paulmataruso/osmo-mgw
1
0
Fork 0
mirror of https://gitea.osmocom.org/cellular-infrastructure/osmo-mgw.git synced 2025-11-04 05:53:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

db: Avoid undefined behavior when copying cm2/cm3 from the db

Browse Source 
memcpy has both the source and destination marked as non-null and
we were still passing NULL (with a zero size) to it. While this
makes sense it violates the constraints of the function. Add the
check to see if these values are NULL or not.

+db.c:583:2: runtime error: null pointer passed as argument 2, which is declared to never be null
+    #0 0x40d7f7 in get_equipment_by_subscr (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40d7f7)
+    #1 0x40f6d2 in db_get_subscriber (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40f6d2)
+    #2 0x40bfaa in sms_from_result_v3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40bfaa)
+    #3 0x40c847 in update_db_revision_3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40c847)
+    #4 0x40cbc3 in check_db_revision (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cbc3)
+    #5 0x40cf85 in db_prepare (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cf85)
+    #6 0x406f18 in main /home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test.c:179
+    #7 0x7fd625638a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
+    #8 0x405598 in _start (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x405598)
+
+db.c:590:2: runtime error: null pointer passed as argument 2, which is declared to never be null
+    #0 0x40da23 in get_equipment_by_subscr (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40da23)
+    #1 0x40f6d2 in db_get_subscriber (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40f6d2)
+    #2 0x40bfaa in sms_from_result_v3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40bfaa)
+    #3 0x40c847 in update_db_revision_3 (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40c847)
+    #4 0x40cbc3 in check_db_revision (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cbc3)
+    #5 0x40cf85 in db_prepare (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x40cf85)
+    #6 0x406f18 in main /home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test.c:179
+    #7 0x7fd625638a3f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20a3f)
+    #8 0x405598 in _start (/home/builder/jenkins/workspace/Osmocom_Sanitizer/source/openbsc/openbsc/tests/db/db_test+0x405598)
This commit is contained in:
Holger Hans Peter Freyther
2016-01-23 09:21:04 +01:00
parent fec29ab4e9
commit f9f44901a2
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
openbsc/src/libmsc/db.c
View File

@@ -579,12 +579,14 @@ static int get_equipment_by_subscr(struct gsm_subscriber *subscr)
cm2 = dbi_result_get_binary(result, "classmark2"); cm2 = dbi_result_get_binary(result, "classmark2");
if (equip->classmark2_len > sizeof(equip->classmark2)) if (equip->classmark2_len > sizeof(equip->classmark2))
equip->classmark2_len = sizeof(equip->classmark2); equip->classmark2_len = sizeof(equip->classmark2);
if (cm2)
memcpy(equip->classmark2, cm2, equip->classmark2_len); memcpy(equip->classmark2, cm2, equip->classmark2_len);
equip->classmark3_len = dbi_result_get_field_length(result, "classmark3"); equip->classmark3_len = dbi_result_get_field_length(result, "classmark3");
cm3 = dbi_result_get_binary(result, "classmark3"); cm3 = dbi_result_get_binary(result, "classmark3");
if (equip->classmark3_len > sizeof(equip->classmark3)) if (equip->classmark3_len > sizeof(equip->classmark3))
equip->classmark3_len = sizeof(equip->classmark3); equip->classmark3_len = sizeof(equip->classmark3);
if (cm3)
memcpy(equip->classmark3, cm3, equip->classmark3_len); memcpy(equip->classmark3, cm3, equip->classmark3_len);
dbi_result_free(result); dbi_result_free(result);