Re: Potential segfault introduced in cache_cf.cc

On 09/24/2010 05:24 AM, Michael Mueller wrote:
> Hi all,
>
> I'm working on a C++ static analyzer (Vigilant Sentry), and squid
> is one of my test subjects. I've been analyzing squid nightly, and
> last night a new defect was reported in trunk, src/config_cf.cc:
>
> static bool
> parseNamedIntList(const char *data, const String&name, Vector<int> &list)
> {
> if (data&& (strncmp(data, name.rawBuf(), name.size()) == 0)) {
> /* Edited for brevity */
> }
> return *data == '\0';
> }
>
> This function (added yesterday) tests 'data' for NULL, but dereferences
> it without a test for NULL later. If 'data' really can be NULL, this
> will cause a crash. Figured someone might want to take a look.

Fixed in r10895.

Do you want your email and/or name to be added to the Squid CONTRIBUTORS
file?

Thanks a lot,

Alex.
Received on Mon Sep 27 2010 - 18:30:45 MDT