dynamips
dynamips copied to clipboard
GNS3
Null pointer dereference
hello, I found a bug of null-pointer-dereference in the source code of dynamips , would you help me check if this bug is true?Thank you very much!
here is an overview of bug occurrence.
step1:
in file dynamips/common/rom2c.c, line 63:
call elf32_getehdr and load its return value to ehdr(addtionally,img_elf is guaranteed not to be null according to line 46)
step2:
in file libelf/elf32_getehdr.c, line 92:
call getehdr_impl, img_elf is used as the 1st parameter
step3:
in file libelf/elf32_getehdr.c, line 53/71:
there are two paths that may return null(though with low possibility)
step4:
in file libelf/elf32_getehdr.c, line 95:
return result to caller which can be null
step5:
in file dynamips/common/rom2c.c, line 63:
load return value of elf32_getehdr to ehdr which can be null
step6:
in file dynamips/common/rom2c.c, line 74:
derefer ehdr without check if ehdr is null
