Skip to content

Commit 9a357b7

Browse files
committed
Fix possible NULL pointer dereference
When a user sets up a TTY without a device, triggering the tty->notty code path, the tty->dev will be NULL and tty_parse_args() still return OK result. Found by Coverity Scan Signed-off-by: Joachim Wiberg <[email protected]>
1 parent ffd01b0 commit 9a357b7

File tree

1 file changed

+13
-10
lines changed

1 file changed

+13
-10
lines changed

src/service.c

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1675,6 +1675,7 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
16751675
if (tty_parse_args(&tty, cmd, &args))
16761676
return errno;
16771677

1678+
/* NOTE: this may result in dev == NULL! */
16781679
if (tty_isatcon(tty.dev))
16791680
dev = tty_atcon();
16801681
else
@@ -1707,17 +1708,19 @@ int service_register(int type, char *cfg, struct rlimit rlimit[], char *file)
17071708
respawn = 1;
17081709

17091710
/* Create name:id tuple for identity, e.g., tty:S0 */
1710-
ptr = strrchr(dev, '/');
1711-
if (ptr)
1712-
ptr++;
1713-
else
1714-
ptr = dev;
1715-
if (!strncmp(ptr, "tty", 3))
1716-
ptr += 3;
1711+
if (dev) {
1712+
ptr = strrchr(dev, '/');
1713+
if (ptr)
1714+
ptr++;
1715+
else
1716+
ptr = dev;
1717+
if (!strncmp(ptr, "tty", 3))
1718+
ptr += 3;
17171719

1718-
name = "tty";
1719-
if (!id || id[0] == 0)
1720-
id = ptr;
1720+
name = "tty";
1721+
if (!id || id[0] == 0)
1722+
id = ptr;
1723+
}
17211724

17221725
svc = svc_find_by_tty(dev);
17231726
} else

0 commit comments

Comments
 (0)