Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dereference of null in alloc_query_params #580

Closed
sminux opened this issue Aug 10, 2024 · 1 comment
Closed

Dereference of null in alloc_query_params #580

sminux opened this issue Aug 10, 2024 · 1 comment

Comments

@sminux
Copy link

sminux commented Aug 10, 2024

Hi there!
Static analyzer shows this warning:
After having been compared to a NULL value at

if( conv ){

pointer 'conv' is dereferenced at
t_pg_coder_enc_func enc_func = pg_coder_enc_func( conv );

I can see the check of param_value before: if( NIL_P(param_value) ). It's somehow connected with 'conv'.
But It seems to be true positive. Should we check the 'conv' for null one more time?

@larskanis
Copy link
Collaborator

The memory management in alloc_query_params() is a bit complicated. I wrote it 10 years ago and since then there was no single change in this function.

The validity of conv is obviously too complicated for a static analyzer. It works like so:
If conv is NULL, then pg_coder_enc_func() assigns pg_coder_enc_to_s() to enc_func:

ruby-pg/ext/pg_coder.c

Lines 504 to 514 in 64fe4c1

pg_coder_enc_func(t_pg_coder *this)
{
if( this ){
if( this->enc_func ){
return this->enc_func;
}else{
return pg_text_enc_in_ruby;
}
}else{
/* no element encoder defined -> use std to_str conversion */
return pg_coder_enc_to_s;

Then the function pointer enc_func is called with a NULL pointer as this (and that's probably what the static analyzer is complaining about):

ruby-pg/ext/pg_connection.c

Lines 1301 to 1305 in 64fe4c1

t_pg_coder_enc_func enc_func = pg_coder_enc_func( conv );
VALUE intermediate;
/* 1st pass for retiving the required memory space */
int len = enc_func(conv, param_value, NULL, &intermediate, paramsData->enc_idx);

So, if conv is NULL it is always the function pg_coder_enc_to_s() that is called; never any other encoder. I added a comment in 64fe4c1 to warn about this exception in pg_coder_enc_to_s(). All other encoders can dereference the this pointer without NULL verification.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants