[PATCH] archival: fix DEREF_OF_NULL.RET.STAT in dpkg.c

Anton Moryakov ant.v.moryakov at gmail.com
Wed Jan 29 21:11:25 UTC 2025


Report of the static analyzer:
DEREF_OF_NULL.RET.STAT Return value of a function 'strtok_r' is dereferenced at dpkg.c:450 without checking for NULL, but it is usually checked for this function (23/25).

Corrections explained:
1. Added a check `field2 != NULL` before calling `strcmp`
to prevent dereferencing a NULL pointer.

2. The logic of the function remains unchanged, but now it safely
handles cases where the delimiter '|' is missing.

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov at gmail.com>

---
 archival/dpkg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/archival/dpkg.c b/archival/dpkg.c
index 8031956e9..f3b65ebf4 100644
--- a/archival/dpkg.c
+++ b/archival/dpkg.c
@@ -446,7 +446,7 @@ static void add_split_dependencies(common_node_t *parent_node, const char *whole
 		line2 = xstrdup(field);
 		field2 = strtok_r(line2, "|", &line_ptr2);
 		or_edge = NULL;
-		if ((edge_type == EDGE_DEPENDS || edge_type == EDGE_PRE_DEPENDS)
+		if (field2 != NULL && (edge_type == EDGE_DEPENDS || edge_type == EDGE_PRE_DEPENDS)
 		 && (strcmp(field, field2) != 0)
 		) {
 			or_edge = xzalloc(sizeof(edge_t));
-- 
2.30.2



More information about the busybox mailing list