Skip to content

fix null pointer dereferences found by malloc-error-check cocci #15552

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kenifor wants to merge 8 commits into from
Closed

fix null pointer dereferences found by malloc-error-check cocci #15552

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
adeae9e
qa/cocci: fix broken regex alternation in malloc-error-check
Jun 4, 2026
cb5f97a
util/log-redis: guard SCCalloc result for redis stream format
Jun 4, 2026
028302f
detect/alert: guard SCStrdup result before use
Jun 4, 2026
501214a
detect/flowbits: check SCRealloc result before overwriting pointer
Jun 4, 2026
b36bacc
detect/reference: guard SCStrdup calls in DetectReferenceParse
Jun 4, 2026
96560ce
util/mpm-hs: fix null check and guard SCCalloc in SCHSConfigInit
Jun 4, 2026
1deb157
decode: propagate PacketAlertCreate failure instead of FatalError
Jun 4, 2026
23bd1df
tests/fuzz: guard SCCalloc result in fuzz_decodebase64
Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions qa/coccinelle/malloc-error-check.cocci
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
@malloced@
expression x;
position p1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)";
identifier func =~ "SCMalloc\|SCStrdup\|SCCalloc\|SCMallocAligned\|SCRealloc";
@@

x@p1 = func(...)
Expand All @@ -10,7 +10,7 @@ x@p1 = func(...)
expression x, E;
statement S;
position malloced.p1;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)";
identifier func =~ "SCMalloc\|SCStrdup\|SCCalloc\|SCMallocAligned\|SCRealloc";
@@

(
Expand All @@ -22,7 +22,7 @@ if (E && (x@p1 = func(...)) == NULL) S
@realloc exists@
position malloced.p1;
expression x, E1;
identifier func =~ "(SCMalloc|SCCalloc|SCMallocAligned)";
identifier func =~ "SCMalloc\|SCCalloc\|SCMallocAligned";
@@

x@p1 = func(...)
Expand All @@ -33,7 +33,7 @@ x = SCRealloc(x, E1)
expression x, E1;
position malloced.p1;
statement S1, S2;
identifier func =~ "(SCMalloc|SCStrdup|SCCalloc|SCMallocAligned|SCRealloc)";
identifier func =~ "SCMalloc\|SCStrdup\|SCCalloc\|SCMallocAligned\|SCRealloc";
@@

x@p1 = func(...)
Expand Down
3 changes: 3 additions & 0 deletions src/detect-engine-alert.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -360,6 +360,9 @@ static inline int PacketAlertSetContext(
}
}
current_json->json_string = SCStrdup(det_ctx->json_content[i].json_content);
if (current_json->json_string == NULL) {
return -1;
}
SCLogDebug("json content %u, value '%s' (%p)", (unsigned int)i,
current_json->json_string, s);
}
Expand Down
4 changes: 2 additions & 2 deletions src/detect-flowbits.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -793,11 +793,11 @@ int DetectFlowbitsAnalyze(DetectEngineCtx *de_ctx)
uint32_t new_fb_array_size = s->init_data->rule_state_flowbits_ids_size + 1;
void *tmp_fb_ptr = SCRealloc(s->init_data->rule_state_flowbits_ids_array,
new_fb_array_size * sizeof(uint32_t));
s->init_data->rule_state_flowbits_ids_array = tmp_fb_ptr;
if (s->init_data->rule_state_flowbits_ids_array == NULL) {
if (tmp_fb_ptr == NULL) {
SCLogError("Failed to reallocate memory for rule_state_variable_idx");
goto error;
}
s->init_data->rule_state_flowbits_ids_array = tmp_fb_ptr;
SCLogDebug(
"realloc'ed array for flowbits ids, new size is %u", new_fb_array_size);
s->init_data->rule_state_dependant_sids_size = new_array_size;
Expand Down
6 changes: 6 additions & 0 deletions src/detect-reference.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,13 +153,19 @@ static DetectReference *DetectReferenceParse(const char *rawstr, DetectEngineCtx
if (strlen(scheme)) {
SCLogConfig("scheme value %s overrides key %s", scheme, key);
ref->key = SCStrdup(scheme);
if (ref->key == NULL) {
goto error;
}
/* already bound checked to be REFERENCE_SYSTEM_NAME_MAX or less */
ref->key_len = (uint16_t)strlen(scheme);
} else {

SCRConfReference *lookup_ref_conf = SCRConfGetReference(key, de_ctx);
if (lookup_ref_conf != NULL) {
ref->key = SCStrdup(lookup_ref_conf->url);
if (ref->key == NULL) {
goto error;
}
/* already bound checked to be REFERENCE_SYSTEM_NAME_MAX or less */
ref->key_len = (uint16_t)strlen(ref->key);
} else {
Expand Down
3 changes: 3 additions & 0 deletions src/util-log-redis.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -673,6 +673,9 @@ int SCConfLogOpenRedis(SCConfNode *redis_node, void *lf_ctx)
format string, whose length is limited by the length of the
maxlen integer formatted as a string */
log_ctx->redis_setup.stream_format = SCCalloc(100, sizeof(char));
if (unlikely(log_ctx->redis_setup.stream_format == NULL)) {
FatalError("Unable to allocate redis stream format");
}
snprintf(log_ctx->redis_setup.stream_format, 100, redis_stream_format_maxlen_tmpl, "%s",
"%s", exact ? '=' : '~', maxlen, "%s");
log_ctx->redis_setup.format = log_ctx->redis_setup.stream_format;
Expand Down
5 changes: 4 additions & 1 deletion src/util-mpm-hs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -641,7 +641,7 @@ static int CompileDataExtensionsInit(hs_expr_ext_t **ext, const SCHSPattern *p)
{
if (p->flags & (MPM_PATTERN_FLAG_OFFSET | MPM_PATTERN_FLAG_DEPTH)) {
*ext = SCCalloc(1, sizeof(hs_expr_ext_t));
if ((*ext) == NULL) {
if (*ext == NULL) {
return -1;
}
if (p->flags & MPM_PATTERN_FLAG_OFFSET) {
Expand Down Expand Up @@ -1179,6 +1179,9 @@ void SCHSPrintInfo(MpmCtx *mpm_ctx)
static MpmConfig *SCHSConfigInit(void)
{
MpmConfig *c = SCCalloc(1, sizeof(MpmConfig));
if (unlikely(c == NULL)) {
FatalError("Failed to allocate MpmConfig");

@catenacyber catenacyber Jun 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can return c, or return NULL, and caller handles it already

@kenifor kenifor Jun 4, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can return c, or return NULL, and caller handles it already

Addressed in #15560: SCHSConfigInit now returns SCCalloc() directly without an intermediate variable, so the caller in detect-engine.c handles the NULL check as it already did.

}
return c;
}

Expand Down