libnfs
libnfs copied to clipboard
Fix the null reference vulnerability.
Hello,
Our team has recently been conducting research on a null-pointer-dereference (NPD) vulnerability detection tool and used it to scan libnfs(the version on the master branch). After a manual review, we have identified some potentially vulnerable code snippets that may lead to null-pointer-dereference bugs.
The NULL Dereference vulnerability happens in static void nfs4_open_confirm_cb(), nfs_v4.c
How the NULL Pointer Dereference happens:
- When
res == NULL. - NULL dereference of variable
reshappens atocresok = &res->resarray.resarray_val[i].nfs_resop4_u.opopen_confirm.OPEN_CONFIRM4res_u.resok4;
static void
nfs4_open_confirm_cb(struct rpc_context *rpc, int status, void *command_data,
void *private_data)
{
......
COMPOUND4res *res = command_data;
......
=> if (res){//false
nfs_increment_seqid(fh, res->status);
}
if (check_nfs4_error(nfs, status, data, res, "OPEN_CONFIRM")) {......}
if ((i = nfs4_find_op(nfs, data, res, OP_OPEN_CONFIRM,"OPEN_CONFIRM")) < 0) {return;}
=> ocresok = &res->resarray.resarray_val[i].nfs_resop4_u.opopen_confirm.OPEN_CONFIRM4res_u.resok4;
......
}
}