[rtems commit] jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()

[Sebastian Huber]

Module:    rtems
Branch:    master
Commit:    9d9bfe594814dbd5ff133779d3cf8dcb1c237186
Changeset: http://git.rtems.org/rtems/commit/?id=9d9bfe594814dbd5ff133779d3cf8dcb1c237186

Author:    Jia-Ju Bai <baijiaju1990 at gmail.com>
Date:      Wed Jul 24 10:46:58 2019 +0800

jffs2: Fix possible null-pointer dereferences in jffs2_add_frag_to_fragtree()

In jffs2_add_frag_to_fragtree(), there is an if statement on line 223 to
check whether "this" is NULL:
    if (this)

When "this" is NULL, it is used at several places, such as on line 249:
    if (this->node)
and on line 260:
    if (newfrag->ofs > this->ofs)

Thus possible null-pointer dereferences may occur.

To fix these bugs, -EINVAL is returned when "this" is NULL.

These bugs are found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990 at gmail.com>
Signed-off-by: Richard Weinberger <richard at nod.at>

---

 cpukit/libfs/src/jffs2/src/nodelist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cpukit/libfs/src/jffs2/src/nodelist.c b/cpukit/libfs/src/jffs2/src/nodelist.c
index ee44024c92..86dd8e60d1 100644
--- a/cpukit/libfs/src/jffs2/src/nodelist.c
+++ b/cpukit/libfs/src/jffs2/src/nodelist.c
@@ -228,7 +228,7 @@ static int jffs2_add_frag_to_fragtree(struct jffs2_sb_info *c, struct rb_root *r
 		lastend = this->ofs + this->size;
 	} else {
 		dbg_fragtree2("lookup gave no frag\n");
-		lastend = 0;
+		return -EINVAL;
 	}
 
 	/* See if we ran off the end of the fragtree */