../src/modules/vfs-search.c:490:47: warning: dereference of NULL ‘value’ [CWE-476] [-Wanalyzer-null-dereference]
490 | priv->show_hidden = (value[0] == '1') ? TRUE : FALSE;
Actually trying to do search with pcmanfm with some crafted URI, with no value causes pcmanfm to segfault:
[tasaka1@localhost ~]$ gdb --args pcmanfm "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1"
GNU gdb (Fedora Linux) 17.1-6.fc44
(gdb) r
Starting program: /usr/bin/pcmanfm search:///home/tasaka1\?recursive=0\&show_hidden\&name=\*xscreensaver\*\&name_ci=1
[Thread debugging using libthread_db enabled]
Thread 6 "pool-0" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe576c6c0 (LWP 124090)]
parse_search_uri (priv=priv@entry=0x7fffc4001920 [FmVfsSearchEnumerator],
uri_str=uri_str@entry=0x7fffc40071f0 "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1")
at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/modules/vfs-search.c:490
490 priv->show_hidden = (value[0] == '1') ? TRUE : FALSE;
(gdb) bt
#0 parse_search_uri
(priv=priv@entry=0x7fffc4001920 [FmVfsSearchEnumerator], uri_str=uri_str@entry=0x7fffc40071f0 "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1") at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/modules/vfs-search.c:490
#1 0x00007fffe463fe00 in _fm_vfs_search_enumerator_new
(file=<optimized out>, path_str=0x7fffc40071f0 "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1", attributes=0x7ffff70c78c0 <gfile_info_query_attribs> "standard::*,unix::*,time::*,access::*,id::filesystem,metadata::emblems", flags=G_FILE_QUERY_INFO_NONE, error=<optimized out>)
at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/modules/vfs-search.c:360
#2 0x00007ffff70a2fbd in fm_dir_list_job_run_gio (job=0xb33830 [FmDirListJob])
at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/job/fm-dir-list-job.c:392
#3 0x00007ffff70a8f99 in job_thread (job=0xb33830 [FmDirListJob], unused=<optimized out>)
at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/job/fm-job.c:371
#4 0x00007ffff6d4803a in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:336
#5 0x00007ffff6d46332 in g_thread_proxy (data=0x7fffd0000b80) at ../glib/gthread.c:897
#6 0x00007ffff6b3fd19 in start_thread (arg=<optimized out>) at pthread_create.c:454
#7 0x00007ffff6bc364c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
gcc16 -fanalyzer -fanalyzer-assume-nothrowwarns:Actually trying to do search with pcmanfm with some crafted URI, with no value causes pcmanfm to segfault: