#701: Segfault by insufficient error handling / around pa_realpath
----------------------+-----------------------------------------------------
Reporter: matthijs | Owner: lennart
Type: defect | Status: new
Milestone: | Component: core
Keywords: |
----------------------+-----------------------------------------------------
Hi,
I'm facing a segfault caused by invalid handling of out-of-memory errors
(I'm working on a swapless embedded system).
The cause of this is the following code in core-util.c/pa_realpath:
{{{
path_buf = pa_xmalloc(PATH_MAX);
if (!(t = realpath(path, path_buf))) {
pa_xfree(path_buf);
return NULL;
}
}}}
Here, there is no check for the pa_xmalloc return value, which should
be there I think. This causes realpath to return NULL (I've also seen
cases where it segfaults directly) and thus pa_realpath to return NULL
as well.
In the main function, there is the following code:
{{{
canonical_rp = pa_realpath(PA_BINARY);
if ((rp = pa_readlink("/proc/self/exe"))) {
if (pa_streq(rp, canonical_rp))
}}}
Here, the return value of pa_realpath is not checked and passed into
pa_streq (== strcmp) directly. If it is NULL, strcmp segfaults.
(Component set to core, but second part is about daemon, btw)
--
Ticket URL: <http://pulseaudio.org/ticket/701>
PulseAudio <http://pulseaudio.org/>
The PulseAudio Sound Server
_______________________________________________
pulseaudio-tickets mailing list
pulseaudio-tickets@mail.0pointer.de
https://tango.0pointer.de/mailman/listinfo/pulseaudio-tickets
