Skip to content

Fix possibility of NULL assignment to std::string #1069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
PSUdaemon merged 1 commit into from
Oct 3, 2016
Merged

Fix possibility of NULL assignment to std::string #1069

PSUdaemon merged 1 commit into from
Oct 3, 2016

Conversation

@PSUdaemon
Copy link
Contributor

@PSUdaemon PSUdaemon commented Oct 3, 2016 •
edited
Loading

BackTrace.io Dump:

traffic_server                                          Sun Oct  2 21:18:58 2016

   Group: d6601e12129b32eb5f9a9806151b8127c4e32e94f3f785d852c67be6cac945c3
    UUID: c61795bc00604cdc89a9ba0c2402904c
    Path: /opt/trafficserver/bin/traffic_server
Priority: 5
 Quality: 66.00
Fault at: 0
    Keys:
      coresnap.object = 6cb407cb-0209-461e-84af-bad2a643090f
      application = traffic_server
      uname.sysname = Linux
      uname.release = 2.6.32-431.el6.x86_64
      uname.version = #1 SMP Fri Nov 22 03:15:09 UTC 2013
      uname.machine = x86_64
      hostname = [REDACTED]
      ptrace.version = 1.22.0
      process.age = 2091336

   State: disk
     PID: 3777
  Parent: 3669
 Threads: 348
  System: Linux [REDACTED] 2.6.32-431.el6.x86_64 #1 SMP Fri Nov 22 03:15:09 UTC 2013 x86_64

    User: ruid=176 euid=176 suid=176 fuid=176
   Group: rgid=176 egid=176 sgid=176 fgid=176

 VirtMem:
              peak: 58737028                  size: 58735864
           rssPeak: 42523064                   rss: 42521900
              swap: 0                       locked: 58735860
               pte: 84800                    stack: 112
                sh: 11044

  Memory:
             total: 198297312                 free: 59790620
           buffers: 225580                  cached: 25315912
        swapCached: 0                       active: 24780372
          inactive: 1039516              swapTotal: 4095992
          swapFree: 4095992                  dirty: 6196
         writeback: 0                         slab: 1166948
      vmallocTotal: 34359738367        vmallocUsed: 692124
      vmallocChunk: 34259100528

     CPU:
              user: 36280779                  nice: 6170
            kernel: 45970002                  idle: 6102244292
            iowait: 428138547                  irq: 20306
           softirq: 10341081                 ctxts: 135619464021
          bootTime: 1473351784             numProc: 16017922
          procsRun: 1                   procsBlock: 0
            FDSize: 65536             volCtxSwitch: 315761730
   nonVolCtxSwitch: 1042636

--------------------------------------------------------------------------------

Rlimits:                   soft-limit       hard-limit       utilization      unit
cpu time                   unlimited        unlimited        unknown          seconds
file size                  unlimited        unlimited        unknown          bytes
data size                  unlimited        unlimited        59940438016      bytes
stack size                 unlimited        unlimited        114688           bytes
core file size             unlimited        unlimited        unknown          bytes
resident set               unlimited        unlimited        43542425600      bytes
processes                  1549066          1549066          348              processes
open files                 500000           500000           65536            files
locked memory              65536            65536            60145520640      bytes
address space              unlimited        unlimited        60145524736      bytes
file locks                 unlimited        unlimited        unknown          locks
pending signals            1549066          1549066          0                signals
msgqueue size              819200           819200           unknown          bytes
nice priority              0                0                unknown          undef
realtime priority          0                0                unknown          undef
realtime timeout           unlimited        unlimited        unknown          usecs

Classifiers:
     null
     memory.read

Annotations:
      Warning: Resource 'Max allowed locked memory' is at 60145520640, exceeding the limit 65536

--------------------------------------------------------------------------------
[?] Thread 4024 (faulted)
*  [  0] libc-2.12.so              __strlen_sse42
        => pcmpeqb (%rdi), %xmm1
   |  1| header_rewrite.so         length (/usr/include/c++/4.4.7/bits/char_traits.h:263)
    (__s) = 0
   |  2| header_rewrite.so         assign (basic_string.h:975)
    (__s) = 0
    (this) = 0x2b1932a27ee0
      *0x2b1932a27ee0 =
         npos = 10781304
         _M_dataplus =
            _M_p = 0xa48278
               *0xa48278 = string(0xa48278, [(null)])
   |  3| header_rewrite.so         operator= (basic_string.h:519)
    (__s) = 0
    (this) = 0x2b1932a27ee0
      *0x2b1932a27ee0 =
         npos = 10781304
         _M_dataplus =
            _M_p = 0xa48278
               *0xa48278 = string(0xa48278, [(null)])
   [  4] header_rewrite.so         VariableExpander::expand(Resources const&) (expander.cc:68)
    (this) = -- [no location entry found: 0]
    (res) = 0x2b1932a27ff0
      *0x2b1932a27ff0 =
         txnp = 0x2b1d6ff71890
            *0x2b1d6ff71890 = void
         contp = 0
         bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         client_bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         client_hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         resp_status = 0 (TS_HTTP_STATUS_NONE)
         _rri = 0x2b1932a280a0
            *0x2b1932a280a0 =
               mapFromUrl = 0x2b1a1f9f6888
                  *0x2b1a1f9f6888 = void
               mapToUrl = 0x2b1cdfe25088
                  *0x2b1cdfe25088 = void
               requestUrl = 0x2b1a96c3db08
                  *0x2b1a96c3db08 = void
               requestBufp = 0x2b1d6ff71fb0
                  *0x2b1d6ff71fb0 = void
               requestHdrp = 0x2b1a96c3d888
                  *0x2b1a96c3d888 = void
               redirect = 0
         changed_url = 0
         _ready = 1
    result =
      npos = 47407247634536
      _M_dataplus =
         _M_p = 0x2b1ddc27b068
            *0x2b1ddc27b068 = string(0x2b1ddc27b068, [for=1.2.3.4;proto=%<proto>;host=foo.example.com])
    start = 0
    end = 7
    first_part =
      npos = 47407245941784
      _M_dataplus =
         _M_p = 0x2b1ddc0ddc18
            *0x2b1ddc0ddc18 = string(0x2b1ddc0ddc18, [for=1.2.3.4;proto=])
    last_part =
      npos = 47407246397240
      _M_dataplus =
         _M_p = 0x2b1ddc14cf38
            *0x2b1ddc14cf38 = string(0x2b1ddc14cf38, [;host=foo.example.com])
    variable =
      npos = 47407246024472
      _M_dataplus =
         _M_p = 0x2b1ddc0f1f18
            *0x2b1ddc0f1f18 = string(0x2b1ddc0f1f18, [%<proto>])
    resolved_variable =
      npos = 10781304
      _M_dataplus =
         _M_p = 0xa48278
            *0xa48278 = string(0xa48278, [(null)])
    bufp = 0x2b1d6ff71fb0
      *0x2b1d6ff71fb0 = void
    hdr_loc = 0xa48260
      *0xa48260 = void
    url_loc = 0x2b1a96c3db78
      *0x2b1a96c3db78 = void
    len = 0
   [  5] header_rewrite.so         OperatorAddHeader::exec(Resources const&) const (operators.cc:455)
    (this) = 0x2b1d68152560
      *0x2b1d68152560 =
         _value =
            _need_expander = 1
            _value =
               npos = 47405300260840
               _M_dataplus =
                  _M_p = 0x2b1d68151fe8
            _int_value = 0
            _float_value = 0.000000
            _cond_val = 0
    (res) = 0x2b1932a27ff0
      *0x2b1932a27ff0 =
         txnp = 0x2b1d6ff71890
            *0x2b1d6ff71890 = void
         contp = 0
         bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         client_bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         client_hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         resp_status = 0 (TS_HTTP_STATUS_NONE)
         _rri = 0x2b1932a280a0
            *0x2b1932a280a0 =
               mapFromUrl = 0x2b1a1f9f6888
                  *0x2b1a1f9f6888 = void
               mapToUrl = 0x2b1cdfe25088
                  *0x2b1cdfe25088 = void
               requestUrl = 0x2b1a96c3db08
                  *0x2b1a96c3db08 = void
               requestBufp = 0x2b1d6ff71fb0
                  *0x2b1d6ff71fb0 = void
               requestHdrp = 0x2b1a96c3d888
                  *0x2b1a96c3d888 = void
               redirect = 0
         changed_url = 0
         _ready = 1
    value =
      npos = 47407247907880
      _M_dataplus =
         _M_p = 0x2b1ddc2bdc28
            *0x2b1ddc2bdc28 = string(0x2b1ddc2bdc28, [for=%<chi>;proto=%<proto>;host=foo.example.com])
    ve =
      _source =
         npos = 47407247907880
         _M_dataplus =
            _M_p = 0x2b1ddc2bdc28
               *0x2b1ddc2bdc28 = string(0x2b1ddc2bdc28, [for=%<chi>;proto=%<proto>;host=foo.example.com])
   |  6| header_rewrite.so         do_exec (operator.h:54)
    (res) = 0x2b1932a27ff0
      *0x2b1932a27ff0 =
         txnp = 0x2b1d6ff71890
            *0x2b1d6ff71890 = void
         contp = 0
         bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         client_bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         client_hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         resp_status = 0 (TS_HTTP_STATUS_NONE)
         _rri = 0x2b1932a280a0
            *0x2b1932a280a0 =
               mapFromUrl = 0x2b1a1f9f6888
                  *0x2b1a1f9f6888 = void
               mapToUrl = 0x2b1cdfe25088
                  *0x2b1cdfe25088 = void
               requestUrl = 0x2b1a96c3db08
                  *0x2b1a96c3db08 = void
               requestBufp = 0x2b1d6ff71fb0
                  *0x2b1d6ff71fb0 = void
               requestHdrp = 0x2b1a96c3d888
                  *0x2b1a96c3d888 = void
               redirect = 0
         changed_url = 0
         _ready = 1
    (this) = -- [no location associated with variable: 0]
   |  7| header_rewrite.so         exec (ruleset.h:97)
    (res) = 0x2b1932a27ff0
      *0x2b1932a27ff0 =
         txnp = 0x2b1d6ff71890
            *0x2b1d6ff71890 = void
         contp = 0
         bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         client_bufp = 0x2b1d6ff71fb0
            *0x2b1d6ff71fb0 = void
         client_hdr_loc = 0x2b1a96c3d888
            *0x2b1a96c3d888 = void
         resp_status = 0 (TS_HTTP_STATUS_NONE)
         _rri = 0x2b1932a280a0
            *0x2b1932a280a0 =
               mapFromUrl = 0x2b1a1f9f6888
                  *0x2b1a1f9f6888 = void
               mapToUrl = 0x2b1cdfe25088
                  *0x2b1cdfe25088 = void
               requestUrl = 0x2b1a96c3db08
                  *0x2b1a96c3db08 = void
               requestBufp = 0x2b1d6ff71fb0
                  *0x2b1d6ff71fb0 = void
               requestHdrp = 0x2b1a96c3d888
                  *0x2b1a96c3d888 = void
               redirect = 0
         changed_url = 0
         _ready = 1
    (this) = 0x2b1d68151ed0
      *0x2b1d68151ed0 =
         next = 0
         _cond = 0
         _oper = 0x2b1d68152300
            *0x2b1d68152300 = void
         _hook = 19 (TS_HTTP_LAST_HOOK)
         _ids = 15 (!)
         _opermods = 1 (OPER_LAST)
         _last = 0
   [  8] header_rewrite.so         TSRemapDoRemap (header_rewrite.cc:501)
    (ih) = -- [no location entry found: 0]
    (rh) = -- [no location entry found: 0]
    (rri) = -- [no location entry found: 0]
    rval = -- [no location entry found: 0]
    config_holder = -- [no location entry found: 0]
    conf = -- [no location entry found: 0]
    rule = 0x2b1d68151ed0
      *0x2b1d68151ed0 =
         next = 0
         _cond = 0
         _oper = 0x2b1d68152300
            *0x2b1d68152300 = void
         _hook = 19 (TS_HTTP_LAST_HOOK)
         _ids = 15 (!)
         _opermods = 1 (OPER_LAST)
         _last = 0
    res =
      txnp = 0x2b1d6ff71890
         *0x2b1d6ff71890 = void
      contp = 0
      bufp = 0x2b1d6ff71fb0
         *0x2b1d6ff71fb0 = void
      hdr_loc = 0x2b1a96c3d888
         *0x2b1a96c3d888 = void
      client_bufp = 0x2b1d6ff71fb0
         *0x2b1d6ff71fb0 = void
      client_hdr_loc = 0x2b1a96c3d888
         *0x2b1a96c3d888 = void
      resp_status = 0 (TS_HTTP_STATUS_NONE)
      _rri = 0x2b1932a280a0
         *0x2b1932a280a0 =
            mapFromUrl = 0x2b1a1f9f6888
               *0x2b1a1f9f6888 = void
            mapToUrl = 0x2b1cdfe25088
               *0x2b1cdfe25088 = void
            requestUrl = 0x2b1a96c3db08
               *0x2b1a96c3db08 = void
            requestBufp = 0x2b1d6ff71fb0
               *0x2b1d6ff71fb0 = void
            requestHdrp = 0x2b1a96c3d888
               *0x2b1a96c3d888 = void
            redirect = 0
      changed_url = 0
      _ready = 1
    rt = -- [no location entry found: 0]

@PSUdaemon PSUdaemon added this to the 7.1.0 milestone Oct 3, 2016
@bryancall
Copy link
Contributor

bryancall commented Oct 3, 2016

👍 - Looks good

@atsci
Copy link

atsci commented Oct 3, 2016

FreeBSD build successful! See https://ci.trafficserver.apache.org/job/Github-FreeBSD/913/ for details.

@atsci
Copy link

atsci commented Oct 3, 2016

Linux build successful! See https://ci.trafficserver.apache.org/job/Github-Linux/808/ for details.

@PSUdaemon PSUdaemon merged commit 91bfe21 into apache:master Oct 3, 2016
bneradt pushed a commit to bneradt/trafficserver that referenced this pull request Jan 23, 2026
CVE-2025-31698: Pull in master updates (apache#1069)
25e06da 
This should fix build warnings.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@bryancall bryancall

Labels

Plugins

Projects

None yet

Milestone

7.1.0

Development

Successfully merging this pull request may close these issues.

3 participants

@PSUdaemon @bryancall @atsci