[MERGED] osmo-mgw[master]: osmux: fix nullpointer dereference

[Neels Hofmeyr]

Neels Hofmeyr has submitted this change and it was merged.

Change subject: osmux: fix nullpointer dereference
..


osmux: fix nullpointer dereference

in point_lookup() the connection pointer is determined using
mgcp_conn_get_rtp() this function may return 0. At the moment
there are no nullpointer checks implemented

Add checks to test for nullpointer.

Fixes: Coverity CID#178662
Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
---
M src/libosmo-mgcp/mgcp_osmux.c
1 file changed, 10 insertions(+), 3 deletions(-)

Approvals:
  Neels Hofmeyr: Looks good to me, approved
  Jenkins Builder: Verified



diff --git a/src/libosmo-mgcp/mgcp_osmux.c b/src/libosmo-mgcp/mgcp_osmux.c
index 60ffe06..09b2636 100644
--- a/src/libosmo-mgcp/mgcp_osmux.c
+++ b/src/libosmo-mgcp/mgcp_osmux.c
@@ -207,12 +207,18 @@
case MGCP_DEST_NET:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   this = _net->end.addr;
+   if (conn_net)
+   this = _net->end.addr;
+   else
+   this = NULL;
break;
case MGCP_DEST_BTS:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_bts = mgcp_conn_get_rtp(endp, CONN_ID_BTS);
-   this = _bts->end.addr;
+   if (conn_bts)
+   this = _bts->end.addr;
+   else
+   this = NULL;
break;
default:
/* Should not ever happen */
@@ -222,7 +228,8 @@
 
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   if (conn_net->osmux.cid == cid && this->s_addr == 
from_addr->s_addr)
+   if (conn_net && this && conn_net->osmux.cid == cid
+   && this->s_addr == from_addr->s_addr)
return endp;
}
 

-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: merged
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 4
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter 
Gerrit-Reviewer: Harald Welte 
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: Neels Hofmeyr 

osmo-mgw[master]: osmux: fix nullpointer dereference

[Neels Hofmeyr]

Patch Set 3: Code-Review+2

-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 3
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter 
Gerrit-Reviewer: Harald Welte 
Gerrit-Reviewer: Jenkins Builder
Gerrit-Reviewer: Neels Hofmeyr 
Gerrit-HasComments: No

[PATCH] osmo-mgw[master]: osmux: fix nullpointer dereference

[Neels Hofmeyr]

Hello Harald Welte, Jenkins Builder,

I'd like you to reexamine a change.  Please visit

https://gerrit.osmocom.org/4711

to look at the new patch set (#3).

osmux: fix nullpointer dereference

in point_lookup() the connection pointer is determined using
mgcp_conn_get_rtp() this function may return 0. At the moment
there are no nullpointer checks implemented

Add checks to test for nullpointer.

Fixes: Coverity CID#178662
Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
---
M src/libosmo-mgcp/mgcp_osmux.c
1 file changed, 10 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-mgw refs/changes/11/4711/3

diff --git a/src/libosmo-mgcp/mgcp_osmux.c b/src/libosmo-mgcp/mgcp_osmux.c
index 60ffe06..09b2636 100644
--- a/src/libosmo-mgcp/mgcp_osmux.c
+++ b/src/libosmo-mgcp/mgcp_osmux.c
@@ -207,12 +207,18 @@
case MGCP_DEST_NET:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   this = _net->end.addr;
+   if (conn_net)
+   this = _net->end.addr;
+   else
+   this = NULL;
break;
case MGCP_DEST_BTS:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_bts = mgcp_conn_get_rtp(endp, CONN_ID_BTS);
-   this = _bts->end.addr;
+   if (conn_bts)
+   this = _bts->end.addr;
+   else
+   this = NULL;
break;
default:
/* Should not ever happen */
@@ -222,7 +228,8 @@
 
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   if (conn_net->osmux.cid == cid && this->s_addr == 
from_addr->s_addr)
+   if (conn_net && this && conn_net->osmux.cid == cid
+   && this->s_addr == from_addr->s_addr)
return endp;
}
 

-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newpatchset
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 3
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter 
Gerrit-Reviewer: Harald Welte 
Gerrit-Reviewer: Jenkins Builder

osmo-mgw[master]: osmux: fix nullpointer dereference

[Harald Welte]

Patch Set 2: Code-Review+2

-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 2
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter 
Gerrit-Reviewer: Harald Welte 
Gerrit-Reviewer: Jenkins Builder
Gerrit-HasComments: No

[PATCH] osmo-mgw[master]: osmux: fix nullpointer dereference

[dexter]

Hello Jenkins Builder,

I'd like you to reexamine a change.  Please visit

https://gerrit.osmocom.org/4711

to look at the new patch set (#2).

osmux: fix nullpointer dereference

in point_lookup() the connection pointer is determined using
mgcp_conn_get_rtp() this function may return 0. At the moment
there are no nullpointer checks implemented

Add checks to test for nullpointer.

Fixes: Coverity CID#178662

Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
---
M src/libosmo-mgcp/mgcp_osmux.c
1 file changed, 10 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-mgw refs/changes/11/4711/2

diff --git a/src/libosmo-mgcp/mgcp_osmux.c b/src/libosmo-mgcp/mgcp_osmux.c
index 60ffe06..09b2636 100644
--- a/src/libosmo-mgcp/mgcp_osmux.c
+++ b/src/libosmo-mgcp/mgcp_osmux.c
@@ -207,12 +207,18 @@
case MGCP_DEST_NET:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   this = _net->end.addr;
+   if (conn_net)
+   this = _net->end.addr;
+   else
+   this = NULL;
break;
case MGCP_DEST_BTS:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_bts = mgcp_conn_get_rtp(endp, CONN_ID_BTS);
-   this = _bts->end.addr;
+   if (conn_bts)
+   this = _bts->end.addr;
+   else
+   this = NULL;
break;
default:
/* Should not ever happen */
@@ -222,7 +228,8 @@
 
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   if (conn_net->osmux.cid == cid && this->s_addr == 
from_addr->s_addr)
+   if (conn_net && this && conn_net->osmux.cid == cid
+   && this->s_addr == from_addr->s_addr)
return endp;
}
 

-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newpatchset
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 2
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter 
Gerrit-Reviewer: Harald Welte 
Gerrit-Reviewer: Jenkins Builder

osmo-mgw[master]: osmux: fix nullpointer dereference

[Harald Welte]

Patch Set 1:

(2 comments)

https://gerrit.osmocom.org/#/c/4711/1//COMMIT_MSG
Commit Message:

Line 15: This fixes CID 178662
syntax


https://gerrit.osmocom.org/#/c/4711/1/src/libosmo-mgcp/mgcp_osmux.c
File src/libosmo-mgcp/mgcp_osmux.c:

Line 213:   this = NULL;
one could simply initialize 'this' to NULL in the variable declaration and save 
the 'else' clauses here. Not overly important.


-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 1
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter 
Gerrit-Reviewer: Harald Welte 
Gerrit-Reviewer: Jenkins Builder
Gerrit-HasComments: Yes

[PATCH] osmo-mgw[master]: osmux: fix nullpointer dereference

[dexter]

Review at  https://gerrit.osmocom.org/4711

osmux: fix nullpointer dereference

in point_lookup() the connection pointer is determined using
mgcp_conn_get_rtp() this function may return 0. At the moment
there are no nullpointer checks implemented

Add checks to test for nullpointer.

This fixes CID 178662

Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
---
M src/libosmo-mgcp/mgcp_osmux.c
1 file changed, 10 insertions(+), 3 deletions(-)


  git pull ssh://gerrit.osmocom.org:29418/osmo-mgw refs/changes/11/4711/1

diff --git a/src/libosmo-mgcp/mgcp_osmux.c b/src/libosmo-mgcp/mgcp_osmux.c
index 60ffe06..09b2636 100644
--- a/src/libosmo-mgcp/mgcp_osmux.c
+++ b/src/libosmo-mgcp/mgcp_osmux.c
@@ -207,12 +207,18 @@
case MGCP_DEST_NET:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   this = _net->end.addr;
+   if (conn_net)
+   this = _net->end.addr;
+   else
+   this = NULL;
break;
case MGCP_DEST_BTS:
/* FIXME: Get rid of CONN_ID_XXX! */
conn_bts = mgcp_conn_get_rtp(endp, CONN_ID_BTS);
-   this = _bts->end.addr;
+   if (conn_bts)
+   this = _bts->end.addr;
+   else
+   this = NULL;
break;
default:
/* Should not ever happen */
@@ -222,7 +228,8 @@
 
/* FIXME: Get rid of CONN_ID_XXX! */
conn_net = mgcp_conn_get_rtp(endp, CONN_ID_NET);
-   if (conn_net->osmux.cid == cid && this->s_addr == 
from_addr->s_addr)
+   if (conn_net && this && conn_net->osmux.cid == cid
+   && this->s_addr == from_addr->s_addr)
return endp;
}
 

-- 
To view, visit https://gerrit.osmocom.org/4711
To unsubscribe, visit https://gerrit.osmocom.org/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: If9a3c1ac002bc8adc90ca1c1c3dd1db4feea07ac
Gerrit-PatchSet: 1
Gerrit-Project: osmo-mgw
Gerrit-Branch: master
Gerrit-Owner: dexter