Re: Null pointer dereference in diversion flushing logic (GNU M4 1.4.19 & 1.4.20)

Ashok Kumawat <[email protected]> writes:

> *Hello M4 Maintainers,*
>
> I encountered a null pointer dereference in GNU M4 1.4.19 while building
> and using it in my environment. The issue occurs in the diversion flushing
> code when output_diversion is NULL.
> *Environment*
>
>
>    - M4 1.4.19
>    -
>
>    GCC 14.2.0
>    -
>
>    Ubuntu 24.04.3 LTS (Linux 6.14.0-27-generic x86_64)
>
> Problem Description
>
> In the diversion flush logic, the following code assumes output_diversion
> is non-NULL. If output_diversion is NULL, the dereference
> output_diversion->u.file causes a segmentation fault. I have attached the
> screenshot of the error.
>
> *ORIGINAL CODE:*
>
> if (output_diversion == selected_diversion)
> {
>   output_file = output_diversion->u.file;
>   output_cursor = NULL;
>   output_unused = 0;
> }
>
> *PROPOSED FIX:*
> if (output_diversion && output_diversion == selected_diversion)
> {
>   output_file = output_diversion->u.file;
>   output_cursor = NULL;
>   output_unused = 0;
> }
> This additional check prevents the null pointer dereference. Using this
> corrected code, I was able to compile M4 successfully.

This warning is a false positive reported here [1]. The 1.4.20 release
contains this commit:

    commit 773a5ca13fb1ba562f3474b118e4ca7b531ab198
    Author:     Bruno Haible <[email protected]>
    AuthorDate: Tue Aug 20 03:27:43 2024 +0200
    Commit:     Paul Eggert <[email protected]>
    CommitDate: Mon Dec 2 11:58:27 2024 -0800
    
        maint: Avoid a gcc 14 warning that makes --enable-gcc-warnings break.
        
        * src/output.c: Disable -Wnull-dereference warnings in this file.

Which silences it.

Collin

[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116426