Re: [PATCH] invalid-null-argument outmem() src/output.c:149:17

31/07/25 20:33, Aleksander Ushakov wrote:
> Hello Dash maintainers,
> 
> I encountered a bug in Dash in commit b4ef25d7 and would like to report
> it. The details are provided below.
> 
> output.c:149:25: runtime error: null pointer passed as argument 1, which 
> is declared to never be null
> /usr/include/string.h:402:14: note: nonnull attribute specified here
>      #0 0x5f7d3a71f5d6 in outmem /upstream/ubsan/dash/src/output.c:149:17
>      #1 0x5f7d3a720841 in doformat /upstream/ubsan/dash/src/output.c:343:2
>      #2 0x5f7d3a7208f8 in out1fmt /upstream/ubsan/dash/src/output.c:275:2
>      #3 0x5f7d3a721d96 in printfcmd /upstream/ubsan/dash/src/bltin/ 
> printf.c:232:5
>      #4 0x5f7d3a6ddc85 in evalbltin /upstream/ubsan/dash/src/eval.c:975:12
>      #5 0x5f7d3a6d8ef4 in evalcommand /upstream/ubsan/dash/src/eval.c:923:7
>      #6 0x5f7d3a6d60ac in evaltree /upstream/ubsan/dash/src/eval.c:305:12
>      #7 0x5f7d3a70218c in cmdloop /upstream/ubsan/dash/src/main.c:246:8
>      #8 0x5f7d3a701e4b in main /upstream/ubsan/dash/src/main.c:180:3
>      #9 0x724e14494249 in __libc_start_call_main csu/../sysdeps/nptl/ 
> libc_start_call_main.h:58:16
>      #10 0x724e14494304 in __libc_start_main csu/../csu/libc-start.c:360:3
>      #11 0x5f7d3a6a4930 in _start (/upstream/ubsan/dash/src/ 
> dash+0x42930) (BuildId: 096851211111e4d689a2ea0deb5b5d647b8ebd40)
> 
> SUMMARY: UndefinedBehaviorSanitizer: invalid-null-argument output.c:149:25
> 
> 
> Environment:
> 
> Debian-12, x86-64
> clang-19 compiler
> 
> Steps to reproduce:
> 
> ./autogen.sh
> CC=clang CFLAGS=" -fsanitize=undefined -g " ./configure --disable-fnmatch
> --disable-lineno --disable-glob
> make
> cd src
> echo -e '""printf "%s"""' | ./dash


Also the patch fix the problem (just add conditional statement). I'm not 
sure if this affects the translator's functionality.

diff --git a/src/output.c b/src/output.c
index e9ee9b4..e97c570 100644
--- a/src/output.c
+++ b/src/output.c
@@ -146,7 +146,8 @@ outmem(const char *p, size_t len, struct output *dest)
         nleft = dest->end - dest->nextc;
         if (likely(nleft >= len)) {
  buffered:
-               dest->nextc = mempcpy(dest->nextc, p, len);
+               if (dest->nextc)
+                       dest->nextc = mempcpy(dest->nextc, p, len);
                 return;
         }