summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPhilipp <pmaier@sysmocom.de>2016-11-25 15:23:50 +0100
committerHarald Welte <laforge@gnumonks.org>2016-11-27 18:27:57 +0000
commit143a274051338c1ae04981d5493818ccbb28841c (patch)
tree59ee2706d8cf7391b977bf6305c699efefde358f
parent487436138e3dca6a99862abc779ac5230c8f826b (diff)
sndcp: fixup for coverity scan defect CID 149097
Coverity scan detects a Null pointer deref (FORWARD_NULL) in gprs_sndcp_comp.c: 67 in gprs_sndcp_comp_create(). The reason for this is that gprs_sndcp_dcomp_init() and also gprs_sndcp_pcomp_init() rely on the comp_entity->algo algo flag. If the program logic is correct a null pointer deref should never occur. This commit adds OSMO_ASSERT() statements to ensure a null pointer deref is catched if if the ...comp_init() functions are used with incorrect parameters. Change-Id: I7748f06d1739a697edad5100a031e5aa1ef11ed1
-rw-r--r--openbsc/src/gprs/gprs_sndcp_dcomp.c1
-rw-r--r--openbsc/src/gprs/gprs_sndcp_pcomp.c1
2 files changed, 2 insertions, 0 deletions
diff --git a/openbsc/src/gprs/gprs_sndcp_dcomp.c b/openbsc/src/gprs/gprs_sndcp_dcomp.c
index 489106b47..b0f95b486 100644
--- a/openbsc/src/gprs/gprs_sndcp_dcomp.c
+++ b/openbsc/src/gprs/gprs_sndcp_dcomp.c
@@ -84,6 +84,7 @@ int gprs_sndcp_dcomp_init(const void *ctx, struct gprs_sndcp_comp *comp_entity,
if (comp_entity->compclass == SNDCP_XID_DATA_COMPRESSION
&& comp_entity->algo == V42BIS) {
+ OSMO_ASSERT(comp_field->v42bis_params);
comp_entity->state =
v42bis_init(ctx, NULL, comp_field->v42bis_params->p0,
comp_field->v42bis_params->p1,
diff --git a/openbsc/src/gprs/gprs_sndcp_pcomp.c b/openbsc/src/gprs/gprs_sndcp_pcomp.c
index 493b26399..a2236c3b1 100644
--- a/openbsc/src/gprs/gprs_sndcp_pcomp.c
+++ b/openbsc/src/gprs/gprs_sndcp_pcomp.c
@@ -54,6 +54,7 @@ int gprs_sndcp_pcomp_init(const void *ctx, struct gprs_sndcp_comp *comp_entity,
if (comp_entity->compclass == SNDCP_XID_PROTOCOL_COMPRESSION
&& comp_entity->algo == RFC_1144) {
+ OSMO_ASSERT(comp_field->rfc1144_params);
comp_entity->state =
slhc_init(ctx, comp_field->rfc1144_params->s01 + 1,
comp_field->rfc1144_params->s01 + 1);