summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorHolger Hans Peter Freyther <holger@moiji-mobile.com>2016-01-23 09:21:04 +0100
committerHolger Hans Peter Freyther <holger@moiji-mobile.com>2016-01-23 09:21:04 +0100
commitf9f44901a23e7f2b472a2e0987bd70df86b4271a (patch)
tree8dc98279965f2b4673e553618d7367f9e18bbf8e
parentfec29ab4e9651959a09b4ca524866e02c537349e (diff)
db: Avoid undefined behavior when copying cm2/cm3 from the db
memcpy has both the source and destination marked as non-null and we were still passing NULL (with a zero size) to it. While this makes sense it violates the constraints of the function. Add the check to see if these values are NULL or not. +db.c:583:2: runtime error: null pointer passed as argument 2, which is declared to never be null + #0 0x40d7f7 in get_equipment_by_subscr (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40d7f7) + #1 0x40f6d2 in db_get_subscriber (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40f6d2) + #2 0x40bfaa in sms_from_result_v3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40bfaa) + #3 0x40c847 in update_db_revision_3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40c847) + #4 0x40cbc3 in check_db_revision (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cbc3) + #5 0x40cf85 in db_prepare (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cf85) + #6 0x406f18 in main /home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test.c:179 + #7 0x7fd625638a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) + #8 0x405598 in _start (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x405598) + +db.c:590:2: runtime error: null pointer passed as argument 2, which is declared to never be null + #0 0x40da23 in get_equipment_by_subscr (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40da23) + #1 0x40f6d2 in db_get_subscriber (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40f6d2) + #2 0x40bfaa in sms_from_result_v3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40bfaa) + #3 0x40c847 in update_db_revision_3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40c847) + #4 0x40cbc3 in check_db_revision (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cbc3) + #5 0x40cf85 in db_prepare (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cf85) + #6 0x406f18 in main /home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test.c:179 + #7 0x7fd625638a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) + #8 0x405598 in _start (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x405598)
-rw-r--r--openbsc/src/libmsc/db.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/openbsc/src/libmsc/db.c b/openbsc/src/libmsc/db.c
index 9f265901c..0935fc54d 100644
--- a/openbsc/src/libmsc/db.c
+++ b/openbsc/src/libmsc/db.c
@@ -579,13 +579,15 @@ static int get_equipment_by_subscr(struct gsm_subscriber *subscr)
cm2 = dbi_result_get_binary(result, "classmark2");
if (equip->classmark2_len > sizeof(equip->classmark2))
equip->classmark2_len = sizeof(equip->classmark2);
- memcpy(equip->classmark2, cm2, equip->classmark2_len);
+ if (cm2)
+ memcpy(equip->classmark2, cm2, equip->classmark2_len);
equip->classmark3_len = dbi_result_get_field_length(result, "classmark3");
cm3 = dbi_result_get_binary(result, "classmark3");
if (equip->classmark3_len > sizeof(equip->classmark3))
equip->classmark3_len = sizeof(equip->classmark3);
- memcpy(equip->classmark3, cm3, equip->classmark3_len);
+ if (cm3)
+ memcpy(equip->classmark3, cm3, equip->classmark3_len);
dbi_result_free(result);