[PATCH v2] kernel-device: expect non-NULL 'vendor' and 'product' argument in get_device_ids()

[Ben Chan]

Sorry, sent the old patch instead. Will upload a new one.

On Tue, Aug 15, 2017 at 9:09 AM, Ben Chan <benchan at chromium.org> wrote:

> get_device_ids() in mm-kernel-device-udev.c accepts a NULL 'vendor' or
> 'product' argument, but the current implementation could result in a
> potential NULL dereferences of the 'vendor' argument. Given that
> get_device_ids() is a local helper and its only caller provides a
> non-NULL 'vendor' and 'product' argument, this patch removes the NULL
> checks (i.e. get_device_ids() expects non-NULL 'vendor' and 'product').
>
> This patch also rearranges the code such that the 'vendor' argument is
> updated only when the function returns TRUE, just like how the 'product'
> argument is handled.
> ---
>  src/kerneldevice/mm-kernel-device-udev.c | 16 ++++++----------
>  1 file changed, 6 insertions(+), 10 deletions(-)
>
> diff --git a/src/kerneldevice/mm-kernel-device-udev.c
> b/src/kerneldevice/mm-kernel-device-udev.c
> index e8763f7e..e2c2bf34 100644
> --- a/src/kerneldevice/mm-kernel-device-udev.c
> +++ b/src/kerneldevice/mm-kernel-device-udev.c
> @@ -119,23 +119,19 @@ get_device_ids (GUdevDevice *device,
>      if (strlen (vid) != 4)
>          goto out;
>
> -    if (vendor) {
> -        *vendor = (guint16) (mm_utils_hex2byte (vid + 2) & 0xFF);
> -        *vendor |= (guint16) ((mm_utils_hex2byte (vid) & 0xFF) << 8);
> -    }
> -
>      if (!pid)
>          pid = g_udev_device_get_property (device, "ID_MODEL_ID");
> -    if (!pid) {
> -        *vendor = 0;
> +    if (!pid)
>          goto out;
> -    }
>
>      if (strncmp (pid, "0x", 2) == 0)
>          pid += 2;
> -    if (strlen (pid) != 4) {
> -        *vendor = 0;
> +    if (strlen (pid) != 4)
>          goto out;
> +
> +    if (vendor) {
> +        *vendor = (guint16) (mm_utils_hex2byte (vid + 2) & 0xFF);
> +        *vendor |= (guint16) ((mm_utils_hex2byte (vid) & 0xFF) << 8);
>      }
>
>      if (product) {
> --
> 2.14.0.434.g98096fd7a8-goog
>
> _______________________________________________
> ModemManager-devel mailing list
> ModemManager-devel at lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/modemmanager-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20170815/0e2e84c6/attachment.html>