check ptr against NULL before dereferencing it

[kokke]

This is a proposed fix for #6709

There is a small issue of dereferencing a pointer before checking it against NULL.

From tests/libtest/lib1536.c : 72 - 76

72  if(memcmp(scheme, "HTTP", 5) != 0) {
              ^^^^^^ scheme is dereferenced here, but checked against NULL later
73    fprintf(stderr, "%s:%d scheme of http resource is incorrect; "
74            "expected 'HTTP' but is %s\n",
75            __FILE__, __LINE__,
76            (scheme == NULL ? "NULL" : "invalid"));
77    res = CURLE_HTTP_RETURNED_ERROR;
78    goto test_cleanup;
79  }

I propose to either:

• add a test in the if-condition, to check against NULL to avoid the potential null-dereference
• remove the check against NULL in (scheme == NULL ? "NULL" : "invalid") if scheme can never be NULL

[danielgustafsson]

Agreed, makes sense.

[kokke]

Hi @danielgustafsson

Thanks for super fast approval of both my PRs.

I agree the problems "fixed" are benign. I would personally prefer a failed test-case with an error-message instead of a segfault, which is the main effect of this.

[bagder]

instead of a segfault, which is the main effect of this.

Is it? This uses the internal printf() code, right? It doesn't segfault on a NULL for %s. It outputs (nil).

[kokke]

Hi @bagder in this case the segfault would be caused by the memcmp at line 72 (as mentioned in the comments) which, to my knowledge, dereferences its arguments.

EDIT:

72  if(memcmp(scheme, "HTTP", 5) != 0) {
              ^^^^^^ scheme is dereferenced here, but checked against NULL later

EDIT2:
Or if it is simply impossible for scheme to be NULL, the check/ternary at line 76 is superfluous.

[cvengler]

The C89 standard doesn't define anything for memcmp with a NULL pointer.
See: http://port70.net/~nsz/c/c89/c89-draft.html#4.11.4.1

[bagder]

I don't think scheme can be NULL at that point. How would that happen? And if it can, why hasn't that been detected by torture tests?

[jay]

I don't think scheme can be NULL at that point. How would that happen? And if it can, why hasn't that been detected by torture tests?

According to CURLINFO_SCHEME it can return NULL so technically he's correct however internally it may currently be an impossibility that it's NULL after the transfer.

[kokke]

A comment mostly FYI:
My tool searches for places where code is “logically inconsistent”. Here the inconcistency is that memcmp is passed a pointer (which it dereferences) that is later checked against NULL.

The dereference / memcmp-call suggests the programmer meant scheme could never be NULL at this point. So either the NULL-check happens “too late” or is superfluous.

That is my reasoning for the fix proposals

I propose to either:

• add a test in the if-condition, to check against NULL to avoid the potential null-dereference
• remove the check against NULL in (scheme == NULL ? "NULL" : "invalid") if scheme can never be NULL

[bagder]

@kokke sorry, I didn't mean to question your tool nor your fix, I was just trying to take a step back and think why the NULL check is there in the first place.

@jay: thanks for checking!

[kokke]

@bagder no offense taken at all. I understand if you guys see many questionable change proposals, so I just wanted to make my reasoning explicitly clear.

[bagder]

Thanks!

[kokke]

And thank you for kindly accepting all my small change proposals 👍 Contributing has been a very pleasant experience