[BUG] Potential null pointer dereference vulnerability
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 405
- Forks
- 99
- Avg merge
- 3m
- Merged PRs (30d)
- 1
Description
Hi, I have found a potential null pointer dereference bug in the project and would like to report it to the maintainers. Can you please help me check it? Thank you for your effort and patience!
Below is the execution sequence of the program that may produce null pointer dereference bug.
In the file src/common/cisco_eeprom.c, the function cisco_eeprom_copy calls cisco_eeprom_free at line 553, in which **eeprom->data (dst->data) ** is assigned as NULL. If the function malloc fails at line 555, dst->data will remain NULL (otherwise it will be assigned as a newly malloced space at line 560).
As the image shown below, after step 4、5、6, NULL value may be dereferenced in the file src/common/cisco_eeprom.c at line 592 in the function cisco_eeprom_get_byte.
Thank you very much for reading and I look forward to hearing from you!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/common/cisco_eeprom.c with cisco_eeprom_copy, cisco_eeprom_free, and cisco_eeprom_get_byte, then trace the reported malloc-failure sequence around lines 553-592. Confirm whether dst->data can remain NULL and whether get_byte dereferences it; done means the reported execution path no longer permits a null dereference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100