decode: fix possible NULL dereference #189
Conversation
Found by a recently added fuzzer. Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61743 Signed-off-by: David Korczynski <[email protected]>
There was a problem hiding this comment.
It seems that this is caused by unpack_meta_type not being called (ie. the msgpack buffer not having a type map key) so instead of handling each case on their own (1009, 999, 983 and other types that don't go through that conditional but need the actual metric to be created) we might want to ensure that decode_context->map and decode_context->map->parent are not NULL in line 980 as a pre-requisite for the remainder of the function.
Could you please do that?
yep |
Signed-off-by: David Korczynski <[email protected]>
|
Adjusted the fix @leonardo-albertovich |
|
@edsiper could you please take a look? |
| @@ -978,6 +978,9 @@ static int unpack_basic_type_meta(mpack_reader_t *reader, size_t index, void *co | |||
|
|
|||
| if (CMT_DECODE_MSGPACK_SUCCESS == result) { | |||
| decode_context->map->label_count = cfl_list_size(&decode_context->map->label_keys); | |||
| if (decode_context->map == NULL || decode_context->map->parent == NULL) { | |||
There was a problem hiding this comment.
if there is a chance that decode_context->map is NULL ideally we want do it before the previous line otherwise it leads to a corruption decode_context->map->...
Signed-off-by: David Korczynski <[email protected]>
Found by a recently added fuzzer.
Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=61743