lib/libadminutil/admutil.c | 41 ++++++++++++++++++++++++-----------------
lib/libadminutil/psetc.c | 32 +++++++++++++++++++++-----------
lib/libadmsslutil/certmgt.c | 19 +++++++++++++++----
3 files changed, 60 insertions(+), 32 deletions(-)
New commits:
commit e0da40846c56e8cae9a64ba0a20c0194bd74577b
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Apr 18 15:07:32 2011 -0700
Bug 697641 - Check if strchr() returns NULL before dereferencing
If we don't find the ':' delimiter, we can end up dereferencing a NULL
pointer. We should check if strchr() returned NULL before dereferencing
password.
cov#10761
diff --git a/lib/libadminutil/admutil.c b/lib/libadminutil/admutil.c
index ee3197b..51dae4e 100644
--- a/lib/libadminutil/admutil.c
+++ b/lib/libadminutil/admutil.c
@@ -1251,21 +1251,24 @@ admldapBuildInfoOnly(char* configRoot, int *errorcode)
/* EOF */
default:
password = strchr(buf, ':');
- *password++ = '\0';
- while (*password) {
- if (*password == ' ') password++;
- else break;
- }
+ if (password) {
+ *password++ = '\0';
+ while (*password) {
+ if (*password == ' ') password++;
+ else break;
+ }
- name = buf;
- if (*password) {
- *errorcode = ADMUTIL_OP_OK;
- admInfo->admpwFilePath = path; /* hand off memory */
- path = NULL;
- admInfo->localAdminName = PL_strdup(name);
- admInfo->localAdminPassword = PL_strdup(password);
- }
- else {
+ name = buf;
+ if (*password) {
+ *errorcode = ADMUTIL_OP_OK;
+ admInfo->admpwFilePath = path; /* hand off memory */
+ path = NULL;
+ admInfo->localAdminName = PL_strdup(name);
+ admInfo->localAdminPassword = PL_strdup(password);
+ } else {
+ *errorcode = ADMUTIL_OP_FAIL;
+ }
+ } else {
*errorcode = ADMUTIL_OP_FAIL;
}
}
commit b1181e4ea020c9866b8058f5b3c0c4520c764342
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Apr 18 15:00:07 2011 -0700
Bug 697641 - Check list->name for NULL before dereferencing
The code assumes that list->name will not be NULL, which is likely a
correct assumption if the list API was used properly. To be same, we
should check if list->name is NULL before dereferencing it.
cov#10762
diff --git a/lib/libadminutil/admutil.c b/lib/libadminutil/admutil.c
index ea207d8..ee3197b 100644
--- a/lib/libadminutil/admutil.c
+++ b/lib/libadminutil/admutil.c
@@ -530,9 +530,11 @@ listDelete(ListNodePtr list, char* name) {
/* Not implemented */
ListNodePtr node, nextptr;
- if (!list) return NULL;
+ if (!list || !name) {
+ goto done;
+ }
- if (!strcasecmp(list->name, name)) {
+ if (list->name && !strcasecmp(list->name, name)) {
nextptr = list->next;
if (list->name) PR_Free(list->name);
if (list->dflag) deleteValue ((ValueType)list->val);
@@ -542,7 +544,7 @@ listDelete(ListNodePtr list, char* name) {
node = list;
while (node->next) {
- if (!strcasecmp(node->next->name, name)) {
+ if (node->next->name && !strcasecmp(node->next->name, name)) {
nextptr = node->next->next;
if (node->next->name) PR_Free (node->next->name);
if (node->next->dflag) deleteValue ((ValueType)node->next->val);
@@ -552,6 +554,8 @@ listDelete(ListNodePtr list, char* name) {
}
node = node->next;
}
+
+done:
return list;
}
commit 14b558e289b3b1ec5fc5d7681eb1bd1522657e8a
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Apr 18 15:12:04 2011 -0700
Bug 697641 - Check if valBuf is NULL before dereferencing
If PR_Realloc() fails to calculate memory for valBuf, we will end up
dereferencing a NULL pointer. We should check if valBuf is NULL before
dereferencing it.
cov#10758
diff --git a/lib/libadminutil/psetc.c b/lib/libadminutil/psetc.c
index 3d01d38..42d0871 100644
--- a/lib/libadminutil/psetc.c
+++ b/lib/libadminutil/psetc.c
@@ -757,6 +757,10 @@ psetNodeFileExport(PsetNodePtr nodePtr, LDAP *ld, FILE *fstream)
valBuf = (char *)PR_Realloc(valBuf, valLen + 1); /*+1 for ending
'\0'*/
prevValLen = valLen;
}
+ if (!valBuf) {
+ errorCode = PSET_SYSTEM_ERR;
+ goto bail;
+ }
PR_snprintf(valBuf, valLen + 1, "%s", valList[i]);
sptr = valBuf;
while ((cptr = strchr(sptr, '\n'))) {
@@ -770,6 +774,7 @@ psetNodeFileExport(PsetNodePtr nodePtr, LDAP *ld, FILE *fstream)
}
listPtr = listPtr->next;
}
+bail:
nvlistDestroy(resultList);
}
commit b83d718da4b7e0f20f0039a439215e19c5a43daf
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Apr 18 14:33:03 2011 -0700
Bug 697641 - Check if pset is NULL before dereferencing
We should check if pset is NULL before dereferencing it.
cov#10759
diff --git a/lib/libadminutil/psetc.c b/lib/libadminutil/psetc.c
index f70b514..3d01d38 100644
--- a/lib/libadminutil/psetc.c
+++ b/lib/libadminutil/psetc.c
@@ -1204,7 +1204,7 @@ psetRootModAttrList(PsetRootPtr psetRoot, int mode, AttributeList
nvl)
return PSET_LOCAL_MODE;
}
- if (target && nodeFlag) {
+ if (target && nodeFlag && pset) {
attrList = (ListNodePtr)nodePtr->val;
/* Check the existence of the attribute */
@@ -1283,7 +1283,9 @@ psetRootModAttrList(PsetRootPtr psetRoot, int mode, AttributeList
nvl)
}
nodePtr=nodePtr->next;
}
- psetFileExportP(pset);
+ if (pset) {
+ psetFileExportP(pset);
+ }
destroyUpdateList(updateList);
return errorcode;
}
commit a551b3ba27dbd253acb16a72f806df3ff3dc9983
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Apr 18 14:21:49 2011 -0700
Bug 697641 - Check if nodeName is NULL before dereferencing
We should check if nodeName is NULL before dereferencing it.
cov#10763,10706
diff --git a/lib/libadminutil/psetc.c b/lib/libadminutil/psetc.c
index 79f2b6d..f70b514 100644
--- a/lib/libadminutil/psetc.c
+++ b/lib/libadminutil/psetc.c
@@ -822,11 +822,10 @@ psetLDAPRefresh(PsetPtr pset)
nodeName = dn2AttrName(dn, pset->sieDN);
ldap_memfree(dn);
- if (nodeName[0] == '\0') {
+ if (!nodeName || (nodeName[0] == '\0')) {
psetNodeSetLDAP(pset->info, result);
pset->info->attrLDAP = e;
- }
- else {
+ } else {
target = psetNodeFindNode(pset->info, pset->ld, nodeName, &nodeFlag,
&errorCode);
if (target) {
@@ -909,12 +908,14 @@ psetFileImportP(PsetPtr pset)
case 1:
/* EOF, out of here */
if (namebuf[0] != '\0') {
- if (nodeName[0] == '\0') target = pset->info;
- else if (lastPsetNode && !strcasecmp(nodeName,
lastPsetNode->attrName))
+ if (!nodeName || (nodeName[0] == '\0')) {
+ target = pset->info;
+ } else if (lastPsetNode && !strcasecmp(nodeName,
lastPsetNode->attrName)) {
/* Is the last node? -> strcasecmp node name */
target = lastPsetNode;
- else /* No, Locate and build node -> psetnodeBuildNodes */
+ } else { /* No, Locate and build node -> psetnodeBuildNodes */
target = psetNodeBuildNodes(pset->info, nodeName, &errorCode);
+ }
/* psetNodeAddNameValue */
if (target) {
@@ -958,12 +959,14 @@ psetFileImportP(PsetPtr pset)
}
else {
if (namebuf[0] != '\0') {
- if (nodeName[0] == '\0') target = pset->info;
- else if (lastPsetNode && !strcasecmp(nodeName,
lastPsetNode->attrName))
+ if (!nodeName || (nodeName[0] == '\0')) {
+ target = pset->info;
+ } else if (lastPsetNode && !strcasecmp(nodeName,
lastPsetNode->attrName)) {
/* Is the last node? -> strcasecmp node name */
target = lastPsetNode;
- else /* No, Locate and build node -> psetnodeBuildNodes */
+ } else { /* No, Locate and build node -> psetnodeBuildNodes */
target = psetNodeBuildNodes(pset->info, nodeName, &errorCode);
+ }
/* psetNodeAddNameValue */
if (target) {
commit 72f7b32ab6ad9b77bc92df4f7918ae1e7170ffd9
Author: Nathan Kinder <nkinder(a)redhat.com>
Date: Mon Apr 18 12:55:51 2011 -0700
Bug 697641 - Check return value of DER_UTCTimeToAscii()
We should check if DER_UTCTimeToAscii() returns NULL before
dereferencing the returned pointer.
cov#10766,10765
diff --git a/lib/libadmsslutil/certmgt.c b/lib/libadmsslutil/certmgt.c
index f0b2aea..a674571 100644
--- a/lib/libadmsslutil/certmgt.c
+++ b/lib/libadmsslutil/certmgt.c
@@ -75,10 +75,15 @@ static SECStatus cmgShowCrlRow(CERTSignedCrl *crl)
}
datestr = DER_UTCTimeToAscii(&crl->crl.nextUpdate);
+ if (!datestr) {
+ return SECFailure;
+ }
/* validity = SEC_CheckCrlTimes(&crl->crl, time(NULL)); */
printf("%s;%s\n", nn, datestr);
+ PORT_Free(datestr);
+
return SECSuccess;
}
@@ -105,21 +110,26 @@ cmgShowCrls(CERTCertDBHandle *handle, int list_type)
PR_IMPLEMENT(char *)
cmgHTMLCrlInfo(CERTSignedCrl *crl)
{
- char *issuer;
- char *notBefore, *notAfter;
+ char *issuer = NULL;
+ char *notBefore = NULL;
+ char *notAfter = NULL;
#define NCHARPERLINE 50
#define NLINES 20
- char * outputBuffer;
+ char *outputBuffer = NULL;
if (!crl) {
- return(0);
+ goto bail;
}
issuer = CERT_FormatName(&crl->crl.name);
notBefore = (char *)DER_UTCTimeToAscii(&crl->crl.lastUpdate);
notAfter = (char *)DER_UTCTimeToAscii(&crl->crl.nextUpdate);
+ if (!issuer || !notBefore || !notAfter) {
+ goto bail;
+ }
+
/* reformat dates */
notBefore[10] = ',';
notAfter[10] = ',';
@@ -133,6 +143,7 @@ cmgHTMLCrlInfo(CERTSignedCrl *crl)
outputBuffer = PR_smprintf("ISSUER=%s\nNOTBEFORE=%s\nNOTAFTER=%s\n",
issuer, notBefore, notAfter);
+bail:
if ( issuer ) {
PORT_Free(issuer);
}