dynamips icon indicating copy to clipboard operation
dynamips copied to clipboard

A potential bug of null pointer dereference(3)

Open ash1852 opened this issue 2 years ago • 0 comments

hello,I found a potential bug of null pointer dereference in source code of dynamips , would you help me check whether this bug is ture?thank you for your effort and patience very much.

step 1 : In file dynamips/common/utils.c , function dyn_sprintf line 88 : Return null to caller

step 2 : In file dynamips/common/dev_c7200_pos.c , function dev_c7200_pa_pos_init line 700 : Store the return value of function dyn_sprintf to d->tx_name

step 3 : In file dynamips/common/dev_c7200_pos.c , function dev_c7200_pa_pos_init line 717 : d->tx_name is used as the 2nd parameter in function dev_plx9060_init (d->tx_name can be null)

step 4 : In file dynamips/common/dev_plx.c , function dev_plx9060_init line 352: name is passed to function fprintf as a variadic argument (name can be null)

there are several bugs like this bug , so I integrate them together shown as following.

step 1 : In file dynamips/common/utils.c , function dyn_sprintf line 88 : Return null to caller

step 2 : In file dynamips/common/dev_c7200_pos.c , function dev_c7200_pa_pos_init line 707 : Store the return value of function dyn_sprintf to d->cs_name

step 3 : In file dynamips/common/dev_c7200_pos.c , function dev_c7200_pa_pos_init line 720 : d->cs_name is used as the 2nd parameter in function dev_plx9060_init (d->cs_name can be null)

step 4 : In file dynamips/common/dev_plx.c , function dev_plx9060_init line 352 : name is passed to function fprintf as a variadic argument (name can be null)

==============================================================================

step 1 : In file dynamips/common/utils.c , function dyn_sprintf line 88 : Return null to caller

step 2 : In file dynamips/common/dev_c7200_pos.c , function dev_c7200_pa_pos_init line 693 : Store the return value of function dyn_sprintf to d->rx_name

step 3 : In file dynamips/common/dev_c7200_pos.c , function dev_c7200_pa_pos_init line 714 : d->rx_name is used as the 2nd parameter in function dev_plx9060_init (d->rx_name can be null)

step 4 : In file dynamips/common/dev_plx.c , function dev_plx9060_init line 352 : name is passed to function fprintf as a variadic argument (name can be null)

==============================================================================

step 1 : In file dynamips/common/utils.c , function dyn_sprintf line 88 : Return null to caller

step 2 : In file dynamips/common/dev_pa_mc8te1.c , function dev_c7200_pa_mc8te1_init line 267 : Store the return value of function dyn_sprintf to d->plx_name

step 3 : In file dynamips/common/dev_pa_mc8te1.c , function dev_c7200_pa_mc8te1_init line 268 : d->plx_name is used as the 2nd parameter in function dev_plx9054_init (d->plx_name can be null)

step 4 : In file dynamips/common/dev_plx.c , function dev_plx9054_init line 392 : name is passed to function fprintf as a variadic argument (name can be null)

ash1852 avatar Sep 27 '21 06:09 ash1852