Re: [Libvirt-cim] [PATCH 3/8] device_parsing: Avoid NULL dereferences

3 Nov 2011

...
"Eduardo Lima (Etrunko)" <eblima@linux.vnet.ibm.com>
Sent by: libvirt-cim-bounces@redhat.com
11/03/2011 10:48 AM
Please respond to
List for discussion and development of libvirt CIM
<libvirt-cim@redhat.com>
To
libvirt-cim@redhat.com
cc
"Eduardo Lima \(Etrunko\)" <eblima@br.ibm.com>
Subject
[Libvirt-cim] [PATCH 3/8] device_parsing: Avoid NULL dereferences
From: Eduardo Lima (Etrunko) <eblima@br.ibm.com>
As revealed by Coverity scan report:
https://bugzilla.redhat.com/show_bug.cgi?id=728245#c8
https://bugzilla.redhat.com/attachment.cgi?id=530435
Error: REVERSE_INULL:
device_parsing.c:1153: deref_ptr: Directly dereferencing pointer
"dominfo".
device_parsing.c:1155: check_after_deref: Dereferencing "dominfo"
before a null
                                          check.
Error: FORWARD_NULL:
device_parsing.c:226: assign_zero: Assigning: "ddev" = 0.
device_parsing.c:284: var_deref_model: Passing null variable "ddev"
to function
                      "cleanup_disk_device", which dereferences it.
device_parsing.c:54: deref_parm: Directly dereferencing parameter "dev".
Error: FORWARD_NULL:
device_parsing.c:170: assign_zero: Assigning: "ddev" = 0.
device_parsing.c:217: var_deref_model: Passing null variable "ddev"
to function
                      "cleanup_disk_device", which dereferences it.
device_parsing.c:54: deref_parm: Directly dereferencing parameter "dev".
Error: FORWARD_NULL:
device_parsing.c:457: assign_zero: Assigning: "edev" = 0.
device_parsing.c:475: var_deref_model: Passing null variable "edev"
to function
                      "cleanup_emu_device", which dereferences it.
device_parsing.c:88: deref_parm: Directly dereferencing parameter "dev".
Error: FORWARD_NULL:
device_parsing.c:516: assign_zero: Assigning: "gdev" = 0.
device_parsing.c:579: var_deref_model: Passing null variable "gdev"
to function
                      "cleanup_graphics_device", which dereferences it.
device_parsing.c:93: deref_parm: Directly dereferencing parameter "dev".
Error: FORWARD_NULL:
device_parsing.c:588: assign_zero: Assigning: "idev" = 0.
device_parsing.c:615: var_deref_model: Passing null variable "idev"
to function
                      "cleanup_input_device", which dereferences it.
device_parsing.c:102: deref_parm: Directly dereferencing parameter "dev".
Error: FORWARD_NULL:
device_parsing.c:310: var_compare_op: Comparing "vsi_dev" to null implies
+1

Sharad Mishra
Open Virtualization
Linux Technology Center
IBM

libvirt-cim-bounces@redhat.com wrote on 11/03/2011 10:48:31 AM:

that
...
"vsi_dev" might be null.
device_parsing.c:344: var_deref_model: Passing null variable "vsi_dev" to
                      function "cleanup_vsi_device", which dereferences
it.
...
device_parsing.c:66: deref_parm: Directly dereferencing parameter "dev".
Error: FORWARD_NULL:
device_parsing.c:352: assign_zero: Assigning: "ndev" = 0.
device_parsing.c:416: var_deref_model: Passing null variable "ndev"
to function
                      "cleanup_net_device", which dereferences it.
device_parsing.c:77: deref_parm: Directly dereferencing parameter "dev".
Signed-off-by: Eduardo Lima (Etrunko) <eblima@br.ibm.com>
---
 libxkutil/device_parsing.c |   21 ++++++++++++++++++++-
 1 files changed, 20 insertions(+), 1 deletions(-)

diff --git a/libxkutil/device_parsing.c b/libxkutil/device_parsing.c
index d25461e..371838f 100644
--- a/libxkutil/device_parsing.c
+++ b/libxkutil/device_parsing.c
@@ -54,6 +54,9 @@ typedef int (*dev_parse_func_t)(xmlNode *, struct
virt_device **);
static void cleanup_disk_device(struct disk_device *dev)
 {
+        if (dev == NULL)
+                return;
+
         free(dev->type);
         free(dev->device);
         free(dev->driver);
@@ -66,6 +69,9 @@ static void cleanup_disk_device(struct disk_device
*dev)
static void cleanup_vsi_device(struct vsi_device *dev)
 {
+        if (dev == NULL)
+                return;
+
         free(dev->vsi_type);
         free(dev->manager_id);
         free(dev->type_id);
@@ -77,6 +83,9 @@ static void cleanup_vsi_device(struct vsi_device *dev)
static void cleanup_net_device(struct net_device *dev)
 {
+        if (dev == NULL)
+                return;
+
         free(dev->type);
         free(dev->mac);
         free(dev->source);
@@ -88,6 +97,9 @@ static void cleanup_net_device(struct net_device *dev)
static void cleanup_emu_device(struct emu_device *dev)
 {
+        if (dev == NULL)
+                return;
+
         free(dev->path);
 }
@@ -108,6 +120,9 @@ static void cleanup_sdl_device(struct
graphics_device *dev)
static void cleanup_graphics_device(struct graphics_device *dev)
 {
+        if (dev == NULL)
+                return;
+
         if (STREQC(dev->type, "sdl")) {
             cleanup_sdl_device(dev);
         }
@@ -119,6 +134,9 @@ static void cleanup_graphics_device(struct
graphics_device *dev)
static void cleanup_input_device(struct input_device *dev)
 {
+        if (dev == NULL)
+                return;
+
         free(dev->type);
         free(dev->bus);
 }
@@ -1207,11 +1225,12 @@ int get_dominfo(virDomainPtr dom, struct
domain **dominfo)
void cleanup_dominfo(struct domain **dominfo)
 {
-        struct domain *dom = *dominfo;
+        struct domain *dom;
if ((dominfo == NULL) || (*dominfo == NULL))
                 return;
+        dom = *dominfo;
         free(dom->name);
         free(dom->uuid);
         free(dom->bootloader);
--
1.7.4.4
_______________________________________________
Libvirt-cim mailing list
Libvirt-cim@redhat.com
https://www.redhat.com/mailman/listinfo/libvirt-cim


    