[PATCH] iconv: skeleton.c: Fix potential NULL dereference in FUNCTION_NAME

[Adhemerval Zanella Netto]

On 29/10/25 11:16, Anton Moryakov wrote:
> Report of the static analyzer:
> After being compared to a NULL value at skeleton.c:516, pointer
> 'irreversible' is dereferenced at skeleton.c:662. This indicates a
> potential null pointer dereference vulnerability.
> 
> Correct explained:
> The pointer 'irreversible' is checked for NULL when initializing
> 'lirreversiblep' (used in conversion loops), but later unconditionally
> dereferenced in the exit path when updating the irreversible counter.
> This creates an inconsistency: if the function is called with
> irreversible == NULL, and the conversion loop completes successfully,
> the final update '*irreversible += lirreversible' will cause a
> segmentation fault.
> 
> Add a NULL check before dereferencing to prevent the crash. This ensures
> consistent behavior with the earlier initialization logic and eliminates
> the risk of undefined behavior.
> 
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

Do we have a testcase that triggers this issue? And do we need a bug report
for this?

> ---
>  iconv/skeleton.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/iconv/skeleton.c b/iconv/skeleton.c
> index 7523694b81..4565beff33 100644
> --- a/iconv/skeleton.c
> +++ b/iconv/skeleton.c
> @@ -533,7 +533,8 @@ FUNCTION_NAME (struct __gconv_step *step, struct __gconv_step_data *data,
>  
>  	      /* Remember how many non-identical characters we
>  		 converted in an irreversible way.  */
> -	      *irreversible += lirreversible;
> +	      if (irreversible != NULL)
> +	      	*irreversible += lirreversible;
>  
>  	      break;
>  	    }