]> git.proxmox.com Git - mirror_qemu.git/commitdiff
util/uri: URI member path can be null, compare more carfully
authorMarkus Armbruster <armbru@redhat.com>
Tue, 27 Jan 2015 16:13:52 +0000 (17:13 +0100)
committerMichael Tokarev <mjt@tls.msk.ru>
Tue, 10 Feb 2015 06:27:20 +0000 (09:27 +0300)
uri_resolve_relative() calls strcmp(bas->path, ref->path).  However,
either argument could be null!  Evidence: the code checks for null
after the comparison.  Spotted by Coverity.

I suspect this was screwed up when we stole the code from libxml2.
There the conditional reads

    xmlStrEqual((xmlChar *)bas->path, (xmlChar *)ref->path)

with

    int
    xmlStrEqual(const xmlChar *str1, const xmlChar *str2) {
if (str1 == str2) return(1);
if (str1 == NULL) return(0);
if (str2 == NULL) return(0);
do {
    if (*str1++ != *str2) return(0);
} while (*str2++);
return(1);
    }

Fix by replicating libxml2's logic faithfully.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
util/uri.c

index b9a7b546bf9f110868b386d2b7ed6f0b79f0695c..1cfd78bdb53ac0217482e05308fccbfe72b900a0 100644 (file)
@@ -1935,7 +1935,8 @@ uri_resolve_relative (const char *uri, const char * base)
        val = g_strdup (uri);
        goto done;
     }
-    if (!strcmp(bas->path, ref->path)) {
+    if (bas->path == ref->path ||
+        (bas->path && ref->path && !strcmp(bas->path, ref->path))) {
        val = g_strdup("");
        goto done;
     }