From nobody Mon Feb 9 01:21:23 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.37 as permitted sender) client-ip=209.132.183.37; envelope-from=libvir-list-bounces@redhat.com; helo=mx5-phx2.redhat.com; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.37 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; Return-Path: Received: from mx5-phx2.redhat.com (mx5-phx2.redhat.com [209.132.183.37]) by mx.zohomail.com with SMTPS id 1488889163712296.07558355844174; Tue, 7 Mar 2017 04:19:23 -0800 (PST) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by mx5-phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v27CGK6D055443; Tue, 7 Mar 2017 07:16:20 -0500 Received: from smtp.corp.redhat.com (int-mx16.intmail.prod.int.phx2.redhat.com [10.5.11.28]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id v27CFkJS003955 for ; Tue, 7 Mar 2017 07:15:46 -0500 Received: by smtp.corp.redhat.com (Postfix) id 7D33A2D655; Tue, 7 Mar 2017 12:15:46 +0000 (UTC) Received: from localhost.localdomain.com (ovpn-117-9.phx2.redhat.com [10.3.117.9]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3B4832D654 for ; Tue, 7 Mar 2017 12:15:46 +0000 (UTC) From: John Ferlan To: libvir-list@redhat.com Date: Tue, 7 Mar 2017 07:15:42 -0500 Message-Id: <20170307121542.25287-3-jferlan@redhat.com> In-Reply-To: <20170307121542.25287-1-jferlan@redhat.com> References: <20170307121542.25287-1-jferlan@redhat.com> X-Scanned-By: MIMEDefang 2.74 on 10.5.11.28 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH 2/2] util: Avoid possible NULL dereference in virSysinfoParsePPCProcessor X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" Found by Coverity. Because there's an "if ((cur =3D strstr(base, "revision"= )) !=3D NULL) {" followed by a "base =3D cur" coverity notes that 'base' could then be NULL causing the return to the top of the "while ((tmp_base =3D strstr(base, "processor")) !=3D NULL) {" to have strstr deref a NULL 'base' pointer because the setting of base at the bottom of the loop is unconditio= nal. Alter the code to set "base =3D cur" after processing each key. That will "ensure" that base doesn't get set to NULL if both "cpu" and "revision" do no follow a "processor". While a /proc/cpuinfo file that has a "processor" key but with neither a "cpu" nor a "revision" doesn't seem feasible, the code is written as if it could happen, so we have to account for it. Signed-off-by: John Ferlan --- src/util/virsysinfo.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/util/virsysinfo.c b/src/util/virsysinfo.c index 14c17a8..8d3377c 100644 --- a/src/util/virsysinfo.c +++ b/src/util/virsysinfo.c @@ -231,6 +231,7 @@ virSysinfoParsePPCProcessor(const char *base, virSysinf= oDefPtr ret) if (eol && VIR_STRNDUP(processor->processor_socket_destination, cur, eol - cur) < 0) return -1; + base =3D cur; =20 if ((cur =3D strstr(base, "cpu")) !=3D NULL) { cur =3D strchr(cur, ':') + 1; @@ -239,6 +240,7 @@ virSysinfoParsePPCProcessor(const char *base, virSysinf= oDefPtr ret) if (eol && VIR_STRNDUP(processor->processor_type, cur, eol - cur) < 0) return -1; + base =3D cur; } =20 if ((cur =3D strstr(base, "revision")) !=3D NULL) { @@ -248,9 +250,9 @@ virSysinfoParsePPCProcessor(const char *base, virSysinf= oDefPtr ret) if (eol && VIR_STRNDUP(processor->processor_version, cur, eol - cur) < 0) return -1; + base =3D cur; } =20 - base =3D cur; } =20 return 0; --=20 2.9.3 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list