mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: dank@kegel.com
To: linux-kernel@vger.kernel.org
Subject: [CHECKER] Fix "null-deref" error in khttpd
Date: Tue, 13 Aug 2002 09:14:13 -0700	[thread overview]
Message-ID: <200208131614.g7DGEDH03569@kegel.com> (raw)

I have not tested this, but it's "obviously correct", and it
should fix a minor error reported by the Stanford checker in khttpd;
see http://marc.theaimsgroup.com/?l=linux-kernel&m=99601418013486

It was posted to the khttpd mailing list a week or so ago.
Comments welcome.
- Dan

--- linux-2.4.19-pre9/net/khttpd/security.c.orig	Tue Aug  6 16:13:21 2002
+++ linux/net/khttpd/security.c	Tue Aug  6 16:33:08 2002
@@ -83,22 +83,21 @@
 */
 struct file *OpenFileForSecurity(char *Filename)
 {
-	struct file *filp;
+	struct file *filp = NULL;
 	struct DynamicString *List;
 	umode_t permission;
 	
-	
-
 	EnterFunction("OpenFileForSecurity");
 	if (Filename==NULL)
-		return NULL;
+		goto out_error;
 	
-	if (strlen(Filename)>=256 ) return NULL;  /* Sanity check */
+	if (strlen(Filename)>=256 )
+		goto out_error;  /* Sanity check */
 	
 	/* Rule no. 1  -- No "?" characters */
 #ifndef BENCHMARK	
 	if (strchr(Filename,'?')!=NULL)
-		return NULL;
+		goto out_error;
 
 	/* Intermediate step: decode all %hex sequences */
 	
@@ -106,9 +105,8 @@
 
 	/* Rule no. 2  -- Must start with a "/" */
 	
-	
 	if (Filename[0]!='/')
-		return NULL;
+		goto out_error;
 		
 #endif
 	/* Rule no. 3 -- Does the file exist ? */
@@ -116,55 +114,44 @@
 	filp = filp_open(Filename, O_RDONLY, 0);
 	
 	if (IS_ERR(filp))
-		return NULL;
+		goto out_error;
 
 #ifndef BENCHMARK		
 	permission = filp->f_dentry->d_inode->i_mode;
 	
 	/* Rule no. 4 : must have enough permissions */
 	
-	
 	if ((permission & sysctl_khttpd_permreq)==0)
-	{
-		if (filp!=NULL)
-			fput(filp);
-		filp=NULL;
-		return NULL;
-	}
-		
+		goto out_error_put;	
+
 	/* Rule no. 5 : cannot have "forbidden" permission */
 	
-	
 	if ((permission & sysctl_khttpd_permforbid)!=0)
-	{
-		if (filp!=NULL)
-			fput(filp);
-		filp=NULL;
-		return NULL;
-	}
+		goto out_error_put;	
 		
 	/* Rule no. 6 : No string in DynamicList can be a
 			substring of the filename */
-			
 	
 	List = DynamicList;
-	
 	while (List!=NULL)
 	{
 		if (strstr(Filename,List->value)!=NULL)
-		{
-			if (filp!=NULL)
-				fput(filp);
-			filp=NULL;
-			return NULL;
-		}
+			goto out_error_put;	
+
 		List = List->Next;
 	}
 	
 #endif	
 	LeaveFunction("OpenFileForSecurity - success");
-
+out:
 	return filp;
+
+out_error_put:
+	fput(filp);
+out_error:
+	filp=NULL;
+	LeaveFunction("OpenFileForSecurity - fail");
+	goto out;
 }
 
 /* 

                 reply	other threads:[~2002-08-13 16:05 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200208131614.g7DGEDH03569@kegel.com \
    --to=dank@kegel.com \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®