From 341323871ef459ac7c3b85728caa568e14f9f912 Mon Sep 17 00:00:00 2001 From: Dmitri Pal Date: Thu, 17 Nov 2011 09:45:06 -0500 Subject: [PATCH] [COLLECTION] Fixing dereferencing NULL This is the issue found by Coverity. If the proprty is NULL but type is not there is dereferencing of the NULL veriable in the check. --- collection/collection.c | 6 ++- collection/collection_ut.c | 67 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 2 deletions(-) diff --git a/collection/collection.c b/collection/collection.c index 4bee949..1b7762a 100644 --- a/collection/collection.c +++ b/collection/collection.c @@ -1588,11 +1588,13 @@ static int col_find_item_and_do(struct collection_item *ci, /* Make sure that there is anything to search */ type &= COL_TYPE_ANY; - if (((property_to_find == NULL) && (type == 0)) || - ((*property_to_find == '\0') && (type == 0))) { + if ((type == 0) && + ((property_to_find == NULL) || + ((property_to_find != NULL) && (*property_to_find == '\0')))) { TRACE_ERROR_NUMBER("No item search criteria specified - returning error!", ENOENT); return ENOENT; } + /* Prepare data for traversal */ traverse_data = (struct find_name *)malloc(sizeof(struct find_name)); if (traverse_data == NULL) { diff --git a/collection/collection_ut.c b/collection/collection_ut.c index e11b0aa..74f1679 100644 --- a/collection/collection_ut.c +++ b/collection/collection_ut.c @@ -1630,6 +1630,34 @@ int search_test(void) found = 0; error = 0; + error = col_is_item_in_collection(level1, NULL, COL_TYPE_INTEGER, COL_TRAVERSE_DEFAULT, &found); + if ((error) || (!found)) { + col_destroy_collection(level1); + col_destroy_collection(level2); + col_destroy_collection(level3); + col_destroy_collection(level4); + printf("Failed to find first int item [level1!level2!level3!level4!id]. Error %d\n", error); + return error ? error : ENOENT; + } + else COLOUT(printf("Expected item is found\n")); + + + found = 0; + error = 0; + error = col_is_item_in_collection(level1, "", COL_TYPE_INTEGER, COL_TRAVERSE_DEFAULT, &found); + if ((error) || (!found)) { + col_destroy_collection(level1); + col_destroy_collection(level2); + col_destroy_collection(level3); + col_destroy_collection(level4); + printf("Failed to find first int item [level1!level2!level3!level4!id]. Error %d\n", error); + return error ? error : ENOENT; + } + else COLOUT(printf("Expected item is found\n")); + + + found = 0; + error = 0; error = col_is_item_in_collection(level1, "level3!level4!id", COL_TYPE_ANY, COL_TRAVERSE_DEFAULT, &found); if ((error) || (!found)) { col_destroy_collection(level1); @@ -1680,6 +1708,45 @@ int search_test(void) } else COLOUT(printf("Expected item is found\n")); + /* Negative tests */ + found = 0; + error = 0; + error = col_is_item_in_collection(level1, NULL, 0, COL_TRAVERSE_DEFAULT, &found); + if ((error != ENOENT) || (found)) { + col_destroy_collection(level1); + col_destroy_collection(level2); + col_destroy_collection(level3); + col_destroy_collection(level4); + if (error) { + printf("Unexpected error with NULL & 0 test %d\n", error); + } + else { + printf("Found unexpected item with NULL & 0. Error %d\n", error); + error = EINVAL; + } + return error; + } + else COLOUT(printf("No item is found as expected.\n")); + + found = 0; + error = 0; + error = col_is_item_in_collection(level1, "", 0, COL_TRAVERSE_DEFAULT, &found); + if ((error != ENOENT) || (found)) { + col_destroy_collection(level1); + col_destroy_collection(level2); + col_destroy_collection(level3); + col_destroy_collection(level4); + if (error) { + printf("Unexpected error with \"\" & 0 tests %d\n", error); + } + else { + printf("Found unexpected item with \"\" & 0. Error %d\n", error); + error = EINVAL; + } + return error; + } + else COLOUT(printf("No item is found as expected.\n")); + col_destroy_collection(level1); col_destroy_collection(level2); col_destroy_collection(level3); -- 1.7.1