[PATCH] opcodes: Fix null pointer dereference vulnerability in pv_dup function

[Jan Beulich]

On 27.03.2026 08:36, pengxu@kylinos.cn wrote:
> 
>    In opcodes/opc2c.c file, in the pv_dup() function, directly calling memcpy after malloc poses potential memory safety issues, with the following specific defects:
> 
> No check for malloc return value:
> malloc may fail and return NULL. Calling memcpy on a NULL pointer results in undefined behavior (typically a segmentation fault).
> A check for rv == NULL should be added：
> 	if (rv == NULL)
> 	  return NULL; 

First: If you say "vulnerability" in the title, you'd need to explain what's
vulnerable here. Checking return values of allocation functions is wanted,
yes, but not doing so is not always a vulnerability. Aiui opc2c is a utility
used when building binutils, not in the targeted environments.

Next, I think it would be nice if you addressed similar issues elsewhere in
the same file at the same time. See e.g. safe_fgets().

Further, what use is it to add a check in pv_dup(), when its caller then
still blindly dereferences the NULL it may get back?

Finally a formal (legal) aspect: Unless you have a copyright assignment in
place, we'd need you to sign-off on your change.

Jan