Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I thought Linus' rant was about NULL checks that came after a dereference had already happened. In that case it at least makes sense that the compiler would assume the NULL check would be superfluous.

IIRC it was an early return from the function rather than an exit function, something like.

    SOMETHING settings = *p;
    if(p == null)
      return;
    do_dangerous_stuff();
And the compiler produced something that unconditionally did the dangerous stuff.


At least if I'm thinking of the same bug the code was this [0]:

    static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
    {
 struct tun_file *tfile = file->private_data;
 struct tun_struct *tun = __tun_get(tfile);
 struct sock *sk = tun->sk; // Dereference before null check!
 unsigned int mask = 0;

 if (!tun)
            return POLLERR;
I haven't been able to find Linus's rant, so I'm not totally convinced that I have the right thing.

[0]: https://lwn.net/Articles/342330/




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: