potential unit read in `src/identify_disks.c`
- Dominant language
- Python
- Stars
- 11
- Forks
- 24
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 1
Description
The return value of `initialize_nvme_controller` is ignored in the `identify_disks` loop https://github.com/Azure/azure-vm-utils/blob/411339288287e788933428dae4d6da696b27e8e4/src/identify_disks.c#L310
If `initialize_nvme_controller` fails (e.g., if `fopen` or `fgets` fails), `ctrl.model` remains uninitialized stack memory. `enumerate_namespaces_for_controller` subsequently reads `ctrl->model` to create a JSON string:
```c
json_object_object_add(namespace_obj, "model", json_object_new_string(ctrl->model));
```
This leads to an out-of-bounds read, potential segmentation fault, or disclosure of sensitive stack memory to stdout.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/identify_disks.c around the identify_disks loop at the linked line, then read initialize_nvme_controller and enumerate_namespaces_for_controller. Trace the failure path for fopen or fgets and verify that a failed initialization cannot cause an uninitialized ctrl->model to be serialized; confirm the existing project checks still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100