From f9f44901a23e7f2b472a2e0987bd70df86b4271a Mon Sep 17 00:00:00 2001 From: Holger Hans Peter Freyther Date: Sat, 23 Jan 2016 09:21:04 +0100 Subject: db: Avoid undefined behavior when copying cm2/cm3 from the db memcpy has both the source and destination marked as non-null and we were still passing NULL (with a zero size) to it. While this makes sense it violates the constraints of the function. Add the check to see if these values are NULL or not. +db.c:583:2: runtime error: null pointer passed as argument 2, which is declared to never be null + #0 0x40d7f7 in get_equipment_by_subscr (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40d7f7) + #1 0x40f6d2 in db_get_subscriber (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40f6d2) + #2 0x40bfaa in sms_from_result_v3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40bfaa) + #3 0x40c847 in update_db_revision_3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40c847) + #4 0x40cbc3 in check_db_revision (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cbc3) + #5 0x40cf85 in db_prepare (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cf85) + #6 0x406f18 in main /home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test.c:179 + #7 0x7fd625638a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) + #8 0x405598 in _start (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x405598) + +db.c:590:2: runtime error: null pointer passed as argument 2, which is declared to never be null + #0 0x40da23 in get_equipment_by_subscr (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40da23) + #1 0x40f6d2 in db_get_subscriber (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40f6d2) + #2 0x40bfaa in sms_from_result_v3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40bfaa) + #3 0x40c847 in update_db_revision_3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40c847) + #4 0x40cbc3 in check_db_revision (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cbc3) + #5 0x40cf85 in db_prepare (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cf85) + #6 0x406f18 in main /home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test.c:179 + #7 0x7fd625638a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f) + #8 0x405598 in _start (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x405598) --- openbsc/src/libmsc/db.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'openbsc/src/libmsc') diff --git a/openbsc/src/libmsc/db.c b/openbsc/src/libmsc/db.c index 9f265901c..0935fc54d 100644 --- a/openbsc/src/libmsc/db.c +++ b/openbsc/src/libmsc/db.c @@ -579,13 +579,15 @@ static int get_equipment_by_subscr(struct gsm_subscriber *subscr) cm2 = dbi_result_get_binary(result, "classmark2"); if (equip->classmark2_len > sizeof(equip->classmark2)) equip->classmark2_len = sizeof(equip->classmark2); - memcpy(equip->classmark2, cm2, equip->classmark2_len); + if (cm2) + memcpy(equip->classmark2, cm2, equip->classmark2_len); equip->classmark3_len = dbi_result_get_field_length(result, "classmark3"); cm3 = dbi_result_get_binary(result, "classmark3"); if (equip->classmark3_len > sizeof(equip->classmark3)) equip->classmark3_len = sizeof(equip->classmark3); - memcpy(equip->classmark3, cm3, equip->classmark3_len); + if (cm3) + memcpy(equip->classmark3, cm3, equip->classmark3_len); dbi_result_free(result); -- cgit v1.2.3