Skip to content

NULL pointer dereference #263

@smithBraun

Description

@smithBraun

It looks (not tested) like we may have null pointer reference in case that client failed to allocate codec:

  1. if createBufferAndCodec failure, returns NULL:

    Codec *ClientManager::createBufferAndCodec(void)
    {
    Codec *codec = m_codecFactory->create();
    MessageBuffer message;
    if (codec != NULL)
    {
    message = m_messageFactory->create();
    if (NULL != message.get())
    {
    codec->setBuffer(message);
    }
    else
    {
    // Dispose of buffers and codecs.
    m_codecFactory->dispose(codec);
    codec = NULL;
    }
    }
    return codec;
    }

  2. createRequest returns RequestContext with NULL codec:

    RequestContext ClientManager::createRequest(bool isOneway)
    {
    // Create codec to read and write the request.
    Codec *codec = createBufferAndCodec();
    return RequestContext(++m_sequence, codec, isOneway);
    }

  3. In the auto generated code, err is set and releaseRequest is called:

    // Get a new request.
    RequestContext request = g_client->createRequest(false);

    // Encode the request.
    Codec * codec = request.getCodec();

    if (codec == NULL)
    {
        err = kErpcStatus_MemoryError;
    }
    else
    {
        ...
    }
    // Dispose of the request.
    g_client->releaseRequest(request);
  1. The null codec dereferenced
    void ClientManager::releaseRequest(RequestContext &request)
    {
    m_messageFactory->dispose(request.getCodec()->getBuffer());

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions