Guard gearman_log_error() against NULL error strings#476
Merged
Conversation
gearman_universal_st::error() returns nullptr when the error code is
GEARMAN_SUCCESS, but gearman_log_error() passed that value straight
to the user-supplied log_fn callback with no NULL check. Every other
logging path in this file formats into a local buffer via vsnprintf
and can never hand log_fn a NULL pointer, so this was the one path
that could crash a log_fn implementation that assumes a valid string
(e.g. strlen/fprintf("%s", line)).
Signed-off-by: Alexei Pastuchov <info@maximka.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gearman_universal_st::error()returnsnullptrwhen the error code isGEARMAN_SUCCESS, butgearman_log_error()(libgearman/log.cc) passed that value straight to the user-suppliedlog_fncallback without a NULL check.gearman_log,_info,_debug) formats into a local buffer viavsnprintfand can therefore never handlog_fna NULL pointer —gearman_log_errorwas the one path that could crash alog_fnimplementation that assumes a valid string (e.g.strlen/fprintf("%s", line)).error.cc) trigger this today since they always set a real error code first, but it's a latent footgun for any future or embedder call path.Test plan
configure && make)