[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-trivial] [PATCH 3/3] util/uri: URI member path can be null, compar
From: |
Markus Armbruster |
Subject: |
[Qemu-trivial] [PATCH 3/3] util/uri: URI member path can be null, compare more carfully |
Date: |
Tue, 27 Jan 2015 17:13:52 +0100 |
uri_resolve_relative() calls strcmp(bas->path, ref->path). However,
either argument could be null! Evidence: the code checks for null
after the comparison. Spotted by Coverity.
I suspect this was screwed up when we stole the code from libxml2.
There the conditional reads
xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)
with
int
xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
if (str1 == str2) return(1);
if (str1 == NULL) return(0);
if (str2 == NULL) return(0);
do {
if (*str1++ != *str2) return(0);
} while (*str2++);
return(1);
}
Fix by replicating libxml2's logic faithfully.
Cc: Paolo Bonzini <address@hidden>
Signed-off-by: Markus Armbruster <address@hidden>
---
util/uri.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/util/uri.c b/util/uri.c
index b9a7b54..1cfd78b 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -1935,7 +1935,8 @@ uri_resolve_relative (const char *uri, const char * base)
val = g_strdup (uri);
goto done;
}
- if (!strcmp(bas->path, ref->path)) {
+ if (bas->path == ref->path ||
+ (bas->path && ref->path && !strcmp(bas->path, ref->path))) {
val = g_strdup("");
goto done;
}
--
1.9.3
- [Qemu-trivial] [PATCH 0/3] util/uri: Cleanups and a bug fix, Markus Armbruster, 2015/01/27
- [Qemu-trivial] [PATCH 3/3] util/uri: URI member path can be null, compare more carfully,
Markus Armbruster <=
- [Qemu-trivial] [PATCH 1/3] util/uri: uri_new() can't fail, drop dead error handling, Markus Armbruster, 2015/01/27
- [Qemu-trivial] [PATCH 2/3] util/uri: realloc2n() can't fail, drop dead error handling, Markus Armbruster, 2015/01/27
- Re: [Qemu-trivial] [PATCH 0/3] util/uri: Cleanups and a bug fix, Paolo Bonzini, 2015/01/27