commit cc3d04f03ac0c3d60d00ae021f41f3610bb3b3eb
author Elliott Hughes <enh@google.com> Thu Oct 26 15:38:06 2017 -0700
committer Elliott Hughes <enh@google.com> Thu Oct 26 16:16:33 2017 -0700
tree 83fc235a8357f5b12802ccc3538dd14d38cef456
parent c6291b081d2089ba7a16d7777fb2713d828d537f

Add null checks to <dirent.h> functions.

Move all the new checks over to the existing __fortify_fatal.

Bug: http://b/67455242
Test: ran tests
Change-Id: Idb899c58c32d52d3b423caf1a91feb7defcba9b3

libc/bionic/dirent.cpp

diff --git a/libc/bionic/dirent.cpp b/libc/bionic/dirent.cpp
index 6fd3842..37a2fa7 100644
--- a/libc/bionic/dirent.cpp
+++ b/libc/bionic/dirent.cpp
@@ -36,6 +36,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#include "private/bionic_fortify.h"
 #include "private/ErrnoRestorer.h"
 #include "private/ScopedPthreadMutexLocker.h"
 
@@ -56,6 +57,8 @@
   long current_pos_;
 };
 
+#define CHECK_DIR(d) if (d == nullptr) __fortify_fatal("%s: null DIR*", __FUNCTION__)
+
 static DIR* __allocate_DIR(int fd) {
   DIR* d = reinterpret_cast<DIR*>(malloc(sizeof(DIR)));
   if (d == NULL) {
@@ -69,8 +72,9 @@
   return d;
 }
 
-int dirfd(DIR* dirp) {
-  return dirp->fd_;
+int dirfd(DIR* d) {
+  CHECK_DIR(d);
+  return d->fd_;
 }
 
 DIR* fdopendir(int fd) {
@@ -93,6 +97,7 @@
 }
 
 static bool __fill_DIR(DIR* d) {
+  CHECK_DIR(d);
   int rc = TEMP_FAILURE_RETRY(__getdents64(d->fd_, d->buff_, sizeof(d->buff_)));
   if (rc <= 0) {
     return false;
@@ -117,12 +122,15 @@
 }
 
 dirent* readdir(DIR* d) {
+  CHECK_DIR(d);
   ScopedPthreadMutexLocker locker(&d->mutex_);
   return __readdir_locked(d);
 }
 __strong_alias(readdir64, readdir);
 
 int readdir_r(DIR* d, dirent* entry, dirent** result) {
+  CHECK_DIR(d);
+
   ErrnoRestorer errno_restorer;
 
   *result = NULL;
@@ -156,6 +164,8 @@
 }
 
 void rewinddir(DIR* d) {
+  CHECK_DIR(d);
+
   ScopedPthreadMutexLocker locker(&d->mutex_);
   lseek(d->fd_, 0, SEEK_SET);
   d->available_bytes_ = 0;
@@ -163,6 +173,8 @@
 }
 
 void seekdir(DIR* d, long offset) {
+  CHECK_DIR(d);
+
   ScopedPthreadMutexLocker locker(&d->mutex_);
   off_t ret = lseek(d->fd_, offset, SEEK_SET);
   if (ret != -1L) {
@@ -172,6 +184,8 @@
 }
 
 long telldir(DIR* d) {
+  CHECK_DIR(d);
+
   return d->current_pos_;
 }