From: Eugene Syromiatnikov <esyr@redhat.com>
Date: Tue, 13 Aug 2024 14:17:27 +0000 (+0200)
Subject: libkmod: avoid undefined behaviour in libkmod-builtin.c:get_string
X-Git-Tag: v33~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5c22362b6b97af9c6b7587f0c3450001e9893115;p=thirdparty%2Fkmod.git

libkmod: avoid undefined behaviour in libkmod-builtin.c:get_string

Static analysis has reported a potential UB:

    kmod-31/libkmod/libkmod-builtin.c:125: use_invalid: Using "nullp", which points to an out-of-scope variable "buf".
    #  123|   	size_t linesz = 0;
    #  124|
    #  125|-> 	while (!nullp) {
    #  126|   		char buf[BUFSIZ];
    #  127|   		ssize_t sz;

It seems to be indeed an UB, as nullp is getting assined an address
inside object buf, which has a lifetime of the while loop body,
and is not available outside of it (specifically, in the while
condition, where nullp is checked for NULL).  Fix it by putting
buf definition in the outer block.
---

diff --git a/libkmod/libkmod-builtin.c b/libkmod/libkmod-builtin.c
index fd0f5492..40a7d614 100644
--- a/libkmod/libkmod-builtin.c
+++ b/libkmod/libkmod-builtin.c
@@ -105,11 +105,11 @@ static off_t get_string(struct kmod_builtin_iter *iter, off_t offset,
 			char **line, size_t *size)
 {
 	int sv_errno;
+	char buf[BUFSIZ];
 	char *nullp = NULL;
 	size_t linesz = 0;
 
 	while (!nullp) {
-		char buf[BUFSIZ];
 		ssize_t sz;
 		size_t partsz;