Fix/clean-up low impact issues in libinjector and libusermode (#1257)

* Add initialization of func_addr (CID 304049) Add initialization of the scalar field func_add, which was uninitialized, what coverity detected as CID 304049 * Remove unused value (CID 309662) Remove unused value in print_injection_info(...), which was identified as CUD 309662 by coverity * Fix error handling in injector_int3_cb (CID 307533) Fix error handling in injector_int3_cb in win_injector.c by checking the return value from vmi_read. This prevents a call to vmi_convert_str_encoding(...) passing uninitialized data. This issue was identified by coverity as CID 307533
tklengyel · Jul 11, 2021 · ad3dc49 · ad3dc49
1 parent 5100019
commit ad3dc49
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 4 deletions.
diff --git a/src/libinjector/win_injector.c b/src/libinjector/win_injector.c
@@ -1443,7 +1443,7 @@ static event_response_t injector_int3_cb(drakvuf_t drakvuf, drakvuf_trap_info_t*
             return 0;
         }
 
-        uint8_t buf[FILE_BUF_SIZE];
+        uint8_t buf[FILE_BUF_SIZE] = {0};;
         unicode_string_t in;
 
         ACCESS_CONTEXT(ctx);
@@ -1458,7 +1458,13 @@ static event_response_t injector_int3_cb(drakvuf_t drakvuf, drakvuf_trap_info_t*
         }
 
         vmi = drakvuf_lock_and_get_vmi(drakvuf);
-        vmi_read(vmi, &ctx, regs.x86.rax * 2, buf, NULL);
+        if (VMI_SUCCESS != vmi_read(vmi, &ctx, regs.x86.rax * 2, buf, NULL))
+        {
+            drakvuf_release_vmi(drakvuf);
+            PRINT_DEBUG("Failed to read buffer at %lx\n", regs.x86.rax * 2);
+            return 0;
+        }
+
         drakvuf_release_vmi(drakvuf);
         in.contents = buf;
         in.length = regs.x86.rax * 2;
@@ -1982,7 +1988,8 @@ static void print_injection_info(output_format_t format, const char* file, injec
 
     if (*split_results_iterator)
     {
-        process_name = *(split_results_iterator++);
+        // Advance iterator to step over image/process name
+        split_results_iterator++;
     }
 
     if (*split_results_iterator)

diff --git a/src/libusermode/uh-private.hpp b/src/libusermode/uh-private.hpp
@@ -157,7 +157,7 @@ struct rh_data_t
         std::string dll_name, std::string func_name, callback_t cb, void* extra):
         target_process(target_process), dll_name(dll_name), func_name(func_name), cb(cb),
         extra(extra), state(HOOK_FIRST_TRY), target_process_pid(target_process_pid),
-        target_process_dtb(), userhook_plugin(userhook_plugin) {}
+        target_process_dtb(), func_addr(), userhook_plugin(userhook_plugin) {}
 
 
     static void free_trap(drakvuf_trap_t* trap)