bug#11467: Parfait problems with GNU coreutils

[Rich Burridge]

Hi,

I've been running parfait [1] on GNU coreutils  and it found the following
problems:

Error: Buffer overrun
   Buffer overflow (CWE 120): In array dereference of word_limit[-1] with index 
'-1'
      Array size is 1000 elements (of 28 bytes each), -1 is -1
        at line 590 of components/coreutils/coreutils-8.5/src/fmt.c in function 
'get_paragraph'.
   Read outside array bounds (CWE 125): In array dereference of word_limit[-1] 
with index '-1'
      Array size is 1000 elements (of 28 bytes each), -1 is -1
        at line 590 of components/coreutils/coreutils-8.5/src/fmt.c in function 
'get_paragraph'.
Error: Null pointer dereference (CWE 476)
   Read from null pointer 's'
        at line 3389 of components/coreutils/coreutils-8.5/src/sort.c in 
function 'main'.
          Function 'parse_field_count' may return constant 'NULL' at line 3130, 
called at line 3387.
          Null pointer introduced at line 3130 in function 'parse_field_count'.
Error: Null pointer dereference (CWE 476)
   Read from null pointer 'bitsp'
        at line 1546 of components/coreutils/coreutils-8.5/src/stty.c in 
function 'display_changed'.
          Function 'mode_type_flag' may return constant 'NULL' at line 1453, 
called at line 1544.
          Null pointer introduced at line 1453 in function 'mode_type_flag'.
Error: Null pointer dereference (CWE 476)
   Read from null pointer 'bitsp'
        at line 1623 of components/coreutils/coreutils-8.5/src/stty.c in 
function 'display_all'.
          Function 'mode_type_flag' may return constant 'NULL' at line 1453, 
called at line 1621.
          Null pointer introduced at line 1453 in function 'mode_type_flag'.
Error: Null pointer dereference (CWE 476)
   Read from null pointer 'bitsp'
        at line 1838 of components/coreutils/coreutils-8.5/src/stty.c in 
function 'sane_mode'.
          Function 'mode_type_flag' may return constant 'NULL' at line 1453, 
called at line 1837.
          Null pointer introduced at line 1453 in function 'mode_type_flag'.
        at line 1843 of components/coreutils/coreutils-8.5/src/stty.c in 
function 'sane_mode'.
          Function 'mode_type_flag' may return constant 'NULL' at line 1453, 
called at line 1842.
          Null pointer introduced at line 1453 in function 'mode_type_flag'.
Error: Null pointer dereference (CWE 476)
   Write to null pointer 'bitsp'
        at line 1838 of components/coreutils/coreutils-8.5/src/stty.c in 
function 'sane_mode'.
          Function 'mode_type_flag' may return constant 'NULL' at line 1453, 
called at line 1837.
          Null pointer introduced at line 1453 in function 'mode_type_flag'.
        at line 1843 of components/coreutils/coreutils-8.5/src/stty.c in 
function 'sane_mode'.
          Function 'mode_type_flag' may return constant 'NULL' at line 1453, 
called at line 1842.
          Null pointer introduced at line 1453 in function 'mode_type_flag'.



I've attached a patch that we are applying to the code to fix these problems.

Here's the evaluation of why the changes have been made:

There are three different types of Parfait errors here:

1/ In fmt.c, in the get_paragraph() routine, Parfait thinks that there
   is a potential problem of a negative index into the 'word' array.
   But that situation is impossible. Earlier in the routine, get_line()
   is called, and this has to have incremented word_limit. The solution
   was to add a Parfait style comment before the offending line of code
   to shut parfait up.

2/ In sort.c, there is an occurrence in the main() routine where 's' was
   being dereferenced, but it could have been NULL. A check was added
   to only do the dereferencing if that wasn't the case. It was noticed
   that there was already similar code in the same routine, so this seems
   a reasonable solution.

3/ In stty.c, there were two occurrences where bitsp was being dereferenced
   that could have been a NULL pointer. In each case, a check was added
   to only do the dereferencing if that wasn't the case. It was noticed
   that there was already similar code in the sane_mode() routine, so this
   seems a reasonable solution.



These changes make us "parfait clean".

I realize there is a later version of GNU coreutils, but this is the version 
that currently
ships with Solaris 11. If these problems still exist in the current version, 
(and assuming
you think these changes are good), hopefully you'll like to make similar changes
in the next version of GNU coreutils.

Thanks.

[1] http://labs.oracle.com/projects/parfait/

parfait-fix.patch
Description: Text document