From nobody Wed Nov 5 16:36:19 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=oracle.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1535644643213777.4451569852381; Thu, 30 Aug 2018 08:57:23 -0700 (PDT) Received: from localhost ([::1]:49615 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvPJx-0006Qq-Uj for importer@patchew.org; Thu, 30 Aug 2018 11:57:22 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54805) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fvPCN-0006qH-VL for qemu-devel@nongnu.org; Thu, 30 Aug 2018 11:49:33 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fvP8Y-0005R0-3Q for qemu-devel@nongnu.org; Thu, 30 Aug 2018 11:45:37 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:44584) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fvP8X-0005QX-RT for qemu-devel@nongnu.org; Thu, 30 Aug 2018 11:45:33 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7UFdGU6030721 for ; Thu, 30 Aug 2018 15:45:33 GMT Received: from aserv0021.oracle.com (aserv0021.oracle.com [141.146.126.233]) by aserp2120.oracle.com with ESMTP id 2m2y2pwhhv-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 30 Aug 2018 15:45:32 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0021.oracle.com (8.14.4/8.14.4) with ESMTP id w7UFjWLW014069 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK) for ; Thu, 30 Aug 2018 15:45:32 GMT Received: from abhmp0014.oracle.com (abhmp0014.oracle.com [141.146.116.20]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w7UFjWL2020756 for ; Thu, 30 Aug 2018 15:45:32 GMT Received: from ol7.uk.oracle.com (/10.175.215.81) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Thu, 30 Aug 2018 08:45:32 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : subject : date : message-id : in-reply-to : references; s=corp-2018-07-02; bh=y/iXqS2mgXQufQSoaTle9V2E2l5V2Czhnww5kswlI9A=; b=eI9DCzfj6vT65DDY8jNDxn0z0M0frBRSoAbgw4z0pEp1PvylWsmIaEh7EnmyFCCx8awi fsE5HMJKo5jKckGrs7coctxpKLBbGR2kkfoNnLPGkhudNHXvvfMyvANWL8It+uHyDNVX kSQ69VDyDgr3qz4jZCaHuPKh15+B9KoANu3LVLCk4OjZINDRQdIiGUJF7+KQSE4ub6d1 EVOdSv6fFqcQHgw0yOfj/6agTKHaBENeX+vHcgcoCCusIH+xx2PPG951hIvvlaLIiSxg c7v0WBUMHYCe0UJ4Jws8VJCcZznOqqwjGJ+hQdfYp2UUFBcE4pnF2BCTOZPlwMJuit/D qg== From: Liam Merwick To: qemu-devel@nongnu.org Date: Thu, 30 Aug 2018 16:47:08 +0100 Message-Id: <1535644031-848-6-git-send-email-Liam.Merwick@oracle.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1535644031-848-1-git-send-email-Liam.Merwick@oracle.com> References: <1535644031-848-1-git-send-email-Liam.Merwick@oracle.com> X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=9000 signatures=668708 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=4 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=750 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808300162 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] X-Received-From: 141.146.126.78 Subject: [Qemu-devel] [PATCH 5/8] block: Fix potential Null pointer dereferences in vvfat.c X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDMRC_1 RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" The calls to bdrv_new_open_driver(), find_mapping_for_cluster(), and array_get_next() may return NULL but it isn't always checked for before dereferencing the value returned. Signed-off-by: Liam Merwick Reviewed-by: Darren Kenny Reviewed-by: Mark Kanda --- block/vvfat.c | 56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/block/vvfat.c b/block/vvfat.c index fc41841a5c3c..0f1f10a2f94b 100644 --- a/block/vvfat.c +++ b/block/vvfat.c @@ -448,6 +448,9 @@ static direntry_t *create_long_filename(BDRVVVFATState = *s, const char *filename) =20 for(i=3D0;idirectory)); + if (entry =3D=3D NULL) { + continue; + } entry->attributes=3D0xf; entry->reserved[0]=3D0; entry->begin=3D0; @@ -665,6 +668,9 @@ static inline void fat_set(BDRVVVFATState* s,unsigned i= nt cluster,uint32_t value } else { int offset =3D (cluster*3/2); unsigned char* p =3D array_get(&(s->fat), offset); + if (p =3D=3D NULL) { + return; + } switch (cluster&1) { case 0: p[0] =3D value&0xff; @@ -730,6 +736,9 @@ static inline direntry_t* create_short_and_long_name(BD= RVVVFATState* s, =20 if(is_dot) { entry=3Darray_get_next(&(s->directory)); + if (entry =3D=3D NULL) { + return NULL; + } memset(entry->name, 0x20, sizeof(entry->name)); memcpy(entry->name,filename,strlen(filename)); return entry; @@ -844,6 +853,12 @@ static int read_directory(BDRVVVFATState* s, int mappi= ng_index) /* create mapping for this file */ if(!is_dot && !is_dotdot && (S_ISDIR(st.st_mode) || st.st_size)) { s->current_mapping =3D array_get_next(&(s->mapping)); + if (s->current_mapping =3D=3D NULL) { + fprintf(stderr, "Failed to create mapping for file\n"); + g_free(buffer); + closedir(dir); + return -2; + } s->current_mapping->begin=3D0; s->current_mapping->end=3Dst.st_size; /* @@ -941,6 +956,9 @@ static int init_directories(BDRVVVFATState* s, /* add volume label */ { direntry_t* entry=3Darray_get_next(&(s->directory)); + if (entry =3D=3D NULL) { + return -1; + } entry->attributes=3D0x28; /* archive | volume label */ memcpy(entry->name, s->volume_label, sizeof(entry->name)); } @@ -953,6 +971,9 @@ static int init_directories(BDRVVVFATState* s, s->cluster_count=3Dsector2cluster(s, s->sector_count); =20 mapping =3D array_get_next(&(s->mapping)); + if (mapping =3D=3D NULL) { + return -1; + } mapping->begin =3D 0; mapping->dir_index =3D 0; mapping->info.dir.parent_mapping_index =3D -1; @@ -1630,6 +1651,9 @@ static void schedule_rename(BDRVVVFATState* s, uint32_t cluster, char* new_path) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D new_path; commit->param.rename.cluster =3D cluster; commit->action =3D ACTION_RENAME; @@ -1639,6 +1663,9 @@ static void schedule_writeout(BDRVVVFATState* s, int dir_index, uint32_t modified_offset) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D NULL; commit->param.writeout.dir_index =3D dir_index; commit->param.writeout.modified_offset =3D modified_offset; @@ -1649,6 +1676,9 @@ static void schedule_new_file(BDRVVVFATState* s, char* path, uint32_t first_cluster) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D path; commit->param.new_file.first_cluster =3D first_cluster; commit->action =3D ACTION_NEW_FILE; @@ -1657,6 +1687,9 @@ static void schedule_new_file(BDRVVVFATState* s, static void schedule_mkdir(BDRVVVFATState* s, uint32_t cluster, char* path) { commit_t* commit =3D array_get_next(&(s->commits)); + if (commit =3D=3D NULL) { + return; + } commit->path =3D path; commit->param.mkdir.cluster =3D cluster; commit->action =3D ACTION_MKDIR; @@ -2261,6 +2294,9 @@ static mapping_t* insert_mapping(BDRVVVFATState* s, } if (index >=3D s->mapping.next || mapping->begin > begin) { mapping =3D array_insert(&(s->mapping), index, 1); + if (mapping =3D=3D NULL) { + return NULL; + } mapping->path =3D NULL; adjust_mapping_indices(s, index, +1); } @@ -2428,6 +2464,9 @@ static int commit_direntries(BDRVVVFATState* s, direntry_t* direntry =3D array_get(&(s->directory), dir_index); uint32_t first_cluster =3D dir_index =3D=3D 0 ? 0 : begin_of_direntry(= direntry); mapping_t* mapping =3D find_mapping_for_cluster(s, first_cluster); + if (mapping =3D=3D NULL) { + return -1; + } =20 int factor =3D 0x10 * s->sectors_per_cluster; int old_cluster_count, new_cluster_count; @@ -2494,6 +2533,9 @@ DLOG(fprintf(stderr, "commit_direntries for %s, paren= t_mapping_index %d\n", mapp direntry =3D array_get(&(s->directory), first_dir_index + i); if (is_directory(direntry) && !is_dot(direntry)) { mapping =3D find_mapping_for_cluster(s, first_cluster); + if (mapping =3D=3D NULL) { + return -1; + } assert(mapping->mode & MODE_DIRECTORY); ret =3D commit_direntries(s, first_dir_index + i, array_index(&(s->mapping), mapping)); @@ -2522,6 +2564,10 @@ static int commit_one_file(BDRVVVFATState* s, assert(offset < size); assert((offset % s->cluster_size) =3D=3D 0); =20 + if (mapping =3D=3D NULL) { + return -1; + } + for (i =3D s->cluster_size; i < offset; i +=3D s->cluster_size) c =3D modified_fat_get(s, c); =20 @@ -2668,6 +2714,9 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* = s) if (commit->action =3D=3D ACTION_RENAME) { mapping_t* mapping =3D find_mapping_for_cluster(s, commit->param.rename.cluster); + if (mapping =3D=3D NULL) { + return -1; + } char* old_path =3D mapping->path; =20 assert(commit->path); @@ -2692,6 +2741,9 @@ static int handle_renames_and_mkdirs(BDRVVVFATState* = s) if (is_file(d) || (is_directory(d) && !is_dot(d)))= { mapping_t* m =3D find_mapping_for_cluster(s, begin_of_direntry(d)); + if (m =3D=3D NULL) { + return -3; + } int l =3D strlen(m->path); char* new_path =3D g_malloc(l + diff + 1); =20 @@ -3193,6 +3245,10 @@ static int enable_write_target(BlockDriverState *bs,= Error **errp) =20 backing =3D bdrv_new_open_driver(&vvfat_write_target, NULL, BDRV_O_ALL= OW_RDWR, &error_abort); + if (!backing) { + ret =3D -EINVAL; + goto err; + } *(void**) backing->opaque =3D s; =20 bdrv_set_backing_hd(s->bs, backing, &error_abort); --=20 1.8.3.1