r15260: Don't dereference NULL pointers to obtain array lengths - found by
authorJelmer Vernooij <jelmer@samba.org>
Wed, 26 Apr 2006 00:08:39 +0000 (00:08 +0000)
committerGerald (Jerry) Carter <jerry@samba.org>
Wed, 10 Oct 2007 19:04:27 +0000 (14:04 -0500)
the IBM checker

source/pidl/lib/Parse/Pidl/Samba4/EJS.pm

index 550499a5f30c4e88d3a87c45a17615fdf36b9dfd..b9d8a1251c000a9e1746de62bf81bf66eaa28293 100644 (file)
@@ -116,6 +116,18 @@ sub get_value_of($)
        }
 }
 
+#####################################################################
+# check that a variable we get from ParseExpr isn't a null pointer
+sub check_null_pointer($)
+{
+       my $size = shift;
+       if ($size =~ /^\*/) {
+               my $size2 = substr($size, 1);
+               pidl "if ($size2 == NULL) return NT_STATUS_INVALID_PARAMETER_MIX;";
+       }
+}
+
+
 #####################################################################
 # work out is a parse function should be declared static or not
 sub fn_declare($$)
@@ -196,6 +208,7 @@ sub EjsPullArray($$$$$)
                if (!$l->{IS_FIXED}) {
                        pidl "EJS_ALLOC_N(ejs, $var, $size);";
                }
+               check_null_pointer($length);
                pidl "ejs_pull_array_uint8(ejs, v, $name, $var, $length);";
                return;
        }
@@ -492,6 +505,7 @@ sub EjsPushArray($$$$$)
        }
        # uint8 arrays are treated as data blobs
        if ($nl->{TYPE} eq 'DATA' && $e->{TYPE} eq 'uint8') {
+               check_null_pointer($length);
                pidl "ejs_push_array_uint8(ejs, v, $name, $var, $length);";
                return;
        }