Skip to content

dragonflybsd: Fix NULL dereference in jail list parsing #2058

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
GermanAizek wants to merge 1 commit into
base: main
Choose a base branch
from
+10 −3
Open

dragonflybsd: Fix NULL dereference in jail list parsing #2058

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 10 additions & 3 deletions dragonflybsd/DragonFlyBSDMachine.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,22 +323,29 @@ static void DragonFlyBSDMachine_scanJails(DragonFlyBSDMachine* this) {
curpos = jails;
while (curpos) {
int jailid;
char* str_hostname;

nextpos = strchr(curpos, '\n');
if (nextpos) {
*nextpos++ = 0;
}

jailid = atoi(strtok(curpos, " "));
str_hostname = strtok(NULL, " ");
char* str_jailid = strtok(curpos, " ");
if (!str_jailid)
goto next;

char* str_hostname = strtok(NULL, " ");
if (!str_hostname)
goto next;

jailid = atoi(str_jailid);

char* jname = (char*) (Hashtable_get(this->jails, jailid));
if (jname == NULL) {
jname = xStrdup(str_hostname);
Hashtable_put(this->jails, jailid, jname);
Comment on lines +332 to 345

@coderabbitai coderabbitai Bot Aug 5, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/sh
set -eu

file="dragonflybsd/DragonFlyBSDMachine.c"

rg -n -C 10 \
  'jail\.list|str_jailid|atoi|strtol|errno|ERANGE|endptr|INT_(MIN|MAX)' \
  "$file"

Repository: htop-dev/htop

Length of output: 1742

🏁 Script executed:

#!/bin/sh
set -eu

# Locate system headers and run read-only behavioral/source-semantics probes for atoi under the compiler toolchain in the sandbox.
# Do not run repository code; only inspect installed headers and compiler availability.
printf '--- header snippets ---\n'
for f in /usr/include/stdlib.h /usr/include/limits.h /usr/include/errno.h; do
  if [ -f "$f" ]; then
    echo "### $f"
    rg -n -C 4 '^(# *include| *|void|long int|int|atoi|strtol|atoi_.*|__ctype|__is|__ctype_b|ERANGE|INT_MIN|INT_MAX)' "$f" | head -80 || true
  fi
done

printf '\n--- compiler availability ---\n'
command -v cc || true
command -v gcc || true
command -v cc1 || true

if command -v cc >/dev/null 2>&1; then
  printf '\n--- atoi call behavioral probe ---\n'
  cat >/tmp/atoi_probe.c <<'EOF'
`#include` <stdio.h>
`#include` <stdlib.h>
`#include` <string.h>
`#include` <errno.h>

int main(void) {
  const char* inputs[] = {
    "2147483647",      /* INT_MAX */
    "2147483648",      /* INT_MAX+1 */
    "99999999999999999999999999999999",
    "-9223372036854775809",  /* < INT_MIN */
    "",                /* empty */
    "abc",
    "123abc",
    "0",
    "-1"
  };
  for (size_t i = 0; i < sizeof(inputs)/sizeof(inputs[0]); i++) {
    const char* s = inputs[i];
    errno = 0;
    int v = atoi(s);
    char exact[80];
    snprintf(exact, sizeof exact, "%d", v);
    printf("atoi(%-30s) = %s errno=%d\n", s, exact, errno);
  }
  return 0;
}
EOF
  cc -o /tmp/atoi_probe /tmp/atoi_probe.c 2>&1 || true
  if [ -x /tmp/atoi_probe ]; then
    /tmp/atoi_probe || true
  fi
fi

Repository: htop-dev/htop

Length of output: 242

🏁 Script executed:

#!/bin/sh
set -eu

# Locate system headers and run read-only behavioral/source-semantics probes for atoi under the compiler toolchain in the sandbox.
# Do not run repository code; only inspect installed headers and compiler availability.
printf '%s\n' '--- header snippets ---'
for f in /usr/include/stdlib.h /usr/include/limits.h /usr/include/errno.h; do
  if [ -f "$f" ]; then
    echo "### $f"
    rg -n -C 4 '^(# *include| *|void|long int|int|atoi|strtol|atoi_.*|__ctype|__is|__ctype_b|ERANGE|INT_MIN|INT_MAX)' "$f" | head -80 || true
  fi
done

printf '%s\n' ''
printf '%s\n' '--- compiler availability ---'
command -v cc || true
command -v gcc || true
command -v cc1 || true

if command -v cc >/dev/null 2>&1; then
  printf '%s\n' ''
  printf '%s\n' '--- atoi call behavioral probe ---'
  cat >/tmp/atoi_probe.c <<'EOF'
`#include` <stdio.h>
`#include` <stdlib.h>
`#include` <string.h>
`#include` <errno.h>

int main(void) {
  const char* inputs[] = {
    "2147483647",      /* INT_MAX */
    "2147483648",      /* INT_MAX+1 */
    "99999999999999999999999999999999",
    "-9223372036854775809",  /* < INT_MIN */
    "",                /* empty */
    "abc",
    "123abc",
    "0",
    "-1"
  };
  for (size_t i = 0; i < sizeof(inputs)/sizeof(inputs[0]); i++) {
    const char* s = inputs[i];
    errno = 0;
    int v = atoi(s);
    char exact[80];
    snprintf(exact, sizeof exact, "%d", v);
    printf("atoi(%-30s) = %s errno=%d\n", s, exact, errno);
  }
  return 0;
}
EOF
  cc -o /tmp/atoi_probe /tmp/atoi_probe.c 2>&1 || true
  if [ -x /tmp/atoi_probe ]; then
    /tmp/atoi_probe || true
  fi
fi

Repository: htop-dev/htop

Length of output: 364

🌐 Web query:

POSIX atoi return value out of range behavior strtol ERANGE undefined behavior

💡 Result:

Under POSIX and ISO C standards, the behavior of atoi when the input string represents a value outside the range of representable values for an int is undefined [1][2][3]. While atoi is technically defined as equivalent to (int) strtol(str, (char)NULL, 10), it explicitly lacks the error-checking mechanisms provided by strtol [1][2][4]. Specifically: 1. Undefined Behavior: If the converted value cannot be represented in an int, the C and POSIX standards classify the result as undefined behavior [1][3]. 2. Lack of Error Reporting: Unlike strtol, atoi does not provide a reliable way to detect overflows or underflows [1][5]. It does not set errno [6][5], and there is no return value that consistently distinguishes a valid result from an error [6][5]. 3. Interaction with strtol: Although implementations often internally use strtol [1][7], the resulting behavior for the user is still undefined [3]. Because strtol returns LONG_MAX or LONG_MIN and sets errno to ERANGE upon overflow/underflow [8][9][10], casting these values to an int can lead to implementation-defined results, but the standard remains strict in categorizing the overall operation as undefined behavior [1][3]. Because of these limitations, the use of atoi is discouraged in new code [1][2][5]. The strtol family of functions is the recommended alternative, as it allows for robust error checking by: - Setting errno to 0 before the call [8][10]. - Checking for ERANGE after the call to detect if the value was out of range [8][10]. - Using the endptr argument to verify that the entire string was consumed [10][11].

Citations:

🌐 Web query:

DragonFly BSD sysctl jail.list output format jailid hostname jail.list documentation

💡 Result:

In DragonFly BSD, the jail.list sysctl is a key mechanism used to retrieve information about currently running jails [1][2]. Unlike FreeBSD, which provides specific jail-related APIs, DragonFly BSD exposes this information through the jail.list sysctl MIB [1]. Format of jail.list output: The jail.list sysctl returns a list of active jails where each entry is typically separated by a newline character [1]. Each line of the output generally follows this space-separated format [1][2]: [JailID] [Hostname] [Path] [IPs] Example Output: When querying jail.list via sysctl, the output appears as follows [2]: # sysctl jail.list jail.list: 2 t02.local /jails/02 10.0.0.3 1 t01.local /jails/01 10.0.0.2 Technical details: 1. Retrieval: You can retrieve this list programmatically using the sysctlbyname("jail.list", ...) function [1]. Because the output size can vary based on the number of active jails, it is common practice to call the function once to determine the required buffer size, and then again to fetch the actual data [1]. 2. Parsing: Since the output includes newline characters to separate multiple jails and spaces to separate the fields within a line, it can be parsed using standard string manipulation functions such as strchr() for line breaks and strtok() for space-delimited fields [1]. 3. Context: This sysctl is distinct from the per-jail configuration sysctls found under jail.<id>.<setting>, which allow for individual management of jail environments [2]. For general administrative tasks, users typically use the jls(8) command, which presents this information in a more readable format [3].

Citations:

Replace atoi with checked strtol conversion for str_jailid.

atoi can invoke undefined behavior when the jail ID does not fit in int, and it does not report malformed input. Reject entries where the whole token is not a decimal integer in the int range before accessing this->jails. Add <errno.h> and <limits.h> if needed.

🧰 Tools
🪛 ast-grep (0.45.0)

[warning] 339-339: Avoid atoi/atol/atoll/atof: they perform no error detection, returning 0 on non-numeric input and invoking undefined behavior on out-of-range values. This rule flags every use of these functions regardless of data provenance. Convert strings with strtol/strtoul/strtod and check errno (and the endptr) so malformed or overflowing input is rejected.
Context: atoi(str_jailid)
Note: [CWE-20] Improper Input Validation.

(atoi-no-error-detection-c)

Source: Linters/SAST tools

}

next:
curpos = nextpos;
}

Expand Down
Loading