[PATCH] iconv: skeleton.c: Fix potential NULL dereference in FUNCTION_NAME

Anton Moryakov ant.v.moryakov@gmail.com
Wed Oct 29 14:16:04 GMT 2025


Report of the static analyzer:
After being compared to a NULL value at skeleton.c:516, pointer
'irreversible' is dereferenced at skeleton.c:662. This indicates a
potential null pointer dereference vulnerability.

Correct explained:
The pointer 'irreversible' is checked for NULL when initializing
'lirreversiblep' (used in conversion loops), but later unconditionally
dereferenced in the exit path when updating the irreversible counter.
This creates an inconsistency: if the function is called with
irreversible == NULL, and the conversion loop completes successfully,
the final update '*irreversible += lirreversible' will cause a
segmentation fault.

Add a NULL check before dereferencing to prevent the crash. This ensures
consistent behavior with the earlier initialization logic and eliminates
the risk of undefined behavior.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
 iconv/skeleton.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/iconv/skeleton.c b/iconv/skeleton.c
index 7523694b81..4565beff33 100644
--- a/iconv/skeleton.c
+++ b/iconv/skeleton.c
@@ -533,7 +533,8 @@ FUNCTION_NAME (struct __gconv_step *step, struct __gconv_step_data *data,
 
 	      /* Remember how many non-identical characters we
 		 converted in an irreversible way.  */
-	      *irreversible += lirreversible;
+	      if (irreversible != NULL)
+	      	*irreversible += lirreversible;
 
 	      break;
 	    }
-- 
2.39.2



More information about the Libc-alpha mailing list