[PATCH] src: fix DEREF_AFTER_NULL.EX in elflint.c

Anton Moryakov ant.v.moryakov@gmail.com
Fri Jan 31 22:43:44 GMT 2025


Report of the static analyzer:
After having been compared to a NULL value at
elflint.c:252, pointer 'suffix' is dereferenced at elflint.c:260
by calling function 'stpcpy'

Corrections explained:
When processing a file with a NULL suffix, the code could dereference
a NULL pointer, leading to undefined behavior. This patch adds a check
to ensure suffix is not NULL before using it in stpcpy.

The fix ensures that new_suffix is properly initialized even when
suffix is NULL, avoiding potential crashes.

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov at gmail.com>

---
 src/elflint.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/elflint.c b/src/elflint.c
index cdc6108d..fba18f5a 100644
--- a/src/elflint.c
+++ b/src/elflint.c
@@ -257,7 +257,10 @@ process_file (int fd, Elf *elf, const char *prefix, const char *suffix,
 	  {
 	    cp = mempcpy (cp, prefix, prefix_len);
 	    *cp++ = '(';
-	    strcpy (stpcpy (new_suffix, suffix), ")");
+		if(suffix != NULL)
+	    	strcpy (stpcpy (new_suffix, suffix), ")");
+		else	
+			new_suffix[0] = '\0';
 	  }
 	else
 	  new_suffix[0] = '\0';
-- 
2.30.2



More information about the Elfutils-devel mailing list