GNU bug report logs - #79336
[PATCH] df: fix potential null pointer dereference

Previous Next

Full log

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: yubiao hu <huyubiaox <at> gmail.com>
To: bug-coreutils <at> gnu.org
Subject: [PATCH] df: fix potential null pointer dereference
Date: Fri, 29 Aug 2025 09:45:46 +0800

* src/df.c (get_dev): Fix potential null pointer dereference
- Avoid dereferencing stat_file when both device and
 mount_point are NULL
- Handle allocation failure for cell when mount_point
 is NULL

---
 src/df.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/df.c b/src/df.c
index fe2e0e3..f60319c 100644
--- a/src/df.c
+++ b/src/df.c
@@ -1050,7 +1050,7 @@ get_dev (char const *device, char const
*mount_point, char const *file,
         }
       else
         {
-          error (0, errno, "%s", quotef (stat_file));
+          error (0, errno, "%s", quotef (stat_file ? stat_file : "-"));
           exit_status = EXIT_FAILURE;
           return;
         }
@@ -1215,17 +1215,23 @@ get_dev (char const *device, char const
*mount_point, char const *file,
           break;

         case TARGET_FIELD:
+          {
+            if (! mount_point) {
+              cell = xstrdup ("-");
+              break;
+            }
 #ifdef HIDE_AUTOMOUNT_PREFIX
-          /* Don't print the first directory name in MOUNT_POINT if it's an
-             artifact of an automounter.  This is a bit too aggressive to be
-             the default.  */
-          if (STRNCMP_LIT (mount_point, "/auto/") == 0)
-            mount_point += 5;
-          else if (STRNCMP_LIT (mount_point, "/tmp_mnt/") == 0)
-            mount_point += 8;
+            /* Don't print the first directory name in MOUNT_POINT if it's an
+              artifact of an automounter.  This is a bit too aggressive to be
+              the default.  */
+            if (STRNCMP_LIT (mount_point, "/auto/") == 0)
+              mount_point += 5;
+            else if (STRNCMP_LIT (mount_point, "/tmp_mnt/") == 0)
+              mount_point += 8;
 #endif
-          cell = xstrdup (mount_point);
-          break;
+            cell = xstrdup (mount_point);
+            break;
+          }

         case INVALID_FIELD:
         default:
-- 
2.33.0

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.