fix NULL pointer derefernce in nfs_parse_square_bracket

In function nfs_parse_square_bracket, hostname could be NULL,
dereferencing it in free(*hostname) may cause an unexpected segfault.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2136807
Signed-off-by: Zhi Li <[email protected]>
---
utils/mount/parse_dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/utils/mount/parse_dev.c b/utils/mount/parse_dev.c
index 0d3bcb95..2ade5d5d 100644
--- a/utils/mount/parse_dev.c
+++ b/utils/mount/parse_dev.c
@@ -170,7 +170,8 @@ static int nfs_parse_square_bracket(const char *dev,
if (pathname) {
*pathname = strndup(cbrace, path_len);
if (*pathname == NULL) {
- free(*hostname);
+ if (hostname)
+ free(*hostname);
return nfs_pdn_nomem_err();
}
}
--
2.37.3

2022-10-24 19:06:52

by Steve Dickson

Subject: Re: [PATCH] [nfs/nfs-utils] mount.nfs: fix NULL pointer derefernce in nfs_parse_square_bracket

On 10/21/22 8:41 AM, Zhi Li wrote:
> In function nfs_parse_square_bracket, hostname could be NULL,
> dereferencing it in free(*hostname) may cause an unexpected segfault.
>
> Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2136807
> Signed-off-by: Zhi Li <[email protected]>
Committed...

steved.
> ---
> utils/mount/parse_dev.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/utils/mount/parse_dev.c b/utils/mount/parse_dev.c
> index 0d3bcb95..2ade5d5d 100644
> --- a/utils/mount/parse_dev.c
> +++ b/utils/mount/parse_dev.c
> @@ -170,7 +170,8 @@ static int nfs_parse_square_bracket(const char *dev,
> if (pathname) {
> *pathname = strndup(cbrace, path_len);
> if (*pathname == NULL) {
> - free(*hostname);
> + if (hostname)
> + free(*hostname);
> return nfs_pdn_nomem_err();
> }
> }