GNS3 / GNS3/dynamips

[BUG] Potential null pointer dereference vulnerability

Open
#284 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
405
Forks
99
Avg merge
3m
Merged PRs (30d)
1

Description

Hi, I have found a potential null pointer dereference bug in the project and would like to report it to the maintainers. Can you please help me check it? Thank you for your effort and patience!
Below is the execution sequence of the program that may produce null pointer dereference bug.

In the file src/common/cisco_eeprom.c, the function cisco_eeprom_copy calls cisco_eeprom_free at line 553, in which **eeprom->data (dst->data) ** is assigned as NULL. If the function malloc fails at line 555, dst->data will remain NULL (otherwise it will be assigned as a newly malloced space at line 560).

As the image shown below, after step 4、5、6, NULL value may be dereferenced in the file src/common/cisco_eeprom.c at line 592 in the function cisco_eeprom_get_byte.

Image

Thank you very much for reading and I look forward to hearing from you!

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/common/cisco_eeprom.c with cisco_eeprom_copy, cisco_eeprom_free, and cisco_eeprom_get_byte, then trace the reported malloc-failure sequence around lines 553-592. Confirm whether dst->data can remain NULL and whether get_byte dereferences it; done means the reported execution path no longer permits a null dereference.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.