<html><head></head><body>Hello!<br>xmalloc is guaranteed to return non-NULL. If it were to return NULL, BIRD would die instead. That's why it's xmalloc and not malloc.<br>Maria<br><br><br><div class="gmail_quote">On April 27, 2020 5:26:58 AM GMT+02:00, liupeiyu@zju.edu.cn wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Hi,<br><br>In lib/string.h line 38,<br><br>static inline char * <br>xstrdup(const char *c) <br>{ <br> size_t l = strlen(c) + 1;<br> // xmalloc may fail, and z will be NULL. <br> char *z = xmalloc(l);<br> // write to a NULL pointer, crash. <br> memcpy(z, c, l); <br> return z; <br>} <br><br>I think this is a vulnerability, and maybe we can fix it as following:<br><br>static inline char * <br>xstrdup(const char *c) <br>{ <br> size_t l = strlen(c) + 1;<br> char *z = xmalloc(1);<br> if(z)<br> { <br> memcpy(z, c, l);<br> return z;<br> }<br> else return -1; <br>}<br><br>Thanks for any consideration!<br><br>Peiyu Liu, <br>NESA lab, <br>Zhejiang University<br><br><br><br>--<br><br>-----原始邮件-----<br>发件人:liupeiyu@zju.edu.cn<br>发送时间:2020-04-27 10:06:41 (星期一)<br>收件人:bird-users@network.cz<br>抄送: <br>主题:Vulnerability? Bug? Missing check after xmalloc() in xstrdup().<br><br>Hi,<br><br>In lib/string.h line 38,<br><br>static inline char * <br>xstrdup(const char *c) <br>{ size_t l = strlen(c) + 1;<br>// xmalloc may fail, and z will be NULL. <br>char *z = xmalloc(l);<br>// write to a NULL pointer, crash. <br>memcpy(z, c, l); <br>return z; <br>} <br><br>I think this is a vulnerability, and maybe we can fix it as following:<br><br> <br>static inline char * <br>xstrdup(const char *c) <br>{ <br>size_t l = strlen(c) + 1;<br>char *z = xmalloc(1);<br>if(z)<br>{ <br>memcpy(z, c, l);<br>return z;<br>}<br>else return -1; <br>}<br><br>Thanks for any consideration!<br><br>Peiyu Liu, <br>NESA lab, <br>Zhejiang University<br><br><br><br></pre></blockquote></div><br>-- <br>Sent from my Android device with K-9 Mail. Please excuse my brevity.</body></html>