353865 - klocwork Null ptr deref in softoken/pk11db.c

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P2)

Description

[Nelson Bolyard (seldom reads bugmail)]

Klocwork ID 88483
Function: secmod_getSecmodName
Location: nss/lib/softoken/pk11db.c : 286

Pointer 'configdir' returned from call to function 'secmod_argFetchValue' 
at line 271 may be NULL and will be dereferenced by passing argument 1 to 
function 'sftk_EvaluateConfigDir' at line 286.

270	    while (*param) { 
271		SECMOD_HANDLE_STRING_ARG(param,configdir,"configDir=",;) 
272		SECMOD_HANDLE_STRING_ARG(param,secmodName,"secmod=",;) 
273		SECMOD_HANDLE_FINAL_ARG(param) 
274	   } 
286	   lconfigdir = sftk_EvaluateConfigDir(configdir, appName);

Comment 1

[Alexei Volkov]

Attachment: check a pointer for NULL before calling sftk_EvaluateConfigDir

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 242935 [details] [diff] [review]
check a pointer for NULL before calling sftk_EvaluateConfigDir

>-   lconfigdir = sftk_EvaluateConfigDir(configdir, appName);
>+   if (configdir) {
>+       lconfigdir = sftk_EvaluateConfigDir(configdir, appName);
>+   }
>    if (lconfigdir) {

lconfigdir is uninitialized, so value is random if !confidir.

Comment 3

[Alexei Volkov]

Attachment: init lconfigdir

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 243410 [details] [diff] [review]
init lconfigdir

r=nelson

Comment 5

[Alexei Volkov]

/cvsroot/mozilla/security/nss/lib/softoken/pk11db.c,v  <--  pk11db.c
new revision: 1.38; previous revision: 1.37