Subject: bug#79336: closed (Re: bug#79336: [PATCH] df: fix potential null pointer dereference)

From: [email-masked] (GNU bug Tracking System)
Date: Sat, 30 Aug 2025 17:53:02 +0000

Your bug report

#79336: [PATCH] df: fix potential null pointer dereference

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
79336: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=79336
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#79336: [PATCH] df: fix potential null pointer dereference
From: Pádraig Brady <[email-masked]>
To: yubiao hu <[email-masked]>, [email-masked]
Date: Sat, 30 Aug 2025 18:52:40 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

On 29/08/2025 02:45, yubiao hu wrote:
> * src/df.c (get_dev): Fix potential null pointer dereference
> - Avoid dereferencing stat_file when both device and
>   mount_point are NULL
> - Handle allocation failure for cell when mount_point
>   is NULL

These are valid concerns.
I also see potential null dereferences of device.
The attached patch takes a different approach
by ensuring arguments are initialized earlier.

Marking this as done.

Will push the attached later.

cheers,
Padraig

From 13a154cd43b241a24dfbb3c6a9d66bfb0a28510e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <[email-masked]>
Date: Sat, 30 Aug 2025 18:48:38 +0100
Subject: [PATCH] df: ensure no null pointer dereferences

* src/df.c (get_dev): Initialise arguments to non null,
to ensure we never dereference null pointer.
Fixes https://bugs.gnu.org/79336
---
 src/df.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/df.c b/src/df.c
index fe2e0e38f..8cfbeb419 100644
--- a/src/df.c
+++ b/src/df.c
@@ -1030,6 +1030,12 @@ get_dev (char const *device, char const *mount_point, char const *file,
   if (!stat_file)
     stat_file = mount_point ? mount_point : device;
 
+  if (! mount_point)
+    mount_point = "-";		/* unspecified */
+
+  if (! device)
+    device = "-";		/* unknown */
+
   struct fs_usage fsu;
   if (force_fsu)
     fsu = *force_fsu;
@@ -1084,12 +1090,6 @@ get_dev (char const *device, char const *mount_point, char const *file,
 
   alloc_table_row ();
 
-  if (! device)
-    device = "-";		/* unknown */
-
-  if (! file)
-    file = "-";			/* unspecified */
-
   char *dev_name = xstrdup (device);
   char *resolved_dev;
 
@@ -1107,6 +1107,9 @@ get_dev (char const *device, char const *mount_point, char const *file,
       dev_name = resolved_dev;
     }
 
+  if (! file)
+    file = "-";			/* unspecified */
+
   if (! fstype)
     fstype = "-";		/* unknown */
 
-- 
2.50.1

Subject: [PATCH] df: fix potential null pointer dereference
From: yubiao hu <[email-masked]>
To: [email-masked]
Date: Fri, 29 Aug 2025 09:45:46 +0800
List-Id: <debbugs-submit.debbugs.gnu.org>

* src/df.c (get_dev): Fix potential null pointer dereference
- Avoid dereferencing stat_file when both device and
 mount_point are NULL
- Handle allocation failure for cell when mount_point
 is NULL

---
 src/df.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/df.c b/src/df.c
index fe2e0e3..f60319c 100644
--- a/src/df.c
+++ b/src/df.c
@@ -1050,7 +1050,7 @@ get_dev (char const *device, char const
*mount_point, char const *file,
         }
       else
         {
-          error (0, errno, "%s", quotef (stat_file));
+          error (0, errno, "%s", quotef (stat_file ? stat_file : "-"));
           exit_status = EXIT_FAILURE;
           return;
         }
@@ -1215,17 +1215,23 @@ get_dev (char const *device, char const
*mount_point, char const *file,
           break;

         case TARGET_FIELD:
+          {
+            if (! mount_point) {
+              cell = xstrdup ("-");
+              break;
+            }
 #ifdef HIDE_AUTOMOUNT_PREFIX
-          /* Don't print the first directory name in MOUNT_POINT if it's an
-             artifact of an automounter.  This is a bit too aggressive to be
-             the default.  */
-          if (STRNCMP_LIT (mount_point, "/auto/") == 0)
-            mount_point += 5;
-          else if (STRNCMP_LIT (mount_point, "/tmp_mnt/") == 0)
-            mount_point += 8;
+            /* Don't print the first directory name in MOUNT_POINT if it's an
+              artifact of an automounter.  This is a bit too aggressive to be
+              the default.  */
+            if (STRNCMP_LIT (mount_point, "/auto/") == 0)
+              mount_point += 5;
+            else if (STRNCMP_LIT (mount_point, "/tmp_mnt/") == 0)
+              mount_point += 8;
 #endif
-          cell = xstrdup (mount_point);
-          break;
+            cell = xstrdup (mount_point);
+            break;
+          }

         case INVALID_FIELD:
         default:
-- 
2.33.0