microsoft / microsoft/ntttcp-for-linux

ASPRINTF macro does not set the output pointer to NULL on failure

Open
#115 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
426
Forks
108
PR merge metrics
No merged PRs in 30d

Description

Received below comments in #112 from Copilot.

Comment 1:
port_str is built via ASPRINTF(&port_str, ...), but the ASPRINTF macro does not set the output pointer to NULL on failure and asprintf() leaves *strp undefined on error. On the getaddrinfo failure path you then free(port_str), which can free an invalid pointer if formatting failed (and getaddrinfo() would also be called with an undefined string). Use asprintf() directly and check its return value before calling getaddrinfo()/free().

Comment 2:
In the bind-failure path, the code appends errno to log after calling ASPRINTF, but asprintf() (and other libc calls) may modify errno. This can log the wrong error code. Also, ASPRINTF hides allocation failure, which makes log handling brittle. Capture errno immediately after bind() fails and use asprintf() return codes to manage log/old_log safely.

Comment 3:

Image

Issue

Code in logger.h:

#define ASPRINTF(...) { \
    int nc = asprintf(__VA_ARGS__); \
    if (nc < 0) \
        PRINT_ERR("error occurs in asprintf"); \
}
  • When asprintf() fails (nc < 0), it prints an error but continues execution, leaving port_str undefined.

The code then:

  • Passes undefined port_str to getaddrinfo()
  • Attempts to free(port_str) with an undefined pointe

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in logger.h, then find the ASPRINTF call sites involved in port_str, getaddrinfo(), and the bind() failure path. Trace how allocation failures and errno are used through those paths; done means failures do not leave an undefined pointer in use or free, and bind errors retain the original errno for logging.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.