From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=192.55.52.115; helo=mga14.intel.com; envelope-from=liming.gao@intel.com; receiver=edk2-devel@lists.01.org Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 4209321165273 for ; Wed, 10 Oct 2018 23:57:36 -0700 (PDT) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 10 Oct 2018 23:57:36 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.54,367,1534834800"; d="scan'208";a="240389606" Received: from shwde7172.ccr.corp.intel.com ([10.239.158.23]) by orsmga004.jf.intel.com with ESMTP; 10 Oct 2018 23:57:35 -0700 From: Liming Gao To: edk2-devel@lists.01.org Cc: Dongao Guo Date: Thu, 11 Oct 2018 14:57:03 +0800 Message-Id: <1539241023-2864-5-git-send-email-liming.gao@intel.com> X-Mailer: git-send-email 2.8.0.windows.1 In-Reply-To: <1539241023-2864-1-git-send-email-liming.gao@intel.com> References: <1539241023-2864-1-git-send-email-liming.gao@intel.com> Subject: [Patch 4/4] MdeModulePkg/RegularExpressionDxe: Add null pointer check X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 11 Oct 2018 06:57:36 -0000 From: Dongao Guo There are five check not necessary in logic ,just for pass static analysis. More detail please refer to comment in code. And the rest changes are all accepted by owner, they are reasonable. Cc: Liming Gao Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Dongao Guo Reviewed-by: Liming Gao --- .../RegularExpressionDxe/Oniguruma/regcomp.c | 8 ++++-- .../RegularExpressionDxe/Oniguruma/regexec.c | 31 +++++++++++++++++++--- .../RegularExpressionDxe/Oniguruma/regparse.c | 1 + 3 files changed, 35 insertions(+), 5 deletions(-) diff --git a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regcomp.c b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regcomp.c index cc06178..5cefafc 100644 --- a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regcomp.c +++ b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regcomp.c @@ -3546,8 +3546,12 @@ expand_case_fold_string_alt(int item_num, OnigCaseFoldCodeItem items[], UChar *p if (IS_NULL(an)) { goto mem_err2; } - - if (items[i].byte_len != slen) { + //The NULL pointer check is not necessary. It is added just for pass static + //analysis. When condition "items[i].byte_len != slen" is true, "varlen = 1" + //in line 3503 will be reached ,so that "if (IS_NULL(var_anode)) return ONIGERR_MEMORY" + //in line 3510 will be executed, so the null pointer has been checked before + //deferenced in line 3584. + if (items[i].byte_len != slen && IS_NOT_NULL(var_anode)) { Node *rem; UChar *q = p + items[i].byte_len; diff --git a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regexec.c b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regexec.c index 26e7a31..7f5bb8b 100644 --- a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regexec.c +++ b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regexec.c @@ -4088,6 +4088,11 @@ slow_search_backward(OnigEncoding enc, UChar* target, UChar* target_end, s = ONIGENC_LEFT_ADJUST_CHAR_HEAD(enc, adjust_text, s); while (s >= text) { + //if text is not null,the logic is correct. + //this function is only invoked by backward_search_range,parameter text come + //from range, which is checked by "if (range == 0) goto fail" in line 4512 + //so the check is just for passing static analysis. + if(IS_NULL(s))break; if (*s == *target) { p = s + 1; t = target + 1; @@ -4298,6 +4303,11 @@ map_search_backward(OnigEncoding enc, UChar map[], const UChar *s = text_start; while (s >= text) { + //if text is not null,the logic is correct. + //this function is only invoked by backward_search_range,parameter text come + //from range, which is checked by "if (range == 0) goto fail" in line 4512 + //so the check is just for passing static analysis. + if(IS_NULL(s))break; if (map[*s]) return (UChar* )s; s = onigenc_get_prev_char_head(enc, adjust_text, s); @@ -4499,7 +4509,7 @@ backward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar** low, UChar** high) { UChar *p; - + if (range == 0) goto fail; range += reg->dmin; p = s; @@ -4550,7 +4560,7 @@ backward_search_range(regex_t* reg, const UChar* str, const UChar* end, case ANCHOR_BEGIN_LINE: if (!ON_STR_BEGIN(p)) { prev = onigenc_get_prev_char_head(reg->enc, str, p); - if (!ONIGENC_IS_MBC_NEWLINE(reg->enc, prev, end)) { + if (IS_NOT_NULL(prev) && !ONIGENC_IS_MBC_NEWLINE(reg->enc, prev, end)) { p = prev; goto retry; } @@ -4739,10 +4749,15 @@ onig_search_with_param(regex_t* reg, const UChar* str, const UChar* end, } } else if (reg->anchor & ANCHOR_SEMI_END_BUF) { + UChar* pre_end = ONIGENC_STEP_BACK(reg->enc, str, end, 1); max_semi_end = (UChar* )end; - if (ONIGENC_IS_MBC_NEWLINE(reg->enc, pre_end, end)) { + // only when str > end, pre_end will be null + // line 4659 "if (start > end || start < str) goto mismatch_no_msa" + // will guarantee str alwayls less than end + // so pre_end won't be null,this check is just for passing staic analysis + if (IS_NOT_NULL(pre_end) && ONIGENC_IS_MBC_NEWLINE(reg->enc, pre_end, end)) { min_semi_end = pre_end; #ifdef USE_CRNL_AS_LINE_TERMINATOR @@ -4891,6 +4906,16 @@ onig_search_with_param(regex_t* reg, const UChar* str, const UChar* end, MATCH_AND_RETURN_CHECK(orig_start); s = prev; } + // if range is not null,the check is not necessary. + // the range is actually the pointer of the end of the matched string + // or assigned by "range = str" in line 4708. In RegularExpressionMatch + // protocol, the matched string is the parameter String. And str in + // line 4708 is the String,too. and the range is calculated from + // "Start + onigenc_str_bytelen_null (CHAR16_ENCODING, Start)" in + // line 146 in RegularExpressionDxe.c. RegularExpressionMatch ensure + // the String is not null,So in both situation, the range can not be NULL. + // This check is just for passing static analysis. + if(IS_NULL(s))break; } while (s >= range); goto mismatch; } diff --git a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c index c71ae5f..0a2d6f8 100644 --- a/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c +++ b/MdeModulePkg/Universal/RegularExpressionDxe/Oniguruma/regparse.c @@ -1572,6 +1572,7 @@ onig_set_callout_of_name(OnigEncoding enc, OnigCalloutType callout_type, fe->arg_types[i] = arg_types[i]; } for (i = arg_num - opt_arg_num, j = 0; i < arg_num; i++, j++) { + if(IS_NULL(opt_defaults))return ONIGERR_INVALID_ARGUMENT; if (fe->arg_types[i] == ONIG_TYPE_STRING) { OnigValue* val = opt_defaults + j; UChar* ds = onigenc_strdup(enc, val->s.start, val->s.end); -- 2.10.0.windows.1