From 61249e6606513295b9ba5ad9a42cbb3601694d13 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sat, 19 Feb 2022 12:34:25 +0100 Subject: Fix nullptr dereference in utilities whan argv[0] == NULL https://lwn.net/Articles/?offset=50 was an entertaining reading where we learn that the fact that argv[0] contains the name of the binary is purely a convention, normally taken by the shell that launches the process, but not guaranteed by the execve() system call that does the job. The following test program tested against cct, cs2cs, geod, gie and proj make them cause a null pointer dereference ``` #include #include extern char **environ; int main() { char* argv[] = { NULL }; printf("%d\n", execve("/path/to/some/proj/binary", argv, environ)); return 0; } ``` --- src/apps/geod.cpp | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/apps/geod.cpp') diff --git a/src/apps/geod.cpp b/src/apps/geod.cpp index 6e3f059e..4f48a57a 100644 --- a/src/apps/geod.cpp +++ b/src/apps/geod.cpp @@ -136,6 +136,10 @@ int main(int argc, char **argv) { FILE *fid; static int eargc = 0, c; + if( argc == 0 ) { + exit(1); + } + if ((emess_dat.Prog_name = strrchr(*argv,'/')) != nullptr) ++emess_dat.Prog_name; else emess_dat.Prog_name = *argv; inverse = strncmp(emess_dat.Prog_name, "inv", 3) == 0 || -- cgit v1.2.3